Reporting & Communication Flashcards

Which element differentiates a penetration test report from a vulnerability scan report?

Answer: Penetration test reports include manual exploitation evidence, attack narratives, and chained vulnerability paths

Pentest reports go beyond automated scanning by including manual exploitation evidence, attack chains, and demonstrated business impact that scanners cannot provide.

A client's legal team requests a copy of all raw evidence (logs, screenshots, captured credentials) collected during a pentest. What should the tester consider FIRST?

Answer: Review the contract to determine what data sharing obligations exist and consult with the testing firm's legal counsel

Sharing raw evidence with legal teams requires reviewing contractual obligations and consulting legal counsel, as it may involve sensitive data and legal implications.

In the context of pentest reporting, what does 'false positive' refer to?

Answer: A reported vulnerability that does not actually exist or cannot be exploited in the target environment

A false positive is a vulnerability flagged by tools or initial analysis that further investigation reveals is not actually exploitable or present in the environment.

What is the significance of 'proof of exploitation' screenshots or logs included in a pentest report?

Answer: They provide irrefutable evidence that a vulnerability was successfully exploited, validating the finding's severity

Proof of exploitation evidence validates findings and demonstrates real-world impact, preventing clients from dismissing findings as theoretical or false positives.

When a penetration test reveals that a third-party vendor's product contains a vulnerability, what is the MOST appropriate reporting action?

Answer: Notify the client and discuss responsible disclosure to the vendor through established channels

Third-party vulnerabilities should be reported to the client first, then coordinated responsible disclosure to the vendor follows established industry practices.

Which metric in a CVSS score specifically reflects whether the vulnerability can be exploited remotely without local access?

Answer: Attack Vector (AV)

The Attack Vector (AV) metric in CVSS indicates whether exploitation requires Network, Adjacent, Local, or Physical access, directly measuring remote exploitability.

A penetration tester must deliver findings verbally to a client's CISO before the written report is complete. What is the MOST important communication principle to follow?

Answer: Clearly distinguish between confirmed findings and preliminary observations, and avoid overstating certainty

Verbal briefings before the final report must clearly distinguish confirmed findings from preliminary observations to avoid misleading decision-makers acting on incomplete information.