PenTest+ Reporting & Communication 2 — Questions and Answers
Question 1: A penetration tester discovers a critical SQL injection vulnerability during an engagement. The client's system is actively processing customer financial transactions. What should the tester do FIRST?
- Exploit the vulnerability fully to demonstrate impact
- Immediately notify the client's designated point of contact per the communication plan (Correct answer)
- Document the finding and continue testing
- Halt all testing and leave the premises
Correct answer: Immediately notify the client's designated point of contact per the communication plan
Critical findings that pose immediate risk must be communicated to the client's designated contact immediately per the pre-agreed communication plan before further exploitation.
Question 2: Which section of a penetration test report provides the highest-level summary intended for executives and decision-makers?
- Technical findings section
- Executive summary (Correct answer)
- Methodology section
- Appendices
Correct answer: Executive summary
The executive summary translates technical findings into business risk language for non-technical stakeholders who make strategic decisions.
Question 3: During a pentest, a tester accidentally accesses data that appears to be personally identifiable information (PII) outside the agreed scope. What is the correct action?
- Copy the data as evidence and continue
- Immediately stop accessing the data and notify the client and legal counsel (Correct answer)
- Delete the data to protect privacy
- Document it in the final report only
Correct answer: Immediately stop accessing the data and notify the client and legal counsel
Unintended access to out-of-scope PII requires immediate cessation of access and notification to the client and potentially legal counsel due to regulatory implications.
Question 4: What is the primary purpose of including a 'scope of work' section in a penetration testing report?
- To list all tools used during testing
- To define what systems and activities were authorized during the engagement (Correct answer)
- To summarize vulnerabilities by severity
- To outline remediation timelines
Correct answer: To define what systems and activities were authorized during the engagement
The scope of work documents exactly which systems, networks, and test types were authorized, providing legal protection and contextualizing the findings.
Question 5: A client requests that a pentest report omit certain high-severity findings before sharing it with their board. How should the tester respond?
- Comply fully with the client's request
- Refuse to modify the report under any circumstances
- Explain that omitting findings undermines the report's integrity and offer alternative presentation formats (Correct answer)
- Submit two versions of the report
Correct answer: Explain that omitting findings undermines the report's integrity and offer alternative presentation formats
Testers should maintain report integrity while offering alternatives like a separate board summary that contextualizes risk without suppressing critical findings.
Question 6: Which risk rating system is most commonly used in penetration testing reports to score vulnerability severity?
- CVSS (Common Vulnerability Scoring System) (Correct answer)
- STRIDE
- PASTA
- DREAD
Correct answer: CVSS (Common Vulnerability Scoring System)
CVSS provides a standardized numerical score (0-10) widely used in the industry to rate vulnerability severity in pentest reports.
Question 7: What should be included in the 'remediation recommendations' section of a pentest report for a critical finding?
- Only a description of the vulnerability
- Specific, actionable steps to fix the vulnerability with prioritization guidance (Correct answer)
- A list of similar vulnerabilities found elsewhere
- The exact exploit code used
Correct answer: Specific, actionable steps to fix the vulnerability with prioritization guidance
Remediation recommendations must be specific and actionable so the client's technical team can address the vulnerability effectively, with priority guidance based on severity.
PenTest+ Reporting & Communication 2
A penetration tester discovers a critical SQL injection vulnerability during an engagement.
The client's system is actively processing customer financial transactions.
What should the tester do FIRST?