PenTest+ Reporting & Communication 2

Question 1

A penetration tester discovers a critical SQL injection vulnerability during an engagement. The client's system is actively processing customer financial transactions. What should the tester do FIRST?

Accepted Answer

Immediately notify the client's designated point of contact per the communication plan

Answer

Critical findings that pose immediate risk must be communicated to the client's designated contact immediately per the pre-agreed communication plan before further exploitation.

Question 2

Which section of a penetration test report provides the highest-level summary intended for executives and decision-makers?

Accepted Answer

Executive summary

Answer

The executive summary translates technical findings into business risk language for non-technical stakeholders who make strategic decisions.

Question 3

During a pentest, a tester accidentally accesses data that appears to be personally identifiable information (PII) outside the agreed scope. What is the correct action?

Accepted Answer

Immediately stop accessing the data and notify the client and legal counsel

Answer

Unintended access to out-of-scope PII requires immediate cessation of access and notification to the client and potentially legal counsel due to regulatory implications.

Question 4

What is the primary purpose of including a 'scope of work' section in a penetration testing report?

Accepted Answer

To define what systems and activities were authorized during the engagement

Answer

The scope of work documents exactly which systems, networks, and test types were authorized, providing legal protection and contextualizing the findings.

Question 5

A client requests that a pentest report omit certain high-severity findings before sharing it with their board. How should the tester respond?

Accepted Answer

Explain that omitting findings undermines the report's integrity and offer alternative presentation formats

Answer

Testers should maintain report integrity while offering alternatives like a separate board summary that contextualizes risk without suppressing critical findings.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Reporting & Communication 2