Sample questions
Pt Reporting Remediation PrioritizationDifficulty 1
A pentest report typically opens with an executive summary before the detailed technical findings. Who is this section mainly written for?
- aOnly the engineers who will patch each individual finding line by line.
- bNon-technical decision-makers who need the overall risk picture without deep technical detail.✓
- cThe pentester's own internal QA team, purely for record-keeping purposes.
- dNo one in particular; it exists only because report templates require a first page, regardless of who reads it or what role they hold.
Explanation:The executive summary is written for leadership and other non-technical stakeholders: it conveys overall risk, business impact, and top priorities in plain language, leaving technical depth to the findings section.
Pt Reporting Remediation PrioritizationDifficulty 1
In the technical findings section of a pentest report, what level of detail is expected for each finding compared to the executive summary?
- aExactly the same wording as the executive summary, just repeated for emphasis.
- bLess detail than the executive summary, since technical readers already know the systems well enough to skip any supporting evidence.
- cEnough detail (affected asset, evidence, impact, recommendation) for engineers to understand and act on it.✓
- dNo detail at all beyond a one-word severity label for each finding.
Explanation:The technical section is written for engineers and administrators who will remediate the issue: it needs enough concrete detail — affected asset, evidence, impact, and a recommendation — to be actionable, unlike the high-level executive summary.
Pt Reporting Remediation PrioritizationDifficulty 1
Besides the executive summary and technical findings, what other section does a standard pentest report usually include to describe what was and was not tested?
- aA scope and methodology section, stating what systems were in scope and how testing was conducted.✓
- bA marketing section describing the testing vendor's other unrelated products and services, unrelated to this specific engagement's scope.
- cA full copy of every tool's raw output with no explanation of what was tested.
- dA legal disclaimer only, with no description of the systems or approach used.
Explanation:A scope and methodology section anchors the whole report: it tells the reader exactly which systems were authorized and tested and what approach was used, so findings can be interpreted in context.
Pt Reporting Remediation PrioritizationDifficulty 2
A pentest report assigns each finding a severity such as Critical, High, Medium, or Low, often informed by a CVSS score. What is the main purpose of this severity rating?
- aTo make the report longer so it looks more thorough to the client.
- bTo replace the need for any written description of the finding.
- cTo rank findings purely by how interesting they were to discover during testing.
- dTo help the client understand relative risk and decide what to fix first.✓
Explanation:Severity ratings give the client a quick, comparable signal of relative risk across many findings, supporting remediation prioritization decisions — they summarize risk, they do not replace the finding's description.
Pt Reporting Remediation PrioritizationDifficulty 2
A finding has a technically high CVSS score, but the affected server holds only public marketing content with no sensitive data or write access to anything important. Why might a pentester note this context in the report alongside the CVSS score?
- aBecause CVSS scores must always be silently ignored and replaced with the pentester's personal opinion.
- bBecause the report should hide the CVSS score entirely whenever it seems inconvenient to the client.
- cBecause business context (what data or function the asset actually holds) shapes real-world prioritization, not the raw score alone.✓
- dBecause context notes are purely decorative and have no bearing on how the client should prioritize the fix, especially on a low-value, non-sensitive system.
Explanation:CVSS reflects technical severity in the abstract, but real prioritization also depends on business context — what the affected asset actually does and what it holds. Noting that context helps the client weigh the finding realistically instead of relying on the score alone.
Pt Reporting Remediation PrioritizationDifficulty 1
A pentest report includes a remediation timeline recommendation, suggesting Critical findings be fixed fastest and Low findings on a longer horizon. Why do different severities typically get different suggested timelines?
- aBecause higher-risk issues need faster action to reduce the window of exposure, while lower-risk ones can be scheduled more flexibly.✓
- bBecause Low findings are unimportant and should simply never be fixed at all.
- cBecause the pentester is legally required to demand the exact same deadline for every single finding, regardless of severity, exploitability, or how quickly the client's team can realistically respond.
- dBecause timeline recommendations are arbitrary and carry no real meaning for the client.
Explanation:Suggested timelines are risk-proportional: Critical and High findings represent greater exposure and typically warrant faster remediation, while Low findings can reasonably be scheduled into normal maintenance cycles.