Report Writing and Post-Testing Actions CPENT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which section of a penetration testing report is primarily intended to provide a high-level overview of the engagement's purpose, scope, and overall risk posture for senior management?

   • ARecommendations
   • BMethodology
   • CExecutive summary
   • DFindings
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the main purpose of including evidence (e.g., screenshots, logs) in the technical findings section of a penetration testing report?

   • ATo prove that the vulnerability exists and was successfully exploited
   • BTo show the tester's skill level
   • CTo make the report longer and more detailed
   • DTo provide a visual break in the text for readability
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   When writing an executive summary for a penetration testing report, which of the following is most appropriate to include?

   • AThe exact commands used to exploit each vulnerability
   • BA detailed list of all discovered vulnerabilities with CVSS scores
   • CA full network diagram with all IP addresses and subnets
   • DA concise statement of the overall risk level and the most critical findings
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   You are documenting a critical vulnerability found during a penetration test: an unauthenticated attacker can upload arbitrary files to a web application, leading to remote code execution. For the technical findings section, which set of details is most appropriate to include?

   • AThe CVSS score and a link to the OWASP page for file upload vulnerabilities.
   • BOnly the vulnerability name and a screenshot of the upload form.
   • CThe business impact and a recommendation to purchase a web application firewall.
   • DThe vulnerable endpoint, a step-by-step reproduction with request/response evidence, the impact, and a recommended fix.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   You are prioritizing findings for a penetration test report. The client's risk appetite is low, and they are particularly concerned about regulatory compliance. You found a medium-severity vulnerability that directly violates a compliance requirement, and a high-severity vulnerability that does not affect compliance. How should you prioritize these findings in the report?

   • APrioritize the high-severity vulnerability first, because severity is the only factor that matters.
   • BPrioritize the high-severity vulnerability first, but add a note that the compliance issue should be fixed within the next quarter.
   • CPrioritize the compliance-related medium finding first, because regulatory impact can outweigh the raw severity score.
   • DList both as equal priority because they are both vulnerabilities.
   Reveal Solution Discussion Select an answer first