easyMultiple Choice
PT0-002 Practice Question: A penetration tester has completed an internal…
A penetration tester has completed an internal network test. The client's IT manager requests a document that lists each vulnerability with its CVSS score, risk rating, and a brief description of the impact. Which section of the final report should contain this information?
⚠ Common exam trap
Many candidates confuse the Executive Summary's role as a summary of all findings with the Technical Findings' role of providing detailed, per-vulnerability data, leading them to incorrectly select the Executive Summary for listing CVSS scores and impacts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Technical Findings
The Technical Findings section is the correct location because it provides a detailed, itemized list of each discovered vulnerability, including its CVSS score, risk rating, and impact description. This section is intended for technical stakeholders who need granular data to prioritize remediation, unlike the Executive Summary which offers high-level business impact and risk overviews.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Executive Summary
Why it's wrong here
The Executive Summary is written for management and other non-technical stakeholders, providing a concise, high-level overview of the test's scope, objectives, and key risk findings in business-oriented language. It deliberately omits detailed vulnerability listings, CVSS scores, and technical impact descriptions because that information is not actionable for its audience. Therefore, it is not the correct section for locating detailed findings with scores.
- ✓
Technical Findings
Why this is correct
The Technical Findings section is the core repository for detailed vulnerability disclosures, listing each finding with its CVSS score, risk rating, affected systems, and a technical description of the impact and exploitation context. This section is specifically tailored for technical staff—such as system administrators, network engineers, and developers—who need precise data to validate and remediate the issues. It is exactly where a pentester documents the technical details of discovered vulnerabilities.
- ✗
Methodology
Why it's wrong here
The Methodology section describes the penetration testing process, including the tools, techniques, and reconnaissance, scanning, exploitation, and post-exploitation procedures used during the engagement. It explains how the test was executed and why certain approaches were chosen, but it does not contain the actual vulnerability findings, their CVSS scores, or impact descriptions. The methodology is about the journey, not the destination.
- ✗
Remediation Summary
Why it's wrong here
The Remediation Summary presents prioritized, actionable recommendations for fixing the identified vulnerabilities, often mapped to specific findings and assigned urgency levels. While it references vulnerabilities, its primary purpose is to outline solutions, such as patches, configuration changes, or compensating controls, rather than to restate detailed findings with scores and technical impact. Thus, it is not the appropriate place to find the detailed vulnerability listing with CVSS scores.
Visual reference
Go deeper
Related to this question
Learn chapter
Third-Party and Supply Chain Risk in Scope
Key term
CVSS
The Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of security vulnerabilities on a scale from 0 to 10.
Key term
Risk rating
A risk rating is a score or label assigned to a potential security threat or vulnerability that indicates how likely it is to cause harm and how severe that harm would be.
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.