PT0-002 Reporting and Communication — 40 Questions

Question 1

After completing a penetration test, the lead tester is preparing the executive summary. The client's CISO wants to understand the business impact of a critical vulnerability found in the customer-facing web application. Which of the following is the BEST way to convey this in the report?

Accepted Answer

Describe the attack scenario and potential financial loss. Option B is correct because the executive summary must communicate business risk, not technical details. Describing the attack scenario and potential financial loss directly addresses the CISO's need to understand the business impact, such as revenue loss from a data breach or regulatory fines. This aligns with the PT0-002 objective of tailoring reports to the audience, where executives require risk context rather than exploit mechanics.

Answer

List the CVSS score and exploitability metrics

Answer

Provide the raw log entries showing the exploitation

Answer

Recommend a specific patch version

Question 2

A penetration tester has completed the test and is preparing the final report. The client requested a risk rating for each vulnerability. Which of the following frameworks is MOST commonly used to standardize vulnerability severity ratings in penetration testing reports?

Accepted Answer

CVSS. CVSS (Common Vulnerability Scoring System) is the industry-standard framework for assigning numeric severity scores (0-10) to vulnerabilities based on metrics like attack vector, complexity, and impact. Penetration testers use CVSS scores to provide consistent, quantitative risk ratings that clients can compare across findings. OWASP Top 10 is a list of web application risk categories, not a scoring system, and CVE is a vulnerability identifier database, not a rating framework.

Answer

OWASP Top 10

Answer

CVE

Answer

NIST SP 800-115

Question 3

A penetration test report includes a finding about a SQL injection vulnerability in a public-facing web application. Which section of the report would be the MOST appropriate place to provide step-by-step remediation instructions for the development team?

Accepted Answer

Technical Findings. Option C is correct because the Technical Findings section of a penetration test report is designed to provide detailed, step-by-step remediation instructions for technical audiences, such as the development team. This section includes specific code-level fixes, parameterized query examples, and input validation techniques to address the SQL injection vulnerability, ensuring the team can implement precise changes.

Answer

Executive Summary

Answer

Risk Assessment

Answer

Appendices

Question 4

After completing a penetration test, the client's technical team requests the detailed raw data (e.g., scan results, exploit logs, packet captures) used to support the findings. According to best practices, which of the following should the penetration tester do?

Accepted Answer

Provide the raw data in a separate, sanitized deliverable with a data handling agreement. Option B is correct because raw data such as scan results, exploit logs, and packet captures often contain sensitive information like IP addresses, credentials, or system details. Best practices (e.g., PTES, NIST SP 800-115) dictate that raw data should be provided in a separate, sanitized deliverable accompanied by a data handling agreement to ensure confidentiality and proper data governance, rather than embedding it directly in the final report.

Answer

Include all raw data in the appendices of the final report

Answer

Refuse to provide raw data to protect the confidentiality of the testing process

Answer

Provide the raw data only if the client signs a non-disclosure agreement

Question 5

A penetration tester is preparing the executive summary for a report. Which of the following metrics would be MOST valuable to include for non-technical stakeholders to understand the overall security posture?

Accepted Answer

The number of critical and high-risk findings along with the average time to exploit them. Option C is correct because non-technical stakeholders (e.g., executives) need a high-level, risk-focused summary that communicates the severity and urgency of findings. The number of critical/high-risk findings directly indicates the most dangerous exposures, and the average time to exploit them conveys how quickly an attacker could compromise the environment. This metric translates technical risk into business impact, which is the core goal of an executive summary.

Answer

A list of all tools used during the penetration test

Answer

The total number of vulnerabilities discovered and their average CVSS score

Answer

A detailed step-by-step exploitation walkthrough of one critical vulnerability

Question 6

After a penetration test, the client's development team requests that the report include specific, actionable remediation steps for each vulnerability. Where in the report should this information be placed?

Accepted Answer

Within the technical report section, under each vulnerability finding. The correct placement for specific, actionable remediation steps is within the technical report section under each vulnerability finding. This aligns with industry best practices (e.g., PTES, OWASP) where each finding includes a description, risk rating, and a dedicated remediation subsection, ensuring developers have immediate context and clear steps without cross-referencing other sections.

Answer

In the executive summary to emphasize the need for fixing vulnerabilities

Answer

In the appendix as a separate remediation checklist

Answer

In a separate document attached to the report to avoid cluttering the main report

Question 7

A penetration tester is preparing the executive summary of a report for a client's board of directors. Which of the following metrics would be MOST valuable for this audience to understand the overall security posture?

