Practice penetration test report vocabulary: executive summary language, finding severity levels, CVSS score explanation, proof of concept sections, and remediation recommendation language.
0 / 10 completed
1 / 10
A pentest report opens with an 'Executive Summary.' What is the purpose of this section?
The executive summary is written for the CISO, CFO, or board — not the engineering team. It should answer: what did the testers find? How serious is it? What is the business risk? What should we do first? Technical details belong in the findings section. A good executive summary uses phrases like 'an attacker could gain unauthorised access to customer data' rather than 'SQL injection in the /api/users endpoint allows UNION-based data extraction.'
2 / 10
A pentest report categorises findings as Critical, High, Medium, Low, and Informational. What typically distinguishes a 'Critical' finding from a 'High' finding?
Severity classification reflects both likelihood (exploitability) and impact. Critical: immediately exploitable, high impact, no authentication required, network-accessible — e.g., unauthenticated RCE, SQL injection that dumps the entire user table. High: serious impact but with prerequisites — e.g., requires valid credentials, or is only exploitable from inside the network. The distinction drives remediation priority and urgency.
3 / 10
What does the 'Proof of Concept' (PoC) section of a pentest finding contain?
The PoC section proves the vulnerability is real and exploitable — not theoretical. It typically includes: the HTTP request with the malicious payload, the server response showing the data leak or error, a screenshot of the attacker's view, and numbered reproduction steps. The PoC allows the client's security team to validate the finding independently and helps developers understand the exact attack vector when fixing it.
4 / 10
A pentest report includes a 'Remediation Recommendation' for each finding. What language is typically used in this section?
Remediation recommendations should be specific and actionable, not vague. 'Improve input validation' is poor. 'Replace string concatenation in the user search query with parameterised queries using PDO or prepared statements' is good. Good remediation language: names the exact fix, references the relevant standard or framework (OWASP, NIST), suggests verification steps, and sometimes includes a code example. The goal is for the developer to implement it without needing to consult the pentester.
5 / 10
What does 'Informational' severity mean in a pentest report?
Informational findings are the pentest equivalent of 'you should know about this, but it is not currently a vulnerability.' Examples: HTTP response headers revealing server version (information disclosure), a self-signed TLS certificate (no active vulnerability but best practice violation), or commented-out debug code. They improve security posture when addressed but do not require emergency remediation. Including them shows thoroughness.
6 / 10
Alex from the security team sent this Slack message to the development team after reviewing a newly submitted PR: 'The script uses an outdated regex library with known vulnerabilities. We've flagged this as a High severity issue requiring immediate attention.' What does 'High severity' most likely indicate in this context?
'High severity' in pentesting indicates a critical level of risk. It signifies that the vulnerability is likely exploitable, could lead to substantial damage (data breach, system compromise), and demands immediate remediation. The term isn't just about inconvenience; it reflects the potential impact on the application and its users. Options B and D misinterpret the urgency implied by 'High'.
7 / 10
You're drafting a PR description for a fix to a SQL injection vulnerability discovered during a penetration test. The report identifies the vulnerable parameter as 'user_input'. What is the MOST appropriate way to phrase this finding within the PR?
Clearly stating the vulnerability and the remediation is crucial. Using 'parameterized queries' directly acknowledges the technical solution applied to address the SQL injection risk. Option A is too vague; option C focuses on logging which isn't the core fix. Option D is unrelated to the security issue.
8 / 10
During a standup meeting, Ben, a developer, is asked about the pentest report. He says, 'We've identified a Cross-Site Scripting (XSS) vulnerability in our user profile page. The report recommends using output encoding.' What does 'output encoding' refer to in this scenario?
Output encoding is a critical defense against XSS. It involves converting potentially harmful characters (like script tags) in user input into their safe HTML entities before displaying them on the page. This prevents malicious code from being executed by the browser. Options A, B and D describe completely different security measures.
9 / 10
A pentest report details a finding: 'The application is vulnerable to Server-Side Request Forgery (SSRF). The remediation recommendation includes implementing input validation.' What does 'input validation' specifically aim to achieve in this context?
SSRF vulnerabilities allow an attacker to make the server send requests on their behalf. 'Input validation' in this case means carefully checking and filtering all user-supplied data that could be used as part of a request URL or HTTP header. This stops the server from blindly following malicious instructions. Options A, B and D are not directly related to mitigating the SSRF risk.
10 / 10
The pentest report notes a finding: 'A lack of proper authorization controls allows unauthorized access to sensitive data.' What does this statement primarily highlight about the security posture?
This statement directly points to a critical authorization flaw. Lack of proper controls means that anyone can potentially reach sensitive data, regardless of their intended role or permissions. This represents a significant security vulnerability and requires immediate attention. Options A, B and D misrepresent the nature of the issue.
What will I practise in "Pentest Report Vocabulary"?
This module focuses on Pentest Communication — real workplace phrasing you'll use on the job. It contains 10 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 10 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Pentest Communication exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around pentest communication — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Pentest Communication exercises?
See the Pentest Communication hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.