4.2 Findings Analysis and Remediation Recommendations

Objective 1.5 is the matching drill that follows the report structure in 1.4: given a finding, recommend the appropriate remediation and name the control category. PT0-003 sorts fixes into technical, administrative, operational, and physical. Exam items rarely ask whether SQL injection is bad. They ask whether the answer is parameterized queries, a mantrap, or job rotation.

Technical controls

Technical controls are implemented in systems, code, cryptography, and infrastructure. Learn each official bullet as a finding → fix pair.

System hardening removes or locks unused services, default accounts, open management ports, and insecure defaults (guest logins, debug endpoints, world-writable shares). CIS Benchmarks and vendor-hardening guides are the usual pattern. A finding of RDP on the internet with NTLM and no lockout is a hardening problem, not a training problem.

Sanitize user input / parameterize queries is the canonical fix for injection. SQL injection on a login form is not "add a WAF and hope." Use parameterized queries (prepared statements) so user input cannot change the statement structure, and sanitize or encode output to reduce XSS. Input validation complements parameterization; it does not replace it. When the stem is SQLi, this is the technical control CompTIA wants named.

Multifactor authentication (MFA) answers credential reuse, password spray, and many phishing-adjacent findings. If testers logged in with a password from a dump, MFA plus a password policy is the pair. MFA is technical; the policy that requires it is administrative.

Encryption covers data in transit (TLS) and at rest (disk, backups, database TDE). HTTP on the payroll host, or unencrypted backups on a file share, maps here — not to cameras on the tape shelf.

Process-level remediation lives at the service or process, not only the OS image: disable a dangerous handler, constrain a service account, restart and replace a compromised worker, apply an application allow-list, or isolate a daemon running as SYSTEM. When the exam says the patch was applied but the vulnerable process is still loaded, the missing piece is process-level remediation.

Patch management is the program that gets vendor fixes onto hosts in a defined window, with inventory coverage. A one-off hotfix on the box you happened to test is not a program. Recommend patch management when the finding is an unpatched CVE that should have been caught by a cadence, not when the only bug is concatenated SQL in new code.

Key rotation is what you recommend when testers stole an SSH key, an API token, or a TLS private key. Changing the portal password is not the same as rotating the compromised key and killing sessions that still hold it.

Certificate management covers issuance, inventory, expiration, revocation, and pinning policy. A stolen TLS key is key rotation plus certificate management: revoke, re-issue, deploy the new certificate, and confirm a forgotten load balancer is not still serving the old one.

Secrets management solution replaces hardcoded passwords, .env files in git, and default postgres credentials sitting in a wiki. Vault-style tools, cloud secret stores, and short-lived credentials belong here. Telling developers to "pick a stronger string" without a secrets manager just moves the sticky note.

Network segmentation answers overly broad security groups, flat VLANs, and any/any east-west paths. Testers who jumped from a kiosk VLAN into SCADA, or from a DMZ web server into payroll, should get segmentation (often with identity-aware controls), not only a patch on the first host.

Infrastructure security controls are the platform guardrails: security groups, NACLs, WAF policy, EDR, hardened gold images, jump hosts, and cloud organization SCPs. Use this bullet when the finding is "the environment had no guardrail," not when the finding is a single missing parameterized query.

Administrative, operational, and physical controls

Administrative controls are policies, identity models, and how software is allowed to be built and approved.

Administrative list

• Role-based access control (RBAC) — least privilege by job function, not a shared "admin" for everyone in IT.
• Secure software development life cycle (secure SDLC) — threat modeling, code review, SAST/DAST gates, and no production deploy of unparameterized SQL. Injection that returns every quarter is an SDLC failure as well as a code bug.
• Minimum password requirements — length, complexity or passphrase rules, bans on defaults and reuse, and whatever rotation the client's policy still requires.
• Policies and procedures — acceptable use, privileged access, change control, incident response, vendor access. A missing procedure is why a "temporary" default password lasted three years.

Operational controls are how people work day to day. They do not compile, and they do not lock a door.

• Job rotation — no single admin is the only person who ever sees the payroll job or the HSM.
• Time-of-day restrictions — service accounts or remote admin that should not authenticate at 03:00 when testers did.
• Mandatory vacations — collusion and fraud control: someone else runs the process while the usual operator is out.
• User training — phishing clicks, USB pickup, password sharing, tailgating awareness. Training is the answer when the finding is human behavior, not when the login API concatenates SQL.

Physical controls stop body and media attacks.

• Access control vestibule (mantrap / two-door sally port) — so tailgating cannot walk a stranger to the server cage.
• Biometric controls — fingerprint, face, or iris in addition to a badge testers cloned.
• Video surveillance — cameras with retention, aimed at vestibules, racks, and USB-facing workstations.

Worked example: login SQL plus default postgres

Testers found the internet-facing login concatenating SQL, and the application database still using the vendor default postgres password (also pasted in an internal wiki). That is two findings with a shared root: secrets and query handling were never treated as controlled engineering.

Technical: parameterize the login queries and sanitize input; put the database credential in a secrets management solution and rotate it off the default; harden postgres (no remote superuser from the DMZ, disable unused extensions); patch the database and application stack; add infrastructure guards (WAF as defense-in-depth, security groups that do not expose 5432 to the world); encrypt client connections. If a key or certificate was copied during the chain, rotate keys and fix certificate management. If a compromised worker is still running, add process-level remediation.

Administrative: enforce a secure SDLC so this query pattern cannot ship (code review plus SAST); set minimum password requirements and a policy that forbids default and wiki-stored secrets; apply RBAC so developers do not share the production superuser; write procedures for secret checkout and production change control.

Do not recommend a vestibule as the SQL fix, and do not recommend parameterized queries as the tailgating fix. Category first, then the specific control.

free PenTest+ practice questionsPractice questions with detailed explanations

Choosing the control the exam is scoring

Read the finding's root and the asked category. "Employees hold doors" is physical and operational (vestibule, cameras, training), not encryption. "Any/any security group" is segmentation and infrastructure controls, not mandatory vacation. "Same password everywhere" is MFA plus password policy. "Help desk never takes leave and is the only team with the break-glass password" is job rotation, mandatory vacations, and RBAC. Stacked recommendations are allowed and often required — 1.5 is not a single-checkbox objective. Write the guidance in the report's recommendations section so a sysadmin can implement the technical fix while leadership funds the policy and the vestibule.