Accepted Answer

A heat map showing the number of vulnerabilities by severity (Critical, High, Medium, Low). The board of directors needs a high-level, risk-based overview of the security posture, not technical details. A heat map with vulnerability counts by severity (Critical, High, Medium, Low) provides an immediate visual representation of risk distribution, enabling strategic decisions without requiring technical expertise. This aligns with the PT0-002 objective of tailoring reporting to the audience.

Answer

The exact CVSS score for each vulnerability found

Answer

A detailed list of commands used during exploitation

Answer

The names of the operating systems and applications that were tested

Question 8

After a penetration test, the client's development team requires detailed, step-by-step instructions to reproduce a SQL injection vulnerability found in the user login functionality. In which section of the standard penetration testing report should this information be included?

Accepted Answer

Technical Findings. The Technical Findings section is the correct location because it provides detailed, step-by-step reproduction steps for vulnerabilities, including the exact SQL injection payloads, input fields, and HTTP request parameters used to exploit the login functionality. This section is intended for technical audiences (e.g., developers) who need to understand and remediate the issue, not for high-level summaries or general advice.

Answer

Executive Summary

Answer

Recommendations

Answer

Risk Rating

Question 9

In a penetration test report, the executive summary is primarily intended for which audience?

Accepted Answer

Senior management (e.g., CISO, board of directors). The executive summary is designed for senior management (e.g., CISO, board of directors) because it provides a high-level overview of the penetration test's objectives, key findings, risk impact, and recommended strategic actions. It avoids technical jargon and detailed exploit steps, focusing instead on business risk and remediation priorities that inform decision-making and resource allocation.

Answer

IT system administrators

Answer

Software developers

Answer

External compliance auditors

Question 10

After a penetration test, the client's technical team wants to understand the exact steps required to reproduce a cross-site scripting vulnerability found in the web application. In which section of the standard penetration testing report should this information be included?

Accepted Answer

Technical Findings and Recommendations. The Technical Findings and Recommendations section is the correct place for step-by-step reproduction steps because it provides detailed, actionable technical information for the client's technical team. This section typically includes specific payloads, HTTP request/response details, and the exact sequence of user interactions needed to trigger the XSS vulnerability, enabling the team to verify and remediate the issue.

Answer

Executive Summary

Answer

Methodology

Answer

Appendices

Question 11

A penetration tester has completed an engagement and needs to present findings to a mixed audience of technical engineers and business executives. Which section of the penetration test report is BEST suited for communicating high-level risk ratings and potential business impact to the non-technical stakeholders?

Accepted Answer

Executive Summary. The Executive Summary is the correct section because it is specifically designed to communicate high-level risk ratings, business impact, and strategic recommendations to non-technical stakeholders such as executives. It avoids technical jargon and focuses on the business context, aligning with the PT0-002 objective of tailoring reports to the audience.

Answer

Technical Findings and Vulnerability Details

Answer

Remediation Steps

Answer

Appendix

Question 12

After completing a penetration test, the client requests a one-page document that highlights the most critical vulnerabilities, overall risk level, and recommended next steps for management. Which deliverable should the penetration tester provide?

Accepted Answer

Executive summary. The executive summary is the correct deliverable because it is specifically designed to provide a high-level overview of the most critical vulnerabilities, overall risk level, and recommended next steps for management. Unlike a technical report, it avoids deep technical jargon and focuses on business impact, aligning with the client's request for a concise one-page document.

Answer

Technical report

Answer

Raw scan data

Answer

Remediation guide

Question 13

A penetration tester is writing the executive summary of a penetration test report. Which of the following elements is MOST important to include for a non-technical audience?

Accepted Answer

A high-level summary of the overall risk and key findings. C is correct because the executive summary is intended for a non-technical audience, such as senior management or stakeholders, who need a concise overview of the organization's security posture. A high-level summary of the overall risk and key findings communicates the business impact and strategic priorities without overwhelming them with technical details. This aligns with the PT0-002 objective of tailoring communication to the audience, ensuring the report drives decision-making rather than technical analysis.

Answer

Detailed list of all ports and services found

Answer

CVSS scores for every vulnerability

Answer

Raw tool output from vulnerability scans

Question 14

After the penetration test, the client requests a one-page summary of the test's scope, key findings, and recommended next steps for the board of directors. Which document should the penetration tester provide?

