Penetration Test Report — Vocabulary and Structure
Learn vocabulary for writing penetration test reports: executive summary, findings, risk ratings, and remediation steps.
0 / 10 completed
1 / 10
What is the purpose of the 'executive summary' in a pentest report?
The executive summary is for non-technical leadership: it covers the overall risk posture (e.g., critical vulnