hardMultiple Choice
PT0-002 Practice Question: A penetration tester is preparing a report for a…
A penetration tester is preparing a report for a client that requires compliance with PCI DSS. Which of the following is the MOST important consideration for the report structure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The report should map findings to specific PCI DSS requirements.
PCI DSS compliance reporting requires that each identified finding be traceable to the specific PCI DSS requirement it violates, enabling the client to demonstrate compliance status and remediation priorities to a QSA or acquirer. Mapping findings to PCI DSS requirements directly supports the standard's mandate for documented, requirement-specific evidence rather than generic vulnerability lists. Options A, B, and C, while potentially useful in some engagements, are not the most important structural consideration for a PCI DSS compliance report: ASV scan sections apply only to external scanning requirements, anonymization is not a PCI DSS reporting mandate, and encryption of the report itself is a data-handling control rather than a report-structure requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Include a separate section for vulnerabilities found in the ASV scan.
Why it's wrong here
ASV scans are separate; this is not the most important for PCI DSS reports.
- ✗
The client's name and sensitive data should be anonymized.
Why it's wrong here
PCI DSS does not mandate anonymising the client's name; the report must identify the assessed entity and scope. It is tempting because anonymisation protects sensitive data in shared distributions, but that applies to public case studies, not a compliance report delivered to the client itself.
- ✗
All findings must be encrypted at rest and in transit.
Why it's wrong here
Encryption at rest and in transit is a data-handling control, not the report structure consideration PCI DSS emphasises. It is tempting because protecting cardholder data is central to PCI DSS, but the question asks about report structure, where scope, findings and evidence organisation govern compliance.
- ✓
The report should map findings to specific PCI DSS requirements.
Why this is correct
PCI DSS compliance demands demonstrable traceability, so the report must map each finding to the specific PCI DSS requirement it breaches. This lets the client verify compliance status and prioritise remediation against the standard's clauses.
Go deeper
Related to this question
Learn chapter
Active Scanning and Enumeration
Key term
Remediation
Remediation is the process of fixing or eliminating vulnerabilities, misconfigurations, or security weaknesses in an IT environment.
Key term
Evidence
Evidence is any data or documentation that proves an event, action, or condition occurred, crucial for verifying compliance, security incidents, or system changes.
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.