PenTest+ Reporting & Communication 3 — Questions and Answers
Question 1: A penetration testing team uses an encrypted communication channel to relay daily status updates to the client during a long-term engagement. What is the MAIN reason for encrypting these communications?
- To comply with GDPR requirements
- To prevent threat actors from learning which systems have already been tested (Correct answer)
- To reduce bandwidth usage
- To meet PCI-DSS audit requirements
Correct answer: To prevent threat actors from learning which systems have already been tested
Encrypting status communications prevents adversaries from learning which systems have been tested and which vulnerabilities remain, which could be exploited before remediation.
Question 2: In a penetration test report, what does 'attack narrative' or 'attack path' documentation provide?
- A list of all IP addresses scanned
- A step-by-step walkthrough showing how an attacker could chain vulnerabilities to achieve an objective (Correct answer)
- The testing team's schedule
- A comparison against industry benchmarks
Correct answer: A step-by-step walkthrough showing how an attacker could chain vulnerabilities to achieve an objective
An attack narrative demonstrates how individual vulnerabilities can be chained together to show realistic attack paths and the true business impact of vulnerabilities.
Question 3: Which document formally authorizes a penetration tester to perform testing activities and provides legal protection?
- Non-disclosure agreement (NDA)
- Statement of work (SOW)
- Rules of engagement (ROE)
- Get-out-of-jail-free letter (Correct answer)
Correct answer: Get-out-of-jail-free letter
A get-out-of-jail-free letter (authorization letter) from the client explicitly grants permission to test and provides legal protection if the tester is questioned by law enforcement.
Question 4: When communicating findings to a technical audience in a pentest report, which approach is MOST appropriate?
- Use only business impact language without technical details
- Include full technical details such as CVE numbers, proof-of-concept code, and reproduction steps (Correct answer)
- Limit findings to a single paragraph per vulnerability
- Avoid including screenshots to keep the report concise
Correct answer: Include full technical details such as CVE numbers, proof-of-concept code, and reproduction steps
Technical audiences (sysadmins, developers) require detailed technical information including CVEs, reproduction steps, and proof-of-concept to understand and remediate findings.
Question 5: A tester discovers evidence of an active breach by a third party during a scheduled pentest. What is the MOST appropriate immediate action?
- Continue testing to avoid disrupting the engagement timeline
- Document the breach evidence and immediately notify the client (Correct answer)
- Attempt to identify and remove the threat actor
- Include the finding only in the final report
Correct answer: Document the breach evidence and immediately notify the client
Discovery of an active breach requires immediate notification to the client so they can engage incident response resources, as this takes priority over the pentest scope.
Question 6: What is the purpose of a 'lessons learned' or 'post-engagement review' meeting after a penetration test?
- To renegotiate the contract price
- To discuss what worked, what didn't, and how to improve future security posture and testing engagements (Correct answer)
- To assign blame for discovered vulnerabilities
- To plan the next year's budget
Correct answer: To discuss what worked, what didn't, and how to improve future security posture and testing engagements
Post-engagement reviews help both the client and the testing team improve processes, understand findings more deeply, and plan remediation priorities collaboratively.
Question 7: How should a penetration tester handle proprietary client data collected during testing after the engagement concludes?
- Archive it permanently as part of the engagement record
- Retain it for use in future engagements with similar clients
- Securely delete all client data per the data retention policy agreed in the contract (Correct answer)
- Transfer it to the tester's personal backup systems
Correct answer: Securely delete all client data per the data retention policy agreed in the contract
Client data must be securely deleted after the engagement per the data handling policy specified in the contract to protect client confidentiality and meet legal obligations.
PenTest+ Reporting & Communication 3
A penetration testing team uses an encrypted communication channel to relay daily status updates to the client during a long-term engagement.
What is the MAIN reason for encrypting these communications?