The answer is the Executive Summary. This is the correct section to expand because it is specifically designed to provide an executive summary for high-level risk overview, translating technical vulnerabilities into business impact and risk ratings that non-technical stakeholders like a VP of Security can immediately act upon. On the CompTIA PenTest+ PT0-002 exam, this question tests your understanding of report structure and stakeholder communication, often appearing as a scenario where you must choose between the Executive Summary and detailed sections like Technical Findings or Remediation Steps. A common trap is selecting the Findings section, which contains raw data, but the exam emphasizes that the Executive Summary is the only part that condenses critical risks into a single-page, business-focused snapshot without compromising the full report’s integrity. Remember the mnemonic: “Executives need the Executive Summary—it’s the ‘big picture’ for the big chairs.”
PT0-002 Reporting and Communication Practice Question
This PT0-002 practice question tests your understanding of reporting and communication. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: executive Summary is for non-technical decision-makers.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester has completed the test and is writing the final report. The client's VP of Security requests a single-page summary that highlights the most critical risks and their business impact. Which section of the report should be expanded to satisfy this request while maintaining the integrity of the full report?
Executive Summary – should include high-level findings and risk ratings
The executive summary is intended for decision-makers and should be concise, highlighting critical risks and business impact, which aligns with the VP's request.
B
Technical Findings – should include a risk matrix
Why wrong: The technical findings section is too detailed for a VP-level request and is better suited for the technical security team.
C
Appendices – should include a condensed risk report
Why wrong: Appendices are for supporting details, not for primary communication of risks to executives.
D
Methodology – should include a summary of attack paths
Why wrong: Methodology describes how the test was conducted, not the critical risks and their impact.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Executive Summary – should include high-level findings and risk ratings
The VP of Security needs a concise, business-focused overview of critical risks and their impact. The Executive Summary is the appropriate section to expand because it is designed to present high-level findings, risk ratings, and business context for non-technical stakeholders, preserving the full report's integrity by keeping detailed technical data in other sections.
Key principle: Executive Summary is for non-technical decision-makers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Executive Summary – should include high-level findings and risk ratings
Why this is correct
The executive summary is intended for decision-makers and should be concise, highlighting critical risks and business impact, which aligns with the VP's request.
Related concept
Executive Summary is for non-technical decision-makers.
✗
Technical Findings – should include a risk matrix
Why it's wrong here
The technical findings section is too detailed for a VP-level request and is better suited for the technical security team.
✗
Appendices – should include a condensed risk report
Why it's wrong here
Appendices are for supporting details, not for primary communication of risks to executives.
✗
Methodology – should include a summary of attack paths
Why it's wrong here
Methodology describes how the test was conducted, not the critical risks and their impact.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think a risk matrix belongs in Technical Findings (Option B) because it involves technical scoring, but the exam tests that business-impact summaries are always placed in the Executive Summary to satisfy non-technical stakeholders.
Detailed technical explanation
How to think about this question
In penetration testing reports, the Executive Summary typically uses a risk rating scale (e.g., CVSS v3.1 scores or a custom critical/high/medium/low system) to map technical vulnerabilities to business impact, such as potential financial loss, regulatory fines, or reputational damage. Expanding this section with a one-page risk heatmap or a prioritized list of top 3-5 findings ensures the VP can make informed decisions without reading the full 50-page report, while the Technical Findings retain the raw data for remediation teams.
KKey Concepts to Remember
Executive Summary is for non-technical decision-makers.
It provides a high-level overview of critical findings and risks.
Business impact is a key component of the Executive Summary.
It should be concise and actionable for strategic planning.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Executive Summary is for non-technical decision-makers.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Executive Summary is for non-technical decision-makers. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Reporting and Communication — This question tests Reporting and Communication — Executive Summary is for non-technical decision-makers..
What is the correct answer to this question?
The correct answer is: Executive Summary – should include high-level findings and risk ratings — The VP of Security needs a concise, business-focused overview of critical risks and their impact. The Executive Summary is the appropriate section to expand because it is designed to present high-level findings, risk ratings, and business context for non-technical stakeholders, preserving the full report's integrity by keeping detailed technical data in other sections.
What should I do if I get this PT0-002 question wrong?
Review executive Summary is for non-technical decision-makers., then practise related PT0-002 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Executive Summary is for non-technical decision-makers.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A penetration tester is preparing the final report. The client's IT director wants a high-level overview of the test results, including the number of findings and the overall risk rating. Which section of the report should the tester point to?
easy
✓ A.Executive summary
B.Technical findings
C.Methodology
D.Recommendations
Why A: The executive summary is specifically designed to provide a high-level overview for management and non-technical stakeholders, such as the IT director. It summarizes the number of findings, overall risk rating, and key business impacts without delving into technical details, making it the correct section for this request.
Variation 2. A penetration tester is writing the executive summary for a report. The client's CEO needs to understand the business impact of a critical SQL injection vulnerability. Which of the following should the tester include?
medium
A.The exact SQL injection payload used
B.The CVSS vector string
✓ C.The potential for data breach and financial loss
D.The remediation steps in detail
Why C: The CEO needs to understand the business impact, not technical details. Option C directly addresses the core concern: a SQL injection vulnerability can lead to unauthorized data access, resulting in a data breach and significant financial loss from fines, remediation costs, and reputational damage. This aligns with the executive summary's goal of translating technical risk into business risk.
Variation 3. A penetration tester is preparing the final report. The client's CEO wants a high-level overview of the test results, including the overall security posture and business risk, without technical details. Which section of the report should the tester emphasize for the CEO?
easy
A.Technical findings and recommendations
✓ B.Executive summary
C.Methodology
D.Appendices
Why B: The executive summary is the section of a penetration testing report that provides a high-level overview of the test results, focusing on the overall security posture and business risk without technical details. It is specifically designed for non-technical stakeholders like the CEO, who need to understand the impact on the organization without delving into specific vulnerabilities or exploitation steps.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.