eJPT Reporting and Communication 5

Question 1

Why should penetration testers maintain detailed notes and logs throughout the engagement?

Accepted Answer

To support accurate reporting, provide evidence for findings, and enable recreation of the testing timeline if disputed

Answer

Detailed logs and notes form the evidentiary basis for the final report and protect the tester legally if the engagement or its findings are ever questioned.

Question 2

Which of the following best describes 'remediation verification' in the context of penetration testing?

Accepted Answer

A follow-up assessment to confirm that reported vulnerabilities have been successfully fixed

Answer

Remediation verification (also called retesting) confirms that the client's fixes actually close the vulnerabilities identified in the original penetration test.

Question 3

A tester's automated scanner reports 200 vulnerabilities. What is the professional approach before including these in the final report?

Accepted Answer

Manually validate each finding to eliminate false positives before reporting

Answer

Automated scanner output must be manually validated because scanners produce false positives; reporting unvalidated results wastes client remediation resources.

Question 4

What does 'attack narrative' or 'attack chain' in a penetration test report describe?

Accepted Answer

A chronological story showing how individual vulnerabilities were chained together to achieve a significant compromise

Answer

An attack narrative shows how low-to-medium findings can be combined into a realistic attack path, helping clients understand compounded risk beyond individual vulnerabilities.

Question 5

Which of the following is a key characteristic of a well-written vulnerability description in a penetration test report?

Accepted Answer

Clear, concise language that explains what the vulnerability is, why it matters, and how it was confirmed

Answer

Effective vulnerability descriptions use accessible language tied to the client's specific environment, combining technical accuracy with business context.

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

(eJPT) eLearnSecurity Junior Penetration Tester Certification Practice Test

eJPT Reporting and Communication 5