PenTest+ Reporting & Communication 5

Question 1

What is the purpose of a 'severity rating' assigned to each finding in a pentest report?

Accepted Answer

To help the client prioritize remediation efforts based on risk to the organization

Answer

Severity ratings allow clients to prioritize which vulnerabilities to remediate first based on the potential impact and likelihood of exploitation.

Question 2

During a red team engagement, the blue team detects the testers' activity and begins incident response. According to proper communication protocols, what should happen?

Accepted Answer

Red team continues unless a pre-established abort signal is received from the engagement coordinator

Answer

Red team operations continue unless a pre-defined abort signal from the engagement coordinator is received, as detection by the blue team is a normal and expected test scenario.

Question 3

Which section of a pentest report would include details about testing methodology frameworks such as PTES or OWASP Testing Guide?

Accepted Answer

Methodology section

Answer

The methodology section describes the testing frameworks, standards, and approaches used during the engagement to provide context and credibility to the findings.

Question 4

A client asks the penetration testing team to keep findings confidential from certain internal IT staff during the engagement. What is the primary reason a client might make this request?

Accepted Answer

To test whether internal staff would detect the intrusion without being tipped off (double-blind testing)

Answer

Double-blind testing keeps internal IT staff unaware of the engagement to realistically assess detection and response capabilities without bias from foreknowledge.

Question 5

What distinguishes 'risk' from 'vulnerability' in penetration test report terminology?

Accepted Answer

Vulnerability is the technical weakness; risk combines the vulnerability with likelihood of exploitation and potential business impact

Answer

A vulnerability is the technical flaw itself, while risk is the combination of that vulnerability's exploitability with the potential business impact if exploited.

(PenTest+) CompTIA PenTest+ Certification Practice Test

(PenTest+) CompTIA PenTest+ Certification Practice Test

PenTest+ Reporting & Communication 5