eJPT Reporting and Communication 4

Question 1

What is a 'finding' in a penetration test report?

Accepted Answer

A documented vulnerability or security weakness discovered during testing, including evidence and impact

Answer

A finding is a documented security issue with evidence, severity rating, impact description, and remediation guidance included in the report.

Question 2

Why is a penetration test report marked 'CONFIDENTIAL' or 'RESTRICTED'?

Accepted Answer

Because it contains a detailed roadmap of exploitable weaknesses that could be used by attackers if disclosed

Answer

A pentest report is a sensitive document because it details exactly how to compromise the client's systems; unauthorized disclosure could enable real attacks.

Question 3

What should a tester do if they discover evidence of an active breach by a third party during a penetration test?

Accepted Answer

Immediately stop testing and notify the client so they can initiate incident response

Answer

Discovering an active breach requires immediate client notification so they can engage incident response; continuing to test could destroy forensic evidence.

Question 4

In the context of penetration test reporting, what is 'risk rating' typically based on?

Accepted Answer

A combination of likelihood of exploitation and potential impact on the organization

Answer

Risk rating combines likelihood (how probable exploitation is) with impact (how severe the consequences would be) to produce a meaningful priority score.

Question 5

A client's development team says they cannot reproduce a finding you documented. What should you do?

Accepted Answer

Provide additional technical detail, screenshots, or offer a live demonstration to help them reproduce it

Answer

Supporting the client in reproducing findings through additional evidence or walkthroughs ensures the vulnerability is properly understood and addressed.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Reporting and Communication 4