Report Writing and Post-Testing Actions CPENT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of a lessons-learned review after a penetration testing engagement?

   • ATo assign blame for any mistakes made during the test
   • BTo provide a final summary to the client
   • CTo identify areas for improvement in future testing processes
   • DTo create a list of all the tools used for billing purposes
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   You are assembling a penetration test report for a client. The report must include an executive summary, methodology, findings, and recommendations. The client also requested a separate section that lists all systems tested and the testing dates. Where should this information be placed in the report structure?

   • AIn the findings section, as an appendix to each vulnerability.
   • BIn the executive summary, so stakeholders immediately see what was covered.
   • CIn the methodology section, as part of the scope description that details what was tested and when.
   • DIn the recommendations section, so the client knows what to re-test.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a recommended practice for formatting a professional penetration testing report?

   • AAvoiding any visual elements to keep the report simple
   • BUsing clear headings, tables, and visual aids to enhance readability
   • CIncluding as many technical details as possible in every section
   • DUsing a single block of text to avoid breaking the flow
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During the client debriefing for a penetration test, the IT manager asks why a medium-severity finding was not fixed before the report was delivered, and the CISO asks for the top three actions to take next week. How should you handle the debriefing?

   • AFocus only on the critical findings and skip the medium-severity explanation to save time.
   • BProvide a list of all findings and ask the IT manager to prioritize them internally.
   • CApologize for not fixing the finding and promise to include it in the next test.
   • DExplain the finding's risk rating, then present the top three prioritized remediation actions with clear owners and timelines.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You are writing a penetration test report for a client that wants to use it to brief their security team and also share a version with their executives. Which report structure best serves both audiences?

   • ACreate two separate reports: one for executives and one for the security team, with no overlap.
   • BWrite only a technical report with no executive summary, since the security team is the primary audience.
   • CInclude an executive summary at the beginning, followed by a detailed technical findings section.
   • DPut all findings in the appendix and keep the main body as a summary of the testing process.
   Reveal Solution Discussion Select an answer first