- A
Include the vulnerability with the risk rating, a brief description, and a note that it was remediated during the test
Why wrong: While acknowledging remediation is important, the report should also contain full reproduction steps and impact analysis to serve as a complete reference.
- B
Exclude the vulnerability from the report because it has already been fixed
Why wrong: All findings, even remediated ones, should be documented to demonstrate the test's thoroughness and to provide evidence that the vulnerability existed.
- C
Document the vulnerability in full, including reproduction steps, impact, and evidence, and note the remediation status
This approach ensures the report is complete and useful for the client's records, compliance, and future prevention. The remediation status provides closure.
- D
Reduce the risk rating of the vulnerability because it has been fixed, and include it in an appendix
Why wrong: The risk rating should reflect the inherent severity at the time of discovery, not the remediated state. Changing the rating could misrepresent the original risk.
Quick Answer
The correct choice is to document the vulnerability in full, including reproduction steps, impact, and evidence, and note the remediation status. This approach aligns with penetration testing standards like PTES and OWASP, which mandate that all findings be recorded as a permanent record regardless of whether they have been fixed. By fully documenting the SQL injection flaw—even after the client’s technical team has remediated it—you ensure the report remains useful for compliance audits, future reference, and verification of the fix. On the CompTIA PenTest+ PT0-002 exam, this concept tests your understanding of professional reporting ethics and the principle that documenting remediated findings is not optional; a common trap is assuming you can omit or downplay a resolved critical issue. Remember the memory tip: “Fix the flaw, not the report”—always write the full finding, then tag it as remediated.
PT0-002 Reporting and Communication Practice Question
This PT0-002 practice question tests your understanding of reporting and communication. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: penetration test reports must be comprehensive records.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is writing the findings section of a report. The tester identified a critical SQL injection vulnerability that allows extraction of the entire customer database. The client's technical team has already remediated the issue. How should the tester present this finding to ensure clarity and usefulness?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Document the vulnerability in full, including reproduction steps, impact, and evidence, and note the remediation status
Option C is correct because penetration testing standards (e.g., PTES, OWASP) require full documentation of all findings regardless of remediation status. Including reproduction steps, impact analysis, and evidence ensures the report serves as a permanent record for compliance, audit, and future reference. Noting the remediation status provides clear context that the issue has been resolved, which is critical for stakeholders who need to verify the fix.
Key principle: Penetration test reports must be comprehensive records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Include the vulnerability with the risk rating, a brief description, and a note that it was remediated during the test
Why it's wrong here
While acknowledging remediation is important, the report should also contain full reproduction steps and impact analysis to serve as a complete reference.
- ✗
Exclude the vulnerability from the report because it has already been fixed
Why it's wrong here
All findings, even remediated ones, should be documented to demonstrate the test's thoroughness and to provide evidence that the vulnerability existed.
- ✓
Document the vulnerability in full, including reproduction steps, impact, and evidence, and note the remediation status
Why this is correct
This approach ensures the report is complete and useful for the client's records, compliance, and future prevention. The remediation status provides closure.
Related concept
Penetration test reports must be comprehensive records.
- ✗
Reduce the risk rating of the vulnerability because it has been fixed, and include it in an appendix
Why it's wrong here
The risk rating should reflect the inherent severity at the time of discovery, not the remediated state. Changing the rating could misrepresent the original risk.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates mistakenly think remediated vulnerabilities should be omitted or minimized, but the PT0-002 exam expects full documentation to maintain report integrity and support post-remediation validation.
Detailed technical explanation
How to think about this question
In a penetration test report, the findings section should follow a structured format like CVSS scoring for risk rating, detailed proof-of-concept (PoC) code or HTTP request/response pairs, and a clear remediation status field (e.g., 'Fixed' or 'Remediated'). This level of detail allows the client's security team to independently verify the fix by replaying the exact attack vector, and it provides evidence for compliance frameworks such as PCI DSS or SOC 2 that require documentation of all vulnerabilities and their resolution.
KKey Concepts to Remember
- Penetration test reports must be comprehensive records.
- All identified vulnerabilities, even remediated ones, require full documentation.
- Documentation includes reproduction steps, impact, and evidence.
- Remediation status should be noted but does not alter the original finding's detail.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Penetration test reports must be comprehensive records.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
What to study next
Got this wrong? Here's your next step.
Review penetration test reports must be comprehensive records., then practise related PT0-002 questions on the same topic to reinforce the concept.
- →
Reporting and Communication — study guide chapter
Learn the concepts, then practise the questions
- →
Reporting and Communication practice questions
Targeted practice on this topic area only
- →
All PT0-002 questions
509 questions across all exam domains
- →
CompTIA PenTest+ PT0-002 study guide
Full concept coverage aligned to exam objectives
- →
PT0-002 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related PT0-002 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Planning and Scoping practice questions
Practise PT0-002 questions linked to Planning and Scoping.
Information Gathering and Vulnerability Scanning practice questions
Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.
Attacks and Exploits practice questions
Practise PT0-002 questions linked to Attacks and Exploits.
Reporting and Communication practice questions
Practise PT0-002 questions linked to Reporting and Communication.
Tools and Code Analysis practice questions
Practise PT0-002 questions linked to Tools and Code Analysis.
PT0-002 fundamentals practice questions
Practise PT0-002 questions linked to PT0-002 fundamentals.
PT0-002 scenario practice questions
Practise PT0-002 questions linked to PT0-002 scenario.
PT0-002 troubleshooting practice questions
Practise PT0-002 questions linked to PT0-002 troubleshooting.
Practice this exam
Start a free PT0-002 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this PT0-002 question test?
Reporting and Communication — This question tests Reporting and Communication — Penetration test reports must be comprehensive records..
What is the correct answer to this question?
The correct answer is: Document the vulnerability in full, including reproduction steps, impact, and evidence, and note the remediation status — Option C is correct because penetration testing standards (e.g., PTES, OWASP) require full documentation of all findings regardless of remediation status. Including reproduction steps, impact analysis, and evidence ensures the report serves as a permanent record for compliance, audit, and future reference. Noting the remediation status provides clear context that the issue has been resolved, which is critical for stakeholders who need to verify the fix.
What should I do if I get this PT0-002 question wrong?
Review penetration test reports must be comprehensive records., then practise related PT0-002 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Penetration test reports must be comprehensive records.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.