PenTest+ Communication During Engagement Quiz

1. What is the purpose of a debrief meeting after a penetration test?

To prevent the client from understanding findings

To discuss results, answer questions, and plan remediation

To reduce the final report details

To avoid accountability for findings

Submit

3. What should be included in a scope change request during an engagement?

No documentation needed

Impact on timeline, cost, and testing parameters

Only the tester's opinion

Client name only

4. True or False: You may share detailed technical findings with all employees without client approval.

True

False

Submit

6. How should you document a client's verbal approval to begin testing?

Do not document verbal approval

Send written confirmation and request acknowledgment

Rely solely on memory

Create a verbal contract only

7. What is the best practice for maintaining confidentiality during client communications?

Share findings on unsecured email

Use secure channels and limit access to authorized personnel

Discuss findings in public areas

Post findings on company intranet

8. True or False: A penetration test report should include recommendations for remediation.

True

False

9. When should you escalate a critical finding discovered during testing?

Only in the final report

Immediately, following the communication plan

After testing is completely finished

Never escalate during the engagement

10. Which stakeholders should typically be included in engagement communication?

Only IT staff

Only executives

IT, management, and relevant department heads

External competitors

11. What is the primary purpose of a pre-engagement communication plan?

Establish scope, rules of engagement, and expectations

Document all vulnerabilities found during testing

Create a marketing strategy for the security firm

Assign individual tester roles and responsibilities

12. True or False: Engagement rules of engagement should be discussed only at the end of the test.

True

False

13. How should you handle a disagreement with a client about a finding's severity?

Insist your assessment is correct without discussion

Provide evidence, explain your methodology, and discuss their perspective

Lower the severity to avoid conflict

Remove the finding from the report

14. What does CVSS stand for in vulnerability reporting?

Critical Vulnerability Severity Scale

Common Vulnerability Scoring System

Client Vulnerability Service Standard

Comprehensive Vulnerability Security Scan

15. When reporting a sensitive finding, what documentation practice is essential?

Verbal discussion only, no written record

Written confirmation of disclosure date and recipient

Delay documentation until after the engagement ends

Share raw evidence without context

16. True or False: You should use highly technical language in all client communications to demonstrate expertise.

True

False

17. What is a key benefit of regular status updates during a penetration test?

It reveals all findings to the client immediately

It maintains client confidence and allows for scope adjustments

It eliminates the need for a final report

It prevents the client from fixing vulnerabilities

18. During an engagement, a client requests you to pause testing immediately. How should you respond?

Ignore the request and continue testing

Acknowledge the request and document the time and reason

Pause only if it affects your schedule

Continue testing and report it later

19. What should be included in a vulnerability report to ensure client understanding?

Technical jargon without explanations

Risk rating, description, impact, and remediation steps

Only the number of vulnerabilities found

Raw tool output and logs

20. Which communication method is most appropriate for disclosing critical vulnerabilities?

Email only

In-person meeting or secure call with written follow-up

Public announcement

Social media notification

PenTest+ Communication During an Engagement Quiz

1. What is the purpose of a debrief meeting after a penetration test?

2.

What first name or nickname would you like us to use?

2. The primary goal of engagement communication is to ____.

3. What should be included in a scope change request during an engagement?

4. True or False: You may share detailed technical findings with all employees without client approval.

5. When presenting findings to non-technical stakeholders, you should ____.

6. How should you document a client's verbal approval to begin testing?

7. What is the best practice for maintaining confidentiality during client communications?

8. True or False: A penetration test report should include recommendations for remediation.

9. When should you escalate a critical finding discovered during testing?

10. Which stakeholders should typically be included in engagement communication?

11. What is the primary purpose of a pre-engagement communication plan?

12. True or False: Engagement rules of engagement should be discussed only at the end of the test.

13. How should you handle a disagreement with a client about a finding's severity?

14. What does CVSS stand for in vulnerability reporting?

15. When reporting a sensitive finding, what documentation practice is essential?

16. True or False: You should use highly technical language in all client communications to demonstrate expertise.

17. What is a key benefit of regular status updates during a penetration test?

18. During an engagement, a client requests you to pause testing immediately. How should you respond?

19. What should be included in a vulnerability report to ensure client understanding?

20. Which communication method is most appropriate for disclosing critical vulnerabilities?