PenTest+ Reporting Quiz: Can You Write The Findings?

1. Which communication method is most appropriate for delivering a critical vulnerability discovered during testing?

Informal email to a random IT staff member

Immediate notification to designated contacts per engagement rules

Public disclosure on social media

Waiting until the final report is due

2. True or False: Penetration test reports should omit remediation recommendations to avoid scope creep.

True

False

Submit

4. Which stakeholder group typically requires the most non-technical language in vulnerability reporting?

System administrators

Executive management and C-level leadership

Security engineers

Network architects

5. True or False: Confidentiality agreements should be referenced in the report to protect sensitive testing details.

True

False

6. What is the primary benefit of using a standardized report format across all penetration tests?

Consistency, clarity, and easier client comparison over time

Reduced report accuracy

Faster writing with less detail

Avoiding client feedback

7. When should a draft report be reviewed with the client before final delivery?

Never; final reports should be a surprise

Only if major vulnerabilities were found

Before final submission to allow for clarification and feedback

After public disclosure

8. True or False: A penetration test report should include recommendations for vulnerabilities that were not exploited.

True

False

Submit

10. What should a remediation recommendation include to be actionable?

Only the vulnerability name

Steps to fix, timeline, and resource requirements

Only the severity rating

The tester's preferred solution method only

11. Which section of a penetration test report should contain a high-level overview of findings without technical detail?

Executive Summary

Detailed Findings

Methodology

Appendix

12. True or False: It is acceptable to use the same report template and findings for all clients without customization.

True

False

Submit

14. When reporting findings, what is the primary purpose of including proof-of-concept (PoC) details?

To demonstrate the vulnerability is real and reproducible

To provide complete exploit code for public use

To intimidate the client

To avoid explaining remediation steps

15. Which of the following should be included in the scope section of a penetration test report?

In-scope systems, testing dates, and limitations

Only the tester's name

Complete source code of all applications tested

Detailed exploit code for each vulnerability

16. True or False: A penetration test report should prioritize technical depth over clarity when communicating with executive leadership.

True

False

Submit

18. Which element should be included when documenting a vulnerability to enable remediation?

Only the vulnerability name

Steps to reproduce, impact, and recommended fixes

Only the affected system IP address

The tester's personal opinion on severity

19. What does CVSS stand for in vulnerability reporting?

Common Vulnerability Severity Scale

Critical Vulnerability Security System

Common Vulnerability Scoring System

Cyber Vulnerability Security Standard

20. When reporting a critical vulnerability to a non-technical stakeholder, what approach is most effective?

Use technical jargon to establish credibility

Explain business impact and remediation steps in plain language

Provide only the CVSS score

Avoid mentioning severity

PenTest+ Reporting Quiz: Can You Write the Findings?

1. Which communication method is most appropriate for delivering a critical vulnerability discovered during testing?

2.

What first name or nickname would you like us to use?

2. True or False: Penetration test reports should omit remediation recommendations to avoid scope creep.

3. A vulnerability with high likelihood but low impact should be rated as ______ risk overall.

4. Which stakeholder group typically requires the most non-technical language in vulnerability reporting?

5. True or False: Confidentiality agreements should be referenced in the report to protect sensitive testing details.

6. What is the primary benefit of using a standardized report format across all penetration tests?

7. When should a draft report be reviewed with the client before final delivery?

8. True or False: A penetration test report should include recommendations for vulnerabilities that were not exploited.

9. The ______ documents the tools, techniques, and timeline used during the penetration test.

10. What should a remediation recommendation include to be actionable?

11. Which section of a penetration test report should contain a high-level overview of findings without technical detail?

12. True or False: It is acceptable to use the same report template and findings for all clients without customization.

13. The ______ is the section where detailed technical findings, affected assets, and remediation steps are documented.

14. When reporting findings, what is the primary purpose of including proof-of-concept (PoC) details?

15. Which of the following should be included in the scope section of a penetration test report?

16. True or False: A penetration test report should prioritize technical depth over clarity when communicating with executive leadership.

17. A risk rating matrix typically combines likelihood and ______ to determine overall risk.

18. Which element should be included when documenting a vulnerability to enable remediation?

19. What does CVSS stand for in vulnerability reporting?

20. When reporting a critical vulnerability to a non-technical stakeholder, what approach is most effective?