PenTest+ Reporting & Communication 3

Question 1

A penetration testing team uses an encrypted communication channel to relay daily status updates to the client during a long-term engagement. What is the MAIN reason for encrypting these communications?

Accepted Answer

To prevent threat actors from learning which systems have already been tested

Answer

Encrypting status communications prevents adversaries from learning which systems have been tested and which vulnerabilities remain, which could be exploited before remediation.

Question 2

In a penetration test report, what does 'attack narrative' or 'attack path' documentation provide?

Accepted Answer

A step-by-step walkthrough showing how an attacker could chain vulnerabilities to achieve an objective

Answer

An attack narrative demonstrates how individual vulnerabilities can be chained together to show realistic attack paths and the true business impact of vulnerabilities.

Question 3

Which document formally authorizes a penetration tester to perform testing activities and provides legal protection?

Accepted Answer

Get-out-of-jail-free letter

Answer

A get-out-of-jail-free letter (authorization letter) from the client explicitly grants permission to test and provides legal protection if the tester is questioned by law enforcement.

Question 4

When communicating findings to a technical audience in a pentest report, which approach is MOST appropriate?

Accepted Answer

Include full technical details such as CVE numbers, proof-of-concept code, and reproduction steps

Answer

Technical audiences (sysadmins, developers) require detailed technical information including CVEs, reproduction steps, and proof-of-concept to understand and remediate findings.

Question 5

A tester discovers evidence of an active breach by a third party during a scheduled pentest. What is the MOST appropriate immediate action?

Accepted Answer

Document the breach evidence and immediately notify the client

Answer

Discovery of an active breach requires immediate notification to the client so they can engage incident response resources, as this takes priority over the pentest scope.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Reporting & Communication 3