easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester is preparing a report for a…
A penetration tester is preparing a report for a client's CISO who is not technical. The CISO needs to understand the overall risk posture and the business impact of the findings. Which section of the report should be tailored for this audience?
⚠ Common exam trap
Candidates often confuse 'executive summary' with 'remediation details' or 'technical findings,' assuming the CISO needs operational specifics, when in fact the exam tests the principle that non-technical audiences require a distilled, business-focused overview of risk posture and impact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Executive summary
The executive summary is designed for non-technical stakeholders like a CISO to quickly grasp the overall risk posture and business impact without needing to interpret raw data or technical jargon. It synthesizes findings into high-level business risks, such as potential financial loss or regulatory exposure, rather than detailing specific vulnerabilities or exploit chains. This section ensures the audience can make informed decisions about resource allocation and risk acceptance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Executive summary
Why this is correct
The executive summary is crafted specifically for decision-makers like the CISO, translating technical vulnerability data into clear business risk. It highlights the overall security posture, key threats that could impact operations or revenue, and suggested prioritization—all in non-technical language. This section enables the CISO to communicate findings to the board and justify resource allocation without needing to parse exploits or raw logs.
- ✗
Technical findings
Why it's wrong here
Technical findings contain detailed exploit steps, proof-of-concept code, and verbose vulnerability descriptions such as CVSS vectors and affected endpoints. This section is intended for IT security engineers who will validate and remediate the issues, not for a CISO who needs synthesized risk context. Presenting this raw technical detail to an executive would obscure the business-critical message and overwhelm an audience focused on strategic decisions.
- ✗
Appendices with raw scan data
Why it's wrong here
Appendices with raw scan data provide a repository of Nmap output, Nessus reports, and even packet captures that serve as auditable evidence. These data sets are enormous and unstructured, requiring specialized tools to interpret, making them unsuitable for an executive summary. A CISO would be lost in a sea of logs rather than gaining insight into risk posture, so this appendix is meant for compliance or technical follow-up, not executive reading.
- ✗
Remediation details
Why it's wrong here
Remediation details include step-by-step fixes, exact configuration changes, and patch versions tailored for system administrators and developers. These are action-oriented technical instructions that presume deep knowledge of the infrastructure and are not strategic in nature. The CISO requires a broader view of remediation efforts—such as timeframes, costs, and residual risk—rather than the granular technical procedures themselves.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.