CISSP Security Assessment and Testing Practice Question
After a penetration test, the tester provides a report that includes vulnerabilities found, exploitation details, and recommended fixes. Which step of the penetration testing process does this represent?
⚠ Common exam trap
It's easy for candidates to confuse 'post-exploitation' with the final reporting step, because post-exploitation involves documenting actions taken after access, but the formal report is a separate, distinct phase that synthesizes all findings from the entire test.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reporting
The reporting phase is the final step in the penetration testing process, where the tester documents all findings, including vulnerabilities discovered, exploitation details, and recommended remediation steps. This report is delivered to the client to provide a clear understanding of the security posture and actionable fixes. Without this step, the test results would have no value for improving security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Reporting
Why this is correct
Reporting is the formal, final phase of a penetration testing engagement where the tester documents discovered vulnerabilities, methodology, and risk ratings. This deliverable translates technical findings into actionable remediation steps for both executive and technical stakeholders, marking the official conclusion of the active assessment.
- ✗
Post-exploitation
Why it's wrong here
Post-exploitation occurs immediately after a system is successfully breached, focusing on maintaining access, escalating privileges, and pivoting to other network segments. While it generates the data that will eventually be reported, it is an active, technical phase of the assessment rather than the administrative delivery of the final report.
- ✗
Planning and scoping
Why it's wrong here
Planning and scoping constitute the preparatory phase established before any active testing begins. During this stage, the rules of engagement, target boundaries, legal authorizations, and testing timelines are defined, making it chronologically opposite to the post-test reporting phase.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance is the initial information-gathering phase where attackers or testers collect passive and active intelligence about the target organization. This phase occurs prior to vulnerability scanning and exploitation, focusing on mapping the attack surface rather than documenting completed test results.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Penetration testing
Penetration testing is a simulated cyberattack on a computer system, network, or application to find security weaknesses before real attackers can exploit them.
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.