PenTest+ V2 Technical Finding Documentation Format

1. What is the primary benefit of using a standardized finding template in reports?

To reduce the tester's workload regardless of content quality

To ensure consistency and clarity across all findings

To confuse stakeholders with uniform formatting

To eliminate the need for technical depth

2. In PenTest+ V2 reporting, what is the significance of assigning a finding identifier (ID) to each vulnerability?

To track findings across reports, versions, and remediation efforts

To make the report longer and more complex

To hide findings from stakeholders

To replace written descriptions

3. Which of the following should NOT be included in a professional penetration test report?

Clear finding descriptions with business impact

Tester's personal opinions or unprofessional language

Prioritized remediation recommendations

Executive summary and technical details

4. What is the primary purpose of including attack vectors in finding documentation?

To provide step-by-step instructions for attackers

To explain how the vulnerability can be exploited and what conditions enable it

To confuse the client with technical complexity

To reduce the perceived severity of findings

5. When should a penetration tester update or revise finding documentation?

Only after the client requests changes

During the assessment if new information emerges or findings are remediated

Never, as findings are permanent records

Only after the final report is delivered

6. In technical documentation, what does the term 'affected asset' refer to?

The financial value of the company

The specific system, application, or resource where the vulnerability exists

The tester's equipment used in the assessment

The client's insurance policy

7. What is the recommended approach for discussing findings with the client during a debrief meeting?

Present all findings without context or prioritization

Focus only on critical issues and skip others

Organize by severity, explain business impact, and discuss remediation

Avoid discussing findings in person

8. A vulnerability with high likelihood of exploitation but low business impact should be rated as which severity?

Critical

High

Medium

Low

9. Which stakeholder typically requires a high-level executive summary rather than technical details?

Security operations center (SOC) analyst

Chief information officer (CIO) or business executive

Penetration tester

System administrator

10. In PenTest+ V2, how should proof of concept evidence be documented?

Avoid including any evidence to protect the client

Include screenshots, logs, or output that demonstrates the vulnerability

Provide only theoretical descriptions without proof

Include full exploit code ready to use

11. Which of the following best describes the primary purpose of technical finding documentation in a penetration test report?

To provide detailed proof of concept code for attackers

To communicate vulnerabilities, impact, and remediation to stakeholders

To demonstrate the tester's technical skills only

To replace verbal communication with clients

12. Which of the following is a best practice when writing finding descriptions?

Use highly technical jargon exclusively

Avoid explaining the business impact

Be clear, concise, and include business context

Use abbreviations without definition

13. A false positive in penetration testing should be documented how?

Omitted entirely from the report

Listed with explanation of why it is not a valid vulnerability

Included as a confirmed finding to inflate the count

Reported verbally but not in writing

14. In vulnerability documentation, what does CWE refer to?

Common Weakness Enumeration

Certified Web Exploit

Critical Web Environment

Compliance and Web Engineering

15. Which communication method is most appropriate for delivering critical findings to executive leadership?

Email with technical jargon only

In-person meeting or executive summary with business impact

Posting on internal wiki

Verbal conversation with no documentation

16. What is the standard format for categorizing findings in PenTest+ V2 reports?

Title, Description, Impact, Remediation

Date, Tester Name, Vulnerability ID, Screenshot

Severity, Risk Rating, Executive Summary, Appendix

Finding ID, CVSS, CWE, Proof of Concept

17. When documenting a finding, what is the most appropriate audience to consider for technical depth?

Only IT security teams

Only executive management

The intended recipient's technical level and role

Hackers and malicious actors

18. Which element should always be included in an effective remediation recommendation?

Blame assignment for the vulnerability

Specific steps to fix the issue with timeframe

A list of competitor security practices

The tester's personal opinion on the fix

19. A CVSS score of 8.5 would typically be classified as which severity level?

Low