PT0-002 Practice Question: A penetration tester is writing the technical…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Executive summary

  Why it's wrong here

  The executive summary is a high-level, business-focused overview written for non-technical stakeholders such as C-level executives and project sponsors. Its purpose is to convey the overall risk exposure, business impact, and high-level recommendations without revealing tactical details or step-by-step attack paths. Including detailed reproduction steps here would overwhelm the intended audience and could expose sensitive attack methodology to readers who do not need it for decision-making, thus violating the audience-appropriate reporting principle.

• ✗

  Risk rating section

  Why it's wrong here

  The risk rating section exists to explain and justify the severity scores assigned to each finding, typically using a framework like CVSS or a qualitative likelihood/impact matrix. It describes the scoring criteria, vectors, and contextual factors that influenced the ratings, but it is not the place for a technical walkthrough of how a vulnerability was exploited. Reproduction steps are operational details that belong in the findings body; the risk rating section focuses on quantifying the risk, not demonstrating the exploit.

• ✓

  Findings and recommendations

  Why this is correct

  The findings and recommendations section is the core technical narrative of a penetration test report, where each vulnerability is fully detailed. It provides a structured breakdown including the affected asset, CVSS score, description, root cause, step-by-step reproduction instructions, evidence, and prioritized remediation guidance. This is the standard location for reproduction steps because it gives the client's technical staff the precise, contextual information they need to validate and fix the issue, while also linking each step to the associated risk and recommended action.

• ✗

  Appendix

  Why it's wrong here

  The appendix is intended for supplementary material that supports but does not form the main narrative of the report, such as raw scan output, log excerpts, screenshots, or extended command listings. While some reproduction evidence could appear here, putting the primary step-by-step reproduction instructions in the appendix would fragment the technical discussion and risk being overlooked if the appendix is not reviewed thoroughly. The main findings and recommendations section is where reproduction steps should be integrated with the analysis, so the appendix remains a reference repository rather than the primary technical location.

Go deeper

Related to this question