eJPT Reporting and Communication 4 — Questions and Answers
Question 1: What is a 'finding' in a penetration test report?
- A tool the tester used during the engagement
- A documented vulnerability or security weakness discovered during testing, including evidence and impact (Correct answer)
- The final score given to the client's overall security posture
- A log of all network packets captured during the test
Correct answer: A documented vulnerability or security weakness discovered during testing, including evidence and impact
A finding is a documented security issue with evidence, severity rating, impact description, and remediation guidance included in the report.
Question 2: Why is a penetration test report marked 'CONFIDENTIAL' or 'RESTRICTED'?
- To comply with CVSS scoring requirements
- Because it contains a detailed roadmap of exploitable weaknesses that could be used by attackers if disclosed (Correct answer)
- To prevent the client from sharing it with their own IT staff
- Because penetration testers are required to keep all client communications secret forever
Correct answer: Because it contains a detailed roadmap of exploitable weaknesses that could be used by attackers if disclosed
A pentest report is a sensitive document because it details exactly how to compromise the client's systems; unauthorized disclosure could enable real attacks.
Question 3: What should a tester do if they discover evidence of an active breach by a third party during a penetration test?
- Continue testing without interruption to maintain neutrality
- Clean up the attacker's tools before notifying the client
- Immediately stop testing and notify the client so they can initiate incident response (Correct answer)
- Document it in the final report and wait until testing is complete
Correct answer: Immediately stop testing and notify the client so they can initiate incident response
Discovering an active breach requires immediate client notification so they can engage incident response; continuing to test could destroy forensic evidence.
Question 4: In the context of penetration test reporting, what is 'risk rating' typically based on?
- The tester's personal opinion of the vulnerability's importance
- A combination of likelihood of exploitation and potential impact on the organization (Correct answer)
- The age of the CVE associated with the vulnerability
- The number of tools required to exploit the vulnerability
Correct answer: A combination of likelihood of exploitation and potential impact on the organization
Risk rating combines likelihood (how probable exploitation is) with impact (how severe the consequences would be) to produce a meaningful priority score.
Question 5: A client's development team says they cannot reproduce a finding you documented. What should you do?
- Delete the finding from the report immediately
- Provide additional technical detail, screenshots, or offer a live demonstration to help them reproduce it (Correct answer)
- Increase the severity rating to draw more attention to the issue
- Blame the development team for not understanding the report
Correct answer: Provide additional technical detail, screenshots, or offer a live demonstration to help them reproduce it
Supporting the client in reproducing findings through additional evidence or walkthroughs ensures the vulnerability is properly understood and addressed.
Question 6: Which element is essential to include when reporting a network-level vulnerability such as an open port exposing a vulnerable service?
- The cost of the server hardware
- IP address, port number, service version, CVE reference, and evidence of exploitability (Correct answer)
- A photograph of the physical server rack
- The names of all administrators with access to that server
Correct answer: IP address, port number, service version, CVE reference, and evidence of exploitability
Network vulnerability findings require precise technical identifiers — host, port, service, version, CVE — along with exploitation evidence so the team can locate and fix the issue.
Question 7: What is the key difference between 'false positive' and 'false negative' in penetration test findings?
- A false positive is a finding that is real; a false negative is one that is fabricated
- A false positive reports a vulnerability that does not actually exist; a false negative misses a real vulnerability (Correct answer)
- False positives are high severity; false negatives are low severity
- False positives occur in automated scans; false negatives only occur in manual testing
Correct answer: A false positive reports a vulnerability that does not actually exist; a false negative misses a real vulnerability
False positives waste remediation effort on non-issues, while false negatives leave real vulnerabilities undiscovered and unfixed — both reduce report quality.
eJPT Reporting and Communication 4
What is a 'finding' in a penetration test report?