Report Writing and Post-Testing Actions CPENT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a typical outcome of a lessons-learned review in penetration testing?

   • AA formal apology to the client for any inconvenience
   • BA guarantee that future tests will have no vulnerabilities
   • CUpdated testing checklists and methodologies
   • DA list of client employees who were uncooperative
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to use tables and visual aids in a penetration testing report?

   • AThey help present complex data in a clear and concise manner
   • BThey make the report look more impressive
   • CThey allow the tester to avoid writing detailed explanations
   • DThey are required by the EC-Council for all reports
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a standard penetration testing report, which section typically includes the detailed steps, tools, and techniques used during the engagement?

   • ARisk rating
   • BExecutive summary
   • CMethodology
   • DAppendix
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You are formatting a penetration test report that includes a large number of findings, each with evidence and remediation steps. The client has asked for a report that is easy to navigate and understand. Which formatting approach best supports this requirement?

   • AInclude all evidence as raw logs in an appendix and refer to them only by number.
   • BUse a consistent structure with numbered headings, a table of contents, and a summary table of findings with severity ratings.
   • CPlace all findings in a single continuous narrative without headings to avoid breaking the flow.
   • DUse a different color and font for each finding to make them stand out.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a penetration test, you captured plaintext credentials and sensitive customer data from a vulnerable application. You need to include this evidence in the report. What is the most appropriate way to handle this data?

   • AMask or redact the sensitive data in the report and store the full evidence in an encrypted file accessible only to the client.
   • BOmit the evidence entirely and only describe the vulnerability in general terms.
   • CSend the full evidence to the client's legal team via unencrypted email.
   • DInclude the full plaintext credentials and customer data in the report to provide complete evidence.
   Reveal Solution Discussion Select an answer first