Reporting & Communication Flashcards

What is the purpose of a 'severity rating' assigned to each finding in a pentest report?

Answer: To help the client prioritize remediation efforts based on risk to the organization

Severity ratings allow clients to prioritize which vulnerabilities to remediate first based on the potential impact and likelihood of exploitation.

During a red team engagement, the blue team detects the testers' activity and begins incident response. According to proper communication protocols, what should happen?

Answer: Red team continues unless a pre-established abort signal is received from the engagement coordinator

Red team operations continue unless a pre-defined abort signal from the engagement coordinator is received, as detection by the blue team is a normal and expected test scenario.

Which section of a pentest report would include details about testing methodology frameworks such as PTES or OWASP Testing Guide?

Answer: Methodology section

The methodology section describes the testing frameworks, standards, and approaches used during the engagement to provide context and credibility to the findings.

A client asks the penetration testing team to keep findings confidential from certain internal IT staff during the engagement. What is the primary reason a client might make this request?

Answer: To test whether internal staff would detect the intrusion without being tipped off (double-blind testing)

Double-blind testing keeps internal IT staff unaware of the engagement to realistically assess detection and response capabilities without bias from foreknowledge.

What distinguishes 'risk' from 'vulnerability' in penetration test report terminology?

Answer: Vulnerability is the technical weakness; risk combines the vulnerability with likelihood of exploitation and potential business impact

A vulnerability is the technical flaw itself, while risk is the combination of that vulnerability's exploitability with the potential business impact if exploited.

When reporting on social engineering test results, which data must be handled with particular sensitivity?

Answer: The identities of employees who failed the tests, to ensure their privacy and prevent retaliation

Employee-specific results from social engineering tests must be handled sensitively to protect individuals from retaliation and should typically be reported as aggregate statistics.

A penetration test report recommends implementing network segmentation as a remediation for multiple findings. What type of recommendation is this?

Answer: A strategic or architectural remediation recommendation addressing root cause across multiple findings

Network segmentation addresses root causes affecting multiple findings simultaneously and represents a strategic architectural improvement rather than a tactical per-vulnerability fix.