PT0-002 Practice Question: A penetration tester is preparing a report for a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Provide the same comprehensive report to both audiences, assuming the security team will interpret it for executives.

  Why it's wrong here

  Providing the identical comprehensive report to both audiences fails because it mixes raw exploit details, code snippets, and low-level evidence with high-level business risk in a single unstructured narrative. Executives do not need to know the nuances of a SQL injection payload; they need the likelihood and business impact of a data breach. This approach forces the security team to act as an intermediary interpreter, introducing delays and potential miscommunication, and it also exposes sensitive technical details to readers who may not have the proper security clearance or need-to-know, complicating the report's distribution and confidentiality.

• ✓

  Create a single report that includes an executive summary at the beginning and a detailed technical section later.

  Why this is correct

  This is the correct structure because it aligns with standard penetration testing report formats (e.g., PTES, NIST SP 800-115) that use a layered approach. An executive summary at the front provides a concise, non-technical overview of the highest-risk findings, business impact, and strategic recommendations, allowing executives to make informed decisions without reading every command or log. The detailed technical section later includes reproducible vulnerabilities, affected assets, proof-of-concept evidence, CVSS scores, and specific remediation steps, giving the technical staff the exact data they need to verify and fix the issues while preserving a single authoritative document that ties business context to technical reality.

• ✗

  Write two separate reports: one for executives with only business impact and another for technical staff with all details.

  Why it's wrong here

  Writing separate reports isolates business impact from technical detail, but the stem requires a single report that layers information for both audiences—such as an executive summary with technical appendices—so the technical team cannot cross-reference the tester’s findings against the business context. This approach is tempting because it mirrors standard practice for highly sensitive or legally privileged engagements where strict audience segregation is mandated, and it would be correct if the client explicitly forbade sharing technical details with executives.

• ✗

  Present only the executive summary and invite the technical team to ask questions orally.

  Why it's wrong here

  Presenting only the executive summary and handling technical details orally is inadequate because it violates the principle of written evidence and auditability. Technical staff need a permanent, searchable record of reproduction steps, affected endpoints, and tool-specific output to independently verify each vulnerability and track remediation progress; verbal explanations cannot be reviewed, documented, or used as compliance evidence. Additionally, oral communication is ephemeral and error-prone, and the report itself must serve as the official deliverable for the engagement. Without a written technical section, the client cannot formally close out findings, and the pentest may not meet contractual or regulatory reporting requirements.

Go deeper

Related to this question