Report Writing and Post-Testing Actions CPENT Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   During the client debriefing, the CEO asks for a one-sentence summary of the test results, while the security team wants to dive into the technical details. The meeting is scheduled for 30 minutes. How should you structure the debriefing to satisfy both audiences?

   • AStart with a one-sentence executive summary, then present the top findings with business impact, and reserve the last portion for technical Q&A.
   • BPresent the full technical report slide by slide, and let the CEO read the executive summary on their own.
   • CAsk the CEO to leave the meeting and schedule a separate executive briefing.
   • DSpend the entire meeting on technical details and provide the executive summary in a follow-up email.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary purpose of the executive summary in a penetration testing report?

   • ATo list all the tools and commands used during testing
   • BTo communicate the overall risk posture and key findings to non-technical stakeholders
   • CTo provide step-by-step technical details of each vulnerability
   • DTo document the legal authorization and scope of the test
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   You are writing the executive summary for a penetration test report. The client's C-suite needs to understand the overall risk posture without technical jargon. The test found a critical remote code execution vulnerability in an internet-facing web server, several medium-severity misconfigurations, and no high-severity issues. Which executive summary approach best communicates the risk posture?

   • ADescribe the exact exploitation steps and proof-of-concept code used to compromise the web server.
   • BSummarize that the overall security posture is good because only one critical issue was found.
   • CState that the organization faces a critical risk from an internet-facing system that could allow unauthorized access, and that remediation of this issue is urgent.
   • DList each vulnerability with its CVSS score and exploitability metrics so the C-suite can assess the technical details.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   In a risk rating methodology for penetration testing findings, which two factors are typically combined to determine the overall risk level?

   • AExposure and accessibility
   • BCost and time
   • CLikelihood and impact
   • DSeverity and complexity
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   You are formatting the final penetration test report for a client. The report contains 15 findings, each with evidence screenshots, request/response data, and remediation steps. The client's IT manager will use the report for remediation, and the CISO will review the overall risk. Which formatting approach best supports both audiences?

   • AOrganize findings alphabetically by vulnerability name so the IT manager can easily find specific issues.
   • BPlace all raw request/response data inline within each finding so the IT manager has everything in one place.
   • CUse only text descriptions without tables or visual aids to keep the report simple.
   • DUse a consistent finding template with severity badges, a summary table sorted by risk, and an appendix for raw evidence.
   Reveal Solution Discussion Select an answer first