eJPT Reporting and Communication 3 — Questions and Answers
Question 1: Which document formally defines the legal boundaries and authorization for a penetration test?
- The penetration test report
- The rules of engagement (RoE) / statement of work (Correct answer)
- The CVSS scoring sheet
- The tester's resume
Correct answer: The rules of engagement (RoE) / statement of work
The rules of engagement or statement of work legally authorizes the test, defines scope, timing, and allowed techniques, protecting both parties.
Question 2: When communicating findings verbally during a debriefing, what should a penetration tester prioritize for a mixed technical and executive audience?
- Reading the full technical findings section aloud
- Leading with business risk and impact before diving into technical details (Correct answer)
- Focusing only on low and informational findings to avoid alarm
- Using only technical jargon to appear credible
Correct answer: Leading with business risk and impact before diving into technical details
Mixed audiences require starting with business impact so executives understand risk, then providing technical depth for the engineering team.
Question 3: What is the main difference between a vulnerability assessment report and a penetration test report?
- A penetration test report includes active exploitation evidence, while a vulnerability assessment only identifies potential weaknesses (Correct answer)
- A vulnerability assessment is longer and more detailed
- Penetration test reports never include remediation advice
- Vulnerability assessments require signed authorization but penetration tests do not
Correct answer: A penetration test report includes active exploitation evidence, while a vulnerability assessment only identifies potential weaknesses
Penetration test reports document actual exploitation chains and confirmed impact, whereas vulnerability assessments list identified weaknesses without necessarily exploiting them.
Question 4: A client asks you to remove a high-severity finding from the final report because it is embarrassing. What should you do?
- Remove it immediately to maintain the client relationship
- Remove it but keep a private copy for your records
- Decline and explain that accurate reporting is essential for their security improvement (Correct answer)
- Change it to a low-severity finding as a compromise
Correct answer: Decline and explain that accurate reporting is essential for their security improvement
Altering or omitting findings compromises the integrity of the report and may expose the client to continued risk; professional ethics require accurate reporting.
Question 5: What is the purpose of including a 'remediation' or 'recommendation' section in a penetration test report?
- To increase the page count and justify the project cost
- To provide actionable steps the client can take to fix identified vulnerabilities (Correct answer)
- To list alternative testing tools the client should purchase
- To document the tester's methodology for future reference
Correct answer: To provide actionable steps the client can take to fix identified vulnerabilities
Remediation recommendations give the client a clear path to fixing vulnerabilities, turning the report from a problem list into an actionable security improvement plan.
Question 6: During a black-box penetration test engagement, the tester unexpectedly gains domain admin access. What is the appropriate next step?
- Immediately notify the client contact and pause or continue per the agreed escalation procedure (Correct answer)
- Create a new admin account for persistent access and continue testing silently
- Delete all logs to cover tracks and document it only in the final report
- Exfiltrate a sample of data to prove the impact, then notify the client
Correct answer: Immediately notify the client contact and pause or continue per the agreed escalation procedure
Gaining domain admin is a critical milestone that should trigger immediate client notification per the rules of engagement to ensure proper oversight.
Question 7: Which CVSS metric group assesses how the vulnerability affects systems beyond the directly vulnerable component?
- Base Score - Attack Vector
- Temporal Score - Exploit Code Maturity
- Base Score - Scope (Correct answer)
- Environmental Score - Modified Impact
Correct answer: Base Score - Scope
The Scope metric in CVSS Base Score indicates whether exploitation can impact components beyond the vulnerable component's authorization scope.
eJPT Reporting and Communication 3
Which document formally defines the legal boundaries and authorization for a penetration test?