A penetration tester is preparing the final report for a client. The report will be read by both the CISO and the IT security team. Which report structure best serves both audiences?

A single non-technical report with a high-level summary and no technical details.

A report with an executive summary at the beginning, followed by detailed technical findings and recommendations.

A single technical report with all findings, evidence, and recommendations, written for the IT security team.

Two separate reports: one for the CISO and one for the IT security team, with no overlap in content.

A penetration tester is writing a report for a client. The client's management team is non-technical, but the IT staff will also read the report. How should the tester handle the language in the report?

Write the entire report in non-technical language to ensure management understands it.

Use technical language throughout the report to ensure accuracy for the IT staff.

Use technical language in the findings and recommendations sections, and non-technical language in the executive summary.

Avoid technical terms entirely and use only business terms throughout the report.

Which of the following is an example of evidence that should be included in the findings documentation?

The full text of the penetration testing contract

A list of all employees' names and email addresses

The tester's personal notes about the client's security team

A screenshot of the command output showing successful exploitation

What does 'impact analysis' in a penetration test report primarily assess?

The potential consequences of a vulnerability being exploited on the organization's operations and security

The financial cost of the penetration test

The number of systems affected by the vulnerability

The likelihood of the vulnerability being discovered by an attacker

What is the recommended structure for a penetration test report?

Executive summary, methodology, findings, recommendations, and appendices

Recommendations, findings, methodology, executive summary, and appendices

Findings, executive summary, recommendations, methodology, and appendices

Methodology, findings, appendices, recommendations, and executive summary

CompTIAPenTest+

Domain 1Objective 4

Penetration Test Reports PT0-003 Practice Questions (Page 2)

Part of the Engagement management domain, which accounts for 13% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

13%of the exam

Questions 6–10

6application · medium
A penetration tester is preparing the final report for a client. The report will be read by both the CISO and the IT security team. Which report structure best serves both audiences?
Select an answer first
7application · medium
A penetration tester is writing a report for a client. The client's management team is non-technical, but the IT staff will also read the report. How should the tester handle the language in the report?
Select an answer first
8foundation · easy
Which of the following is an example of evidence that should be included in the findings documentation?
Select an answer first
9foundation · easy
What does 'impact analysis' in a penetration test report primarily assess?
Select an answer first
10foundation · easy
What is the recommended structure for a penetration test report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.