PT0-002 Practice Question: A penetration tester is presenting findings to a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Raw tool output and log files

  Why it's wrong here

  Raw tool output and log files, such as Nmap scans, Nessus .nessus files, or Burp Suite proxy logs, are verbose, technical, and overloaded with false positives that lack business context. Executives require a distilled, prioritized view of risk, not a data dump that forces them to interpret technical artifacts without domain expertise. Presenting unprocessed output obscures the bottom-line impact and can erode confidence in the assessment's clarity and utility.

• ✓

  Risk ratings, business impact, and high-level remediation strategy

  Why this is correct

  Risk ratings, business impact, and a high-level remediation strategy align security findings directly with the organization's operational and financial goals, which is what executive audiences need to prioritize actions and allocate resources. Ratings such as Critical/High/Medium/Low, derived from likelihood and impact (e.g., CVSS base scores adjusted for business context), translate technical vulnerabilities into decision-ready language. The high-level remediation strategy—such as 'segment the payment network' or 'accelerate patching of internet-facing systems'—gives executives actionable direction without drowning them in implementation minutiae.

• ✗

  Detailed exploit code and proof-of-concept

  Why it's wrong here

  Detailed exploit code and proof-of-concept scripts are inappropriate for executives because they are operationally sensitive and technically esoteric; they focus on how a vulnerability is abused rather than the resulting business exposure. Such content is typically reserved for technical staff or developers who need to validate and mitigate the specific weakness, and sharing it widely increases the risk of accidental or malicious misuse. Executives only need to know the severity of the vulnerability and its potential business consequence, not the step-by-step exploitation mechanics.

• ✗

  Step-by-step remediation commands

  Why it's wrong here

  Step-by-step remediation commands, such as specific firewall ACL changes, registry edits, or configuration snippets, are tactical and environment-specific, meant for system administrators and IT engineers who implement fixes. Executives neither need nor can act on such low-level details; their responsibility is to approve budgets, set policy, and oversee risk management, not to execute shell commands. Overloading an executive presentation with operational commands detracts from strategic decision-making and can make the report feel inaccessible to its primary audience.

Go deeper

Related to this question