A penetration tester needs to present the findings of a test to a non-technical audience. The test identified 15 vulnerabilities across different severity levels. Which visual representation is most effective for conveying the overall risk posture?

A table listing each vulnerability with its CVSS score and CWE identifier.

A pie chart showing the percentage of vulnerabilities by severity (Critical, High, Medium, Low).

A scatter plot of vulnerabilities by port number and service.

A line graph showing the number of vulnerabilities discovered over time.

What is the primary purpose of the executive summary in a penetration test report?

To provide step-by-step remediation instructions for the IT team

To provide a detailed technical explanation of each vulnerability found

To list every command and tool used during the penetration test

To present a high-level overview of key findings and their business impact for non-technical stakeholders

Which of the following is the best example of an actionable remediation recommendation?

Disable all unnecessary services on all servers

Update all software to the latest version

Apply the vendor-supplied security patch MS-2024-001 to all internet-facing web servers within 30 days

Improve the overall security posture of the organization

A penetration test reveals a critical remote code execution (RCE) vulnerability in a legacy application that is scheduled for decommissioning in six months. The application is currently internet-facing. Which remediation recommendation is most appropriate for this finding?

Apply the latest vendor patch to the application.

Immediately isolate the application from the internet and implement a compensating control, such as a web application firewall (WAF), until it is decommissioned.

Rewrite the application in a modern language to eliminate the vulnerability.

Document the risk and accept it, since the application will be decommissioned soon.

When writing a penetration test report, why is it important to differentiate between technical and non-technical language?

To make the report longer and more comprehensive

To comply with legal requirements for report writing

To ensure that all readers, regardless of technical background, can understand the findings and their implications

To hide the technical details from the client

CompTIAPenTest+

Domain 1Objective 4

Penetration Test Reports PT0-003 Practice Questions (Page 5)

Part of the Engagement management domain, which accounts for 13% of the PT0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

13%of the exam

Questions 21–25

21application · medium
A penetration tester needs to present the findings of a test to a non-technical audience. The test identified 15 vulnerabilities across different severity levels. Which visual representation is most effective for conveying the overall risk posture?
Select an answer first
22foundation · easy
What is the primary purpose of the executive summary in a penetration test report?
Select an answer first
23foundation · easy
Which of the following is the best example of an actionable remediation recommendation?
Select an answer first
24application · medium
A penetration test reveals a critical remote code execution (RCE) vulnerability in a legacy application that is scheduled for decommissioning in six months. The application is currently internet-facing. Which remediation recommendation is most appropriate for this finding?
Select an answer first
25foundation · easy
When writing a penetration test report, why is it important to differentiate between technical and non-technical language?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PT0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “PT0-003” is a trademark of its owner, used for identification only.