How should I use these Reporting and Communication practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Reporting and Communication questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Reporting and Communication domain.

PT0-002 · topic practice

Reporting and Communication practice questions

Practise CompTIA PenTest+ PT0-002 Reporting and Communication practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Reporting and Communication

Practice 10 questions Browse domain →

What the exam tests

What to know about Reporting and Communication

Reporting and Communication questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Reporting and Communication exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Reporting and Communication questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Reporting and Communication explanation →

During a penetration test, a penetration tester discovers a critical vulnerability that allows unauthenticated remote code execution on a public-facing web server. According to best practices for communication during a penetration test, what should the tester do next?

Trap 1: Document the finding and inform the client only after verifying…

While verification is good, the urgency of a critical finding requires immediate communication.

Trap 2: Wait until the end of the test to include it in the final report.

Waiting could leave the client exposed to exploitation without their knowledge.

Trap 3: Exploit the vulnerability to demonstrate the full impact before…

Exploiting without warning could cause unintended damage and is not ethical.

Study all Reporting and Communication common traps →

A
Immediately notify the client of the critical finding and provide initial remediation steps.
Immediate notification allows the client to mitigate the risk promptly.
B
Document the finding and inform the client only after verifying with a second tester.
Why wrong: While verification is good, the urgency of a critical finding requires immediate communication.
C
Wait until the end of the test to include it in the final report.
Why wrong: Waiting could leave the client exposed to exploitation without their knowledge.
D
Exploit the vulnerability to demonstrate the full impact before notifying the client.
Why wrong: Exploiting without warning could cause unintended damage and is not ethical.

Reporting and Communication practice questions

What to know about Reporting and Communication

Common Reporting and Communication exam traps

Reporting and Communication questions

During a penetration test, a penetration tester discovers a critical vulnerability that allows unauthenticated remote code execution on a public-facing web server. According to best practices for communication during a penetration test, what should the tester do next?

When writing the executive summary of a penetration test report, which of the following is the most appropriate language to use?

A penetration tester is preparing a remediation recommendation for a SQL injection vulnerability found in a legacy application. The development team cannot immediately update the framework due to compatibility issues. What should the tester recommend as a compensating control?

A penetration tester is calculating the severity of a vulnerability using the DREAD model. Which of the following factors is assessed under the 'Damage' category?

In a penetration test report, which section should contain detailed technical information such as affected systems, proof-of-concept code, and remediation steps?

During a penetration test, the tester discovers evidence of an ongoing cyber attack by an external threat actor on the client's network. What is the tester's responsibility?

A penetration tester is presenting findings to a mixed audience of technical staff and executives. The executives seem confused about the risk ratings. How should the tester adjust the presentation?

A penetration tester is prioritizing remediation recommendations in a report. Which of the following should be considered first?

In a penetration test report, the tester includes a screenshot of a successful exploit. What metadata should the screenshot include to ensure proper evidence documentation?

Which of the following is an example of a responsible remediation recommendation?

A penetration tester uses the CVSS base score to rate a vulnerability. The tester finds that the vulnerability has a high CVSS score but the affected system is isolated from the internet and has no sensitive data. Which approach should the tester take when assigning an overall severity rating?

A client requests that the penetration test report include raw output from the scanning tools used. Where should this output be placed in the report?

A penetration tester is preparing to present findings to the client's technical team. Which TWO practices are most effective for this audience?

During a penetration test, the tester encounters a situation where the scope of the test is ambiguous. Which TWO actions should the tester take to clarify the situation?

Which THREE items are typically included in the appendices of a penetration test report?

A penetration tester discovers a critical vulnerability on a client's web server and wants to communicate it immediately. Which of the following is the most appropriate action?

Which section of a penetration testing report should provide a high-level overview of the test results using business language and strategic recommendations?

During a penetration test, a tester discovers evidence of an ongoing live exploitation by an unknown third party. Which of the following should the tester do first?

A penetration tester is writing a report and needs to assign a severity rating to a vulnerability that has a CVSS base score of 7.5. According to CVSS v3.1, which severity level does this score correspond to?

A penetration tester is evaluating vulnerabilities using the DREAD model. For a specific vulnerability, the tester assigns the following scores: Damage=8, Reproducibility=7, Exploitability=9, Affected users=6, Discoverability=5. Which of the following is the overall DREAD risk rating?

Track your progress over time

Start a Reporting and Communication only practice session

Related PT0-002 topic practice pages

Information Gathering and Vulnerability Scanning practice questions

Planning and Scoping practice questions

Reporting and Communication practice questions

Attacks and Exploits practice questions

Tools and Code Analysis practice questions

PT0-002 fundamentals practice questions

PT0-002 scenario practice questions

PT0-002 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid