eJPT Reporting and Communication 5 — Questions and Answers
Question 1: Why should penetration testers maintain detailed notes and logs throughout the engagement?
- To bill the client for more hours
- To support accurate reporting, provide evidence for findings, and enable recreation of the testing timeline if disputed (Correct answer)
- To share techniques publicly after the engagement
- To comply with OWASP Top 10 requirements
Correct answer: To support accurate reporting, provide evidence for findings, and enable recreation of the testing timeline if disputed
Detailed logs and notes form the evidentiary basis for the final report and protect the tester legally if the engagement or its findings are ever questioned.
Question 2: Which of the following best describes 'remediation verification' in the context of penetration testing?
- The process of verifying the tester's credentials before the engagement begins
- A follow-up assessment to confirm that reported vulnerabilities have been successfully fixed (Correct answer)
- Checking that the client paid the invoice before delivering the report
- Running automated scans immediately after the initial report is written
Correct answer: A follow-up assessment to confirm that reported vulnerabilities have been successfully fixed
Remediation verification (also called retesting) confirms that the client's fixes actually close the vulnerabilities identified in the original penetration test.
Question 3: A tester's automated scanner reports 200 vulnerabilities. What is the professional approach before including these in the final report?
- Include all 200 automatically to maximize the report's value
- Manually validate each finding to eliminate false positives before reporting (Correct answer)
- Include only the top 10 most severe without validation
- Send the raw scanner output directly to the client as the final report
Correct answer: Manually validate each finding to eliminate false positives before reporting
Automated scanner output must be manually validated because scanners produce false positives; reporting unvalidated results wastes client remediation resources.
Question 4: What does 'attack narrative' or 'attack chain' in a penetration test report describe?
- A list of all usernames and passwords discovered during the test
- A chronological story showing how individual vulnerabilities were chained together to achieve a significant compromise (Correct answer)
- The legal contract authorizing the penetration test
- A summary of all tools available to penetration testers
Correct answer: A chronological story showing how individual vulnerabilities were chained together to achieve a significant compromise
An attack narrative shows how low-to-medium findings can be combined into a realistic attack path, helping clients understand compounded risk beyond individual vulnerabilities.
Question 5: Which of the following is a key characteristic of a well-written vulnerability description in a penetration test report?
- Written in highly technical jargon to demonstrate the tester's expertise
- Clear, concise language that explains what the vulnerability is, why it matters, and how it was confirmed (Correct answer)
- Focused entirely on theoretical risk without any evidence
- Copied verbatim from NVD/CVE database descriptions without customization
Correct answer: Clear, concise language that explains what the vulnerability is, why it matters, and how it was confirmed
Effective vulnerability descriptions use accessible language tied to the client's specific environment, combining technical accuracy with business context.
Question 6: What is the purpose of including a 'scope' section in a penetration test report?
- To list all vulnerabilities that were out of scope
- To clearly define what systems, networks, and applications were tested so the reader understands the coverage and limitations (Correct answer)
- To describe the tester's professional certifications
- To document the client's internal security policies
Correct answer: To clearly define what systems, networks, and applications were tested so the reader understands the coverage and limitations
The scope section establishes the boundaries of the assessment so stakeholders understand what was tested, what was excluded, and where risk may still exist outside tested areas.
Question 7: After delivering a penetration test report, the client asks you to sign an NDA retroactively. What is the professional best practice?
- Refuse because NDAs must be signed after delivery to be valid
- Agree, since confidentiality agreements protect both parties and signing retroactively is standard practice
- Insist that NDAs and confidentiality terms should always be agreed upon and signed before the engagement begins (Correct answer)
- Share the report publicly before signing to maintain transparency
Correct answer: Insist that NDAs and confidentiality terms should always be agreed upon and signed before the engagement begins
NDAs and confidentiality agreements should be established before testing begins to protect client data throughout the entire engagement, not just after delivery.
eJPT Reporting and Communication 5
Why should penetration testers maintain detailed notes and logs throughout the engagement?