PenTest+ Reporting & Communication 5 — Questions and Answers
Question 1: What is the purpose of a 'severity rating' assigned to each finding in a pentest report?
- To determine the tester's billing rate for that finding
- To help the client prioritize remediation efforts based on risk to the organization (Correct answer)
- To rank findings alphabetically
- To comply with federal reporting requirements
Correct answer: To help the client prioritize remediation efforts based on risk to the organization
Severity ratings allow clients to prioritize which vulnerabilities to remediate first based on the potential impact and likelihood of exploitation.
Question 2: During a red team engagement, the blue team detects the testers' activity and begins incident response. According to proper communication protocols, what should happen?
- Red team should immediately go dark and cease all activity
- Red team continues unless a pre-established abort signal is received from the engagement coordinator (Correct answer)
- Red team should identify themselves to the blue team immediately
- Red team should escalate their activities to test incident response further
Correct answer: Red team continues unless a pre-established abort signal is received from the engagement coordinator
Red team operations continue unless a pre-defined abort signal from the engagement coordinator is received, as detection by the blue team is a normal and expected test scenario.
Question 3: Which section of a pentest report would include details about testing methodology frameworks such as PTES or OWASP Testing Guide?
- Executive summary
- Appendices
- Methodology section (Correct answer)
- Risk matrix
Correct answer: Methodology section
The methodology section describes the testing frameworks, standards, and approaches used during the engagement to provide context and credibility to the findings.
Question 4: A client asks the penetration testing team to keep findings confidential from certain internal IT staff during the engagement. What is the primary reason a client might make this request?
- To reduce the cost of the engagement
- To test whether internal staff would detect the intrusion without being tipped off (double-blind testing) (Correct answer)
- To prevent the IT team from patching vulnerabilities before they are documented
- To comply with HIPAA requirements
Correct answer: To test whether internal staff would detect the intrusion without being tipped off (double-blind testing)
Double-blind testing keeps internal IT staff unaware of the engagement to realistically assess detection and response capabilities without bias from foreknowledge.
Question 5: What distinguishes 'risk' from 'vulnerability' in penetration test report terminology?
- They are interchangeable terms in pentest reports
- Vulnerability is the technical weakness; risk combines the vulnerability with likelihood of exploitation and potential business impact (Correct answer)
- Risk refers only to financial losses; vulnerability refers to technical flaws
- Vulnerability is more severe than risk
Correct answer: Vulnerability is the technical weakness; risk combines the vulnerability with likelihood of exploitation and potential business impact
A vulnerability is the technical flaw itself, while risk is the combination of that vulnerability's exploitability with the potential business impact if exploited.
Question 6: When reporting on social engineering test results, which data must be handled with particular sensitivity?
- The tools used to craft phishing emails
- The identities of employees who failed the tests, to ensure their privacy and prevent retaliation (Correct answer)
- The IP addresses of mail servers used
- The timestamp of when phishing emails were sent
Correct answer: The identities of employees who failed the tests, to ensure their privacy and prevent retaliation
Employee-specific results from social engineering tests must be handled sensitively to protect individuals from retaliation and should typically be reported as aggregate statistics.
Question 7: A penetration test report recommends implementing network segmentation as a remediation for multiple findings. What type of recommendation is this?
- A compensating control recommendation
- A strategic or architectural remediation recommendation addressing root cause across multiple findings (Correct answer)
- A tactical quick-fix recommendation
- A compliance-only recommendation
Correct answer: A strategic or architectural remediation recommendation addressing root cause across multiple findings
Network segmentation addresses root causes affecting multiple findings simultaneously and represents a strategic architectural improvement rather than a tactical per-vulnerability fix.
PenTest+ Reporting & Communication 5
What is the purpose of a 'severity rating' assigned to each finding in a pentest report?