eJPT Reporting and Communication 3

Question 1

Which document formally defines the legal boundaries and authorization for a penetration test?

Accepted Answer

The rules of engagement (RoE) / statement of work

Answer

The rules of engagement or statement of work legally authorizes the test, defines scope, timing, and allowed techniques, protecting both parties.

Question 2

When communicating findings verbally during a debriefing, what should a penetration tester prioritize for a mixed technical and executive audience?

Accepted Answer

Leading with business risk and impact before diving into technical details

Answer

Mixed audiences require starting with business impact so executives understand risk, then providing technical depth for the engineering team.

Question 3

What is the main difference between a vulnerability assessment report and a penetration test report?

Accepted Answer

A penetration test report includes active exploitation evidence, while a vulnerability assessment only identifies potential weaknesses

Answer

Penetration test reports document actual exploitation chains and confirmed impact, whereas vulnerability assessments list identified weaknesses without necessarily exploiting them.

Question 4

A client asks you to remove a high-severity finding from the final report because it is embarrassing. What should you do?

Accepted Answer

Decline and explain that accurate reporting is essential for their security improvement

Answer

Altering or omitting findings compromises the integrity of the report and may expose the client to continued risk; professional ethics require accurate reporting.

Question 5

What is the purpose of including a 'remediation' or 'recommendation' section in a penetration test report?

Accepted Answer

To provide actionable steps the client can take to fix identified vulnerabilities

Answer

Remediation recommendations give the client a clear path to fixing vulnerabilities, turning the report from a problem list into an actionable security improvement plan.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Reporting and Communication 3