How should I use these Reporting and Communication practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Reporting and Communication questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Reporting and Communication domain.

PT0-002 · topic practice

Reporting and Communication practice questions

Use this page to practise Reporting and Communication questions for this certification. Focus on how the exam tests reporting and communication in scenario format — understanding the why behind each answer builds more durable knowledge than memorising options.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Reporting and Communication

Practice 10 questions Browse domain →

What the exam tests

What to know about Reporting and Communication

Reporting and Communication questions on this certification test your ability to deploy and manage reporting and communication concepts in scenario-based situations.

Core Reporting and Communication concepts and how they apply in real-world cloud scenarios.

How to deploy reporting and communication correctly and verify the outcome.

Troubleshooting reporting and communication issues by interpreting error output and system state.

Cloud best practices and Reporting and Communication design trade-offs tested by this certification.

Watch out for

Common Reporting and Communication exam traps

▸Selecting the most expensive service when a simpler managed option meets the requirement.
▸Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
▸Choosing a global service fix when the issue is region-specific.
▸Overlooking cost implications of cross-region data transfer in architecture questions.

Practice set

Reporting and Communication questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Reporting and Communication explanation →

After completing a penetration test, the lead tester is preparing the executive summary. The client's CISO wants to understand the business impact of a critical vulnerability found in the customer-facing web application. Which of the following is the BEST way to convey this in the report?

Trap 1: List the CVSS score and exploitability metrics

CVSS scores are technical and may not effectively communicate business impact to non-technical executives.

Trap 2: Provide the raw log entries showing the exploitation

Raw logs are too detailed for an executive summary and do not directly convey business impact.

Trap 3: Recommend a specific patch version

Patch recommendations belong in the technical remediation section, not the executive summary.

Study all Reporting and Communication common traps →

A
List the CVSS score and exploitability metrics
Why wrong: CVSS scores are technical and may not effectively communicate business impact to non-technical executives.
B
Describe the attack scenario and potential financial loss
Correct. This explains the real-world consequences in business terms, which is most relevant for an executive summary.
C
Provide the raw log entries showing the exploitation
Why wrong: Raw logs are too detailed for an executive summary and do not directly convey business impact.
D
Recommend a specific patch version
Why wrong: Patch recommendations belong in the technical remediation section, not the executive summary.

Reporting and Communication practice questions

What to know about Reporting and Communication

Common Reporting and Communication exam traps

Reporting and Communication questions

After completing a penetration test, the lead tester is preparing the executive summary. The client's CISO wants to understand the business impact of a critical vulnerability found in the customer-facing web application. Which of the following is the BEST way to convey this in the report?

A penetration tester has completed the test and is preparing the final report. The client requested a risk rating for each vulnerability. Which of the following frameworks is MOST commonly used to standardize vulnerability severity ratings in penetration testing reports?

A penetration test report includes a finding about a SQL injection vulnerability in a public-facing web application. Which section of the report would be the MOST appropriate place to provide step-by-step remediation instructions for the development team?

After completing a penetration test, the client's technical team requests the detailed raw data (e.g., scan results, exploit logs, packet captures) used to support the findings. According to best practices, which of the following should the penetration tester do?

A penetration tester is preparing the executive summary for a report. Which of the following metrics would be MOST valuable to include for non-technical stakeholders to understand the overall security posture?

After a penetration test, the client's development team requests that the report include specific, actionable remediation steps for each vulnerability. Where in the report should this information be placed?

A penetration tester is preparing the executive summary of a report for a client's board of directors. Which of the following metrics would be MOST valuable for this audience to understand the overall security posture?

After a penetration test, the client's development team requires detailed, step-by-step instructions to reproduce a SQL injection vulnerability found in the user login functionality. In which section of the standard penetration testing report should this information be included?

In a penetration test report, the executive summary is primarily intended for which audience?

After a penetration test, the client's technical team wants to understand the exact steps required to reproduce a cross-site scripting vulnerability found in the web application. In which section of the standard penetration testing report should this information be included?

After completing a penetration test, the client requests a one-page document that highlights the most critical vulnerabilities, overall risk level, and recommended next steps for management. Which deliverable should the penetration tester provide?

A penetration tester is writing the executive summary of a penetration test report. Which of the following elements is MOST important to include for a non-technical audience?

After the penetration test, the client requests a one-page summary of the test's scope, key findings, and recommended next steps for the board of directors. Which document should the penetration tester provide?

The client's development team needs to reproduce a cross-site scripting vulnerability found in the login form. They require the exact payload and steps. Which deliverable should the penetration tester provide to meet this need?

During a penetration test, the tester discovers active ransomware on a critical server. Which communication should the tester perform FIRST according to standard rules of engagement?

After a penetration test, the client requests a document that includes the methodology used, a list of all vulnerabilities found along with their CVSS scores, and detailed steps for remediation. Which type of report section is this?

After completing a penetration test, the client's board of directors requests a document that provides a high-level overview of the test's objectives, key findings, and business impact. Which section of the standard penetration testing report should be produced for this audience?

The client's development team needs to reproduce a cross-site scripting (XSS) vulnerability discovered during the penetration test. They require the exact payload and step-by-step instructions. Which deliverable should the tester provide to meet this need?

Track your progress over time

Start a Reporting and Communication only practice session

Related PT0-002 topic practice pages

Planning and Scoping practice questions

Information Gathering and Vulnerability Scanning practice questions

Attacks and Exploits practice questions

Reporting and Communication practice questions

Tools and Code Analysis practice questions

PT0-002 fundamentals practice questions

PT0-002 scenario practice questions

PT0-002 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid