PenTest+ Reporting & Communication 4

Question 1

Which element differentiates a penetration test report from a vulnerability scan report?

Accepted Answer

Penetration test reports include manual exploitation evidence, attack narratives, and chained vulnerability paths

Answer

Pentest reports go beyond automated scanning by including manual exploitation evidence, attack chains, and demonstrated business impact that scanners cannot provide.

Question 2

A client's legal team requests a copy of all raw evidence (logs, screenshots, captured credentials) collected during a pentest. What should the tester consider FIRST?

Accepted Answer

Review the contract to determine what data sharing obligations exist and consult with the testing firm's legal counsel

Answer

Sharing raw evidence with legal teams requires reviewing contractual obligations and consulting legal counsel, as it may involve sensitive data and legal implications.

Question 3

In the context of pentest reporting, what does 'false positive' refer to?

Accepted Answer

A reported vulnerability that does not actually exist or cannot be exploited in the target environment

Answer

A false positive is a vulnerability flagged by tools or initial analysis that further investigation reveals is not actually exploitable or present in the environment.

Question 4

What is the significance of 'proof of exploitation' screenshots or logs included in a pentest report?

Accepted Answer

They provide irrefutable evidence that a vulnerability was successfully exploited, validating the finding's severity

Answer

Proof of exploitation evidence validates findings and demonstrates real-world impact, preventing clients from dismissing findings as theoretical or false positives.

Question 5

When a penetration test reveals that a third-party vendor's product contains a vulnerability, what is the MOST appropriate reporting action?

Accepted Answer

Notify the client and discuss responsible disclosure to the vendor through established channels

Answer

Third-party vulnerabilities should be reported to the client first, then coordinated responsible disclosure to the vendor follows established industry practices.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Reporting & Communication 4