PenTest+ V2 Risk Rating & Severity Scoring

1. In a penetration test report, how should you communicate severity ratings to non-technical stakeholders?

Use only numerical CVSS scores

Use color-coded severity levels with brief business impact explanations

Include only the raw vulnerability names

Provide detailed technical exploit code

2. What is the primary goal of risk rating in penetration test reporting?

To provide detailed exploit techniques

To help organizations prioritize remediation efforts based on actual risk

To eliminate all security vulnerabilities

To assign blame for security gaps

3. In CVSS, an Availability Impact of 'None' indicates the vulnerability does NOT affect ____ of systems or services.

Confidentiality

Integrity

Availability

Access control

4. Which communication principle is most important when presenting severity ratings to executive leadership?

Use maximum technical jargon for credibility

Focus on business risk and remediation ROI

Provide only the highest severity findings

Avoid mentioning any medium-risk items

5. A vulnerability with Integrity Impact of 'High' means the vulnerability allows ____ of information.

Unauthorized disclosure

Total loss of availability

Unauthorized modification

Privilege escalation

6. In risk reporting, what does 'compensating controls' refer to in the context of severity adjustment?

Controls that replace CVSS scoring

Existing security measures that reduce the practical risk of a vulnerability

Controls that prevent all vulnerabilities

Controls implemented after the penetration test

7. Which CVSS impact metric specifically measures unauthorized access to information?

Availability Impact

Integrity Impact

Confidentiality Impact

Scope Impact

8. A vulnerability requiring valid user credentials to exploit would have Privileges Required set to ____ in CVSS.

None

Low

High

Administrator

9. What is the primary advantage of using standardized risk rating systems like CVSS in reports?

They eliminate the need for professional judgment

They ensure consistency and comparability across different assessments

They reduce the total number of vulnerabilities found

They automatically determine remediation timelines

10. Which of the following is an example of a Critical severity vulnerability?

Outdated SSL certificate

Unauthenticated remote code execution

Weak password policy recommendation

Missing HTTP security headers

11. What does CVSS stand for in the context of vulnerability severity scoring?

Common Vulnerability Scoring System

Cyber Vulnerability Security Standard

Critical Vulnerability Severity Score

Comprehensive Vulnerability Security Specification

12. Which CVSS metric measures whether the vulnerability impact is contained to the vulnerable component or spreads to other systems?

Scope

Attack Complexity

Privileges Required

User Interaction

13. A vulnerability affecting an unauthenticated remote attacker with low complexity would have an Attack Vector of ____ in CVSS.

Network

Adjacent Network

Local

Physical

14. Which of the following best describes the purpose of severity scoring in penetration test reports?

To determine the tester's skill level

To standardize and communicate the impact of vulnerabilities for remediation prioritization

To calculate the final invoice amount

To measure testing coverage percentage

15. In risk assessment, which formula is commonly used: Risk = ____ × Vulnerability × Impact?

Threat

Probability

Likelihood

Exposure

16. What does the Temporal metric group in CVSS account for?

How quickly the vulnerability can be exploited

The time-sensitive aspects like exploit availability and patch status

The duration of the attack window

Historical vulnerability trends

17. Which factor is NOT part of the CVSS v3.1 base metric group?

Attack Vector

Confidentiality Impact

Business Impact

Attack Complexity

18. A vulnerability with a CVSS base score of 8.5 would typically be rated as ____ severity.

Low

Medium

High

Critical

19. In CVSS v3.1, what is the score range for a High severity rating?

0.0–3.9

4.0–6.9

7.0–8.9

9.0–10.0

20. Which CVSS metric describes whether a vulnerability requires user interaction to be exploited?

Attack Complexity

User Interaction

Scope

Privileges Required

PenTest+ V2 Risk Rating and Severity Scoring in Reports Quiz

1. In a penetration test report, how should you communicate severity ratings to non-technical stakeholders?

2.

What first name or nickname would you like us to use?

2. What is the primary goal of risk rating in penetration test reporting?

3. In CVSS, an Availability Impact of 'None' indicates the vulnerability does NOT affect ____ of systems or services.

4. Which communication principle is most important when presenting severity ratings to executive leadership?

5. A vulnerability with Integrity Impact of 'High' means the vulnerability allows ____ of information.

6. In risk reporting, what does 'compensating controls' refer to in the context of severity adjustment?

7. Which CVSS impact metric specifically measures unauthorized access to information?

8. A vulnerability requiring valid user credentials to exploit would have Privileges Required set to ____ in CVSS.

9. What is the primary advantage of using standardized risk rating systems like CVSS in reports?

10. Which of the following is an example of a Critical severity vulnerability?

11. What does CVSS stand for in the context of vulnerability severity scoring?

12. Which CVSS metric measures whether the vulnerability impact is contained to the vulnerable component or spreads to other systems?

13. A vulnerability affecting an unauthenticated remote attacker with low complexity would have an Attack Vector of ____ in CVSS.

14. Which of the following best describes the purpose of severity scoring in penetration test reports?

15. In risk assessment, which formula is commonly used: Risk = ____ × Vulnerability × Impact?

16. What does the Temporal metric group in CVSS account for?

17. Which factor is NOT part of the CVSS v3.1 base metric group?

18. A vulnerability with a CVSS base score of 8.5 would typically be rated as ____ severity.

19. In CVSS v3.1, what is the score range for a High severity rating?

20. Which CVSS metric describes whether a vulnerability requires user interaction to be exploited?