Report Writing and Post-Testing Actions CPENT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are creating a penetration test report for a client that wants to use it to track remediation progress. Which section of the report is most important for this purpose?

   • AThe executive summary, because it provides a high-level overview.
   • BThe findings section with clear severity ratings and remediation steps for each vulnerability.
   • CThe appendix, because it contains raw data and evidence.
   • DThe methodology section, because it explains how the test was conducted.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During a client debriefing, how should the tester present the findings to non-technical stakeholders?

   • AUse as much technical jargon as possible to show expertise
   • BFocus only on the most critical vulnerability
   • CSkip the debriefing and just send the report
   • DUse clear, non-technical language and focus on business impact
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   Your penetration test uncovered a critical vulnerability that, if exploited, could expose customer PII. During the debriefing, the client's legal counsel asks whether the report must include the actual PII captured during testing as evidence. The client's data protection policy requires minimizing the use of personal data. How should you handle the PII in the report?

   • AInclude the PII in the report but deliver it without encryption to the client's legal team.
   • BInclude redacted or masked samples of the PII in the report, with a description of the data types and the full evidence stored securely for the client's review.
   • COmit all PII from the report and only describe the vulnerability in general terms.
   • DInclude the full PII in the report because it is necessary evidence for the technical team.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   After a penetration test, your team reviews the engagement and identifies that the initial scope definition was unclear, leading to two days of testing systems outside the authorized scope. Additionally, the team discovered that the vulnerability scanner used was outdated, missing several known vulnerabilities that were later found manually. What should be the primary focus of the lessons-learned documentation?

   • ASuggest that the team spend more time on each engagement to compensate for the scope issues.
   • BImprove the scope-definition process with the client and implement a tool-update policy to ensure the scanner is current before each engagement.
   • CRecommend that the team rely more on manual testing and reduce the use of vulnerability scanners.
   • DDocument that the scope issue was the client's fault and no process change is needed.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is essential to include in the technical documentation of a vulnerability for a penetration testing report?

   • AOnly the CVSS score and the CVE identifier
   • BThe name of the tester who found the vulnerability
   • CEvidence, impact, and remediation steps
   • DThe client's internal project code name
   Reveal Solution Discussion Select an answer first