CISSP Practice Question! · CISSP Study Group

CISSP Practice Question!

During a penetration test, the red team discovers a critical vulnerability in a production system that could allow full privilege escalation. From a CISSP perspective, what’s the right next step, should they exploit it fully to prove impact, or stop short and document the finding? How do you balance business risk, liability, and the test’s objectives?

9 comments