Reporting & Communication Flashcards

A penetration testing team uses an encrypted communication channel to relay daily status updates to the client during a long-term engagement. What is the MAIN reason for encrypting these communications?

Answer: To prevent threat actors from learning which systems have already been tested

Encrypting status communications prevents adversaries from learning which systems have been tested and which vulnerabilities remain, which could be exploited before remediation.

In a penetration test report, what does 'attack narrative' or 'attack path' documentation provide?

Answer: A step-by-step walkthrough showing how an attacker could chain vulnerabilities to achieve an objective

An attack narrative demonstrates how individual vulnerabilities can be chained together to show realistic attack paths and the true business impact of vulnerabilities.

Which document formally authorizes a penetration tester to perform testing activities and provides legal protection?

Answer: Get-out-of-jail-free letter

A get-out-of-jail-free letter (authorization letter) from the client explicitly grants permission to test and provides legal protection if the tester is questioned by law enforcement.

When communicating findings to a technical audience in a pentest report, which approach is MOST appropriate?

Answer: Include full technical details such as CVE numbers, proof-of-concept code, and reproduction steps

Technical audiences (sysadmins, developers) require detailed technical information including CVEs, reproduction steps, and proof-of-concept to understand and remediate findings.

A tester discovers evidence of an active breach by a third party during a scheduled pentest. What is the MOST appropriate immediate action?

Answer: Document the breach evidence and immediately notify the client

Discovery of an active breach requires immediate notification to the client so they can engage incident response resources, as this takes priority over the pentest scope.

What is the purpose of a 'lessons learned' or 'post-engagement review' meeting after a penetration test?

Answer: To discuss what worked, what didn't, and how to improve future security posture and testing engagements

Post-engagement reviews help both the client and the testing team improve processes, understand findings more deeply, and plan remediation priorities collaboratively.

How should a penetration tester handle proprietary client data collected during testing after the engagement concludes?

Answer: Securely delete all client data per the data retention policy agreed in the contract

Client data must be securely deleted after the engagement per the data handling policy specified in the contract to protect client confidentiality and meet legal obligations.