Accepted Answer

Executive Summary. The executive summary is specifically designed to provide a high-level overview of the penetration test's scope, key findings, and recommended next steps for non-technical stakeholders like the board of directors. It distills complex technical details into business-focused language, enabling informed decision-making without requiring deep cybersecurity expertise.

Answer

Detailed Technical Report

Answer

Vulnerability Scan Report

Answer

Remediation Plan

Question 15

After completing a penetration test, the client's technical team requests a detailed list of all vulnerabilities found, prioritized by severity, along with step-by-step reproduction steps and remediation guidance. In which section of the standard penetration testing report should this information be provided?

Accepted Answer

Findings. The Findings section of a standard penetration testing report is the correct location for a detailed, prioritized list of vulnerabilities with step-by-step reproduction steps and remediation guidance. This section provides the technical depth required by the client's technical team, contrasting with the high-level summaries found elsewhere.

Answer

Executive Summary

Answer

Methodology

Answer

Appendices

Question 16

The client's development team needs to reproduce a cross-site scripting vulnerability found in the login form. They require the exact payload and steps. Which deliverable should the penetration tester provide to meet this need?

Accepted Answer

A proof of concept code or walkthrough in the report appendix. The correct deliverable is a proof of concept (PoC) code or walkthrough in the report appendix because the client's development team needs the exact payload and step-by-step instructions to reproduce the cross-site scripting (XSS) vulnerability. This allows them to validate the finding and implement a fix by injecting a crafted script (e.g., ) into the login form's input fields, demonstrating how user input is not properly sanitized or encoded. Including this in the appendix ensures the technical details are documented for replication without cluttering the main report.

Answer

An executive summary

Answer

A spreadsheet of findings with CVSS scores

Answer

A verbal explanation during the readout

Question 17

During a penetration test, the tester discovers active ransomware on a critical server. Which communication should the tester perform FIRST according to standard rules of engagement?

Accepted Answer

Immediately notify the client's emergency contact. The standard rules of engagement (ROE) for penetration testing require immediate notification of the client's emergency contact upon discovery of active ransomware. This is because ransomware represents an active, ongoing security incident that demands urgent response to prevent data loss and further spread, overriding the normal testing timeline. The tester must not attempt containment or continue testing, as those actions could interfere with incident response or violate legal boundaries.

Answer

Include it in the final report

Answer

Attempt to contain the ransomware

Answer

Log the finding and continue testing

Question 18

After a penetration test, the client requests a document that includes the methodology used, a list of all vulnerabilities found along with their CVSS scores, and detailed steps for remediation. Which type of report section is this?

Accepted Answer

Technical report. The client's request for methodology, vulnerability list with CVSS scores, and remediation steps describes the detailed, technical findings of the penetration test. This content is characteristic of the Technical Report section, which provides in-depth analysis and actionable data for technical stakeholders, as opposed to high-level summaries or contractual documents.

Answer

Executive summary

Answer

Rules of engagement

Answer

Scope of work

Question 19

After completing a penetration test, the client's board of directors requests a document that provides a high-level overview of the test's objectives, key findings, and business impact. Which section of the standard penetration testing report should be produced for this audience?

Accepted Answer

Executive Summary. The executive summary is the section of a penetration testing report designed for non-technical stakeholders, such as the board of directors. It provides a high-level overview of the test's objectives, key findings, and business impact, avoiding technical jargon and focusing on risk and remediation priorities. This aligns with the PT0-002 objective of tailoring communication to the audience.

Answer

Technical Findings Section

Answer

Methodology Section

Answer

Appendix with Logs

Question 20

The client's development team needs to reproduce a cross-site scripting (XSS) vulnerability discovered during the penetration test. They require the exact payload and step-by-step instructions. Which deliverable should the tester provide to meet this need?

Accepted Answer

Detailed Vulnerability Report with reproduction steps. The correct answer is B because the development team needs the exact payload and step-by-step instructions to reproduce the XSS vulnerability. A Detailed Vulnerability Report with reproduction steps provides the precise technical details, including the payload string, input vectors, and browser behavior, enabling the team to replicate the issue in their environment. This aligns with the PT0-002 objective of delivering actionable findings for remediation.

Answer

Executive Summary

Answer

Rules of Engagement

Answer

Risk Assessment Matrix