PenTest+ Reporting & Communication 4 — Questions and Answers
Question 1: Which element differentiates a penetration test report from a vulnerability scan report?
- Penetration test reports list more CVEs
- Penetration test reports include manual exploitation evidence, attack narratives, and chained vulnerability paths (Correct answer)
- Vulnerability scan reports are more detailed
- Penetration test reports focus only on network-layer findings
Correct answer: Penetration test reports include manual exploitation evidence, attack narratives, and chained vulnerability paths
Pentest reports go beyond automated scanning by including manual exploitation evidence, attack chains, and demonstrated business impact that scanners cannot provide.
Question 2: A client's legal team requests a copy of all raw evidence (logs, screenshots, captured credentials) collected during a pentest. What should the tester consider FIRST?
- Provide all evidence immediately without question
- Review the contract to determine what data sharing obligations exist and consult with the testing firm's legal counsel (Correct answer)
- Destroy all evidence before it can be subpoenaed
- Provide only the final report
Correct answer: Review the contract to determine what data sharing obligations exist and consult with the testing firm's legal counsel
Sharing raw evidence with legal teams requires reviewing contractual obligations and consulting legal counsel, as it may involve sensitive data and legal implications.
Question 3: In the context of pentest reporting, what does 'false positive' refer to?
- A vulnerability that is more severe than initially assessed
- A reported vulnerability that does not actually exist or cannot be exploited in the target environment (Correct answer)
- A finding confirmed by manual testing
- A vulnerability found outside the agreed scope
Correct answer: A reported vulnerability that does not actually exist or cannot be exploited in the target environment
A false positive is a vulnerability flagged by tools or initial analysis that further investigation reveals is not actually exploitable or present in the environment.
Question 4: What is the significance of 'proof of exploitation' screenshots or logs included in a pentest report?
- They are required by ISO 27001 standards
- They provide irrefutable evidence that a vulnerability was successfully exploited, validating the finding's severity (Correct answer)
- They help the tester remember what was found
- They are only relevant for compliance audits
Correct answer: They provide irrefutable evidence that a vulnerability was successfully exploited, validating the finding's severity
Proof of exploitation evidence validates findings and demonstrates real-world impact, preventing clients from dismissing findings as theoretical or false positives.
Question 5: When a penetration test reveals that a third-party vendor's product contains a vulnerability, what is the MOST appropriate reporting action?
- Publicly disclose the vulnerability immediately
- Notify the client and discuss responsible disclosure to the vendor through established channels (Correct answer)
- Only report it to the vendor without informing the client
- Ignore it since it is a third-party product
Correct answer: Notify the client and discuss responsible disclosure to the vendor through established channels
Third-party vulnerabilities should be reported to the client first, then coordinated responsible disclosure to the vendor follows established industry practices.
Question 6: Which metric in a CVSS score specifically reflects whether the vulnerability can be exploited remotely without local access?
- Confidentiality Impact
- Attack Vector (AV) (Correct answer)
- Privileges Required (PR)
- Scope (S)
Correct answer: Attack Vector (AV)
The Attack Vector (AV) metric in CVSS indicates whether exploitation requires Network, Adjacent, Local, or Physical access, directly measuring remote exploitability.
Question 7: A penetration tester must deliver findings verbally to a client's CISO before the written report is complete. What is the MOST important communication principle to follow?
- Share all raw technical details and exploit code
- Clearly distinguish between confirmed findings and preliminary observations, and avoid overstating certainty (Correct answer)
- Only discuss findings that have been fully documented
- Refuse to discuss findings until the written report is finalized
Correct answer: Clearly distinguish between confirmed findings and preliminary observations, and avoid overstating certainty
Verbal briefings before the final report must clearly distinguish confirmed findings from preliminary observations to avoid misleading decision-makers acting on incomplete information.
PenTest+ Reporting & Communication 4
Which element differentiates a penetration test report from a vulnerability scan report?