Reporting & Communication Flashcards

A penetration tester discovers a critical SQL injection vulnerability during an engagement. The client's system is actively processing customer financial transactions. What should the tester do FIRST?

Answer: Immediately notify the client's designated point of contact per the communication plan

Critical findings that pose immediate risk must be communicated to the client's designated contact immediately per the pre-agreed communication plan before further exploitation.

Which section of a penetration test report provides the highest-level summary intended for executives and decision-makers?

Answer: Executive summary

The executive summary translates technical findings into business risk language for non-technical stakeholders who make strategic decisions.

During a pentest, a tester accidentally accesses data that appears to be personally identifiable information (PII) outside the agreed scope. What is the correct action?

Answer: Immediately stop accessing the data and notify the client and legal counsel

Unintended access to out-of-scope PII requires immediate cessation of access and notification to the client and potentially legal counsel due to regulatory implications.

What is the primary purpose of including a 'scope of work' section in a penetration testing report?

Answer: To define what systems and activities were authorized during the engagement

The scope of work documents exactly which systems, networks, and test types were authorized, providing legal protection and contextualizing the findings.

A client requests that a pentest report omit certain high-severity findings before sharing it with their board. How should the tester respond?

Answer: Explain that omitting findings undermines the report's integrity and offer alternative presentation formats

Testers should maintain report integrity while offering alternatives like a separate board summary that contextualizes risk without suppressing critical findings.

Which risk rating system is most commonly used in penetration testing reports to score vulnerability severity?

Answer: CVSS (Common Vulnerability Scoring System)

CVSS provides a standardized numerical score (0-10) widely used in the industry to rate vulnerability severity in pentest reports.

What should be included in the 'remediation recommendations' section of a pentest report for a critical finding?

Answer: Specific, actionable steps to fix the vulnerability with prioritization guidance

Remediation recommendations must be specific and actionable so the client's technical team can address the vulnerability effectively, with priority guidance based on severity.