eJPT Reporting and Communication 2 — Questions and Answers
Question 1: What is the primary purpose of an executive summary in a penetration test report?
- To list every vulnerability found with CVSS scores
- To provide a high-level overview of findings for non-technical stakeholders (Correct answer)
- To document the exact commands run during testing
- To describe the methodology used by the tester
Correct answer: To provide a high-level overview of findings for non-technical stakeholders
The executive summary communicates risk and business impact at a level appropriate for management and executives who may not have technical backgrounds.
Question 2: During a penetration test, you discover a critical vulnerability. The client's system admin is not available. What is the correct communication action?
- Continue testing and document it in the final report only
- Exploit it fully to demonstrate impact, then report later
- Escalate immediately to the designated point of contact per the rules of engagement (Correct answer)
- Patch the vulnerability yourself to protect the client
Correct answer: Escalate immediately to the designated point of contact per the rules of engagement
Rules of engagement typically define escalation paths for critical findings; following this path ensures timely client awareness and proper authorization.
Question 3: Which section of a penetration test report would contain step-by-step reproduction instructions for a SQL injection finding?
- Executive Summary
- Scope and Methodology
- Technical Findings / Vulnerability Details (Correct answer)
- Remediation Roadmap
Correct answer: Technical Findings / Vulnerability Details
Technical findings sections include proof-of-concept steps, screenshots, and payloads so the client's team can reproduce and verify the vulnerability.
Question 4: What does 'scope creep' mean in the context of a penetration test engagement?
- The tester improving their skills mid-engagement
- Testing systems or assets not explicitly authorized in the rules of engagement (Correct answer)
- Adding more remediations to the final report
- Increasing the CVSS score of a vulnerability after further analysis
Correct answer: Testing systems or assets not explicitly authorized in the rules of engagement
Scope creep refers to testing beyond the agreed boundaries, which can create legal and contractual issues for both the tester and client.
Question 5: A penetration tester rates a vulnerability as 'High' severity. Which factor most directly influences this severity rating?
- The number of hours spent exploiting it
- The combination of exploitability and potential business impact (Correct answer)
- Whether the client has heard of the vulnerability before
- The length of the CVE description
Correct answer: The combination of exploitability and potential business impact
Severity ratings consider both how easily a vulnerability can be exploited and what damage successful exploitation would cause to the organization.
Question 6: What is the correct way to handle sensitive client data (e.g., captured credentials) discovered during a penetration test?
- Store them in a personal cloud account for easy access
- Use them to access additional systems not in scope to demonstrate further impact
- Securely document them in the report and delete all copies after delivery per the contract (Correct answer)
- Share them with the client's competitors as a warning
Correct answer: Securely document them in the report and delete all copies after delivery per the contract
Ethical handling requires securing discovered data, reporting it appropriately, and disposing of it according to contractual and legal obligations.
Question 7: In a penetration test report, what does a 'proof of concept' (PoC) typically include?
- A business case for why the client should hire more testers
- Screenshots, commands, or code that demonstrates the vulnerability is exploitable (Correct answer)
- A list of all tools installed on the tester's machine
- The client's network diagram
Correct answer: Screenshots, commands, or code that demonstrates the vulnerability is exploitable
A PoC provides reproducible evidence — such as screenshots, tool output, or exploit code — proving that a vulnerability is real and exploitable.
eJPT Reporting and Communication 2
What is the primary purpose of an executive summary in a penetration test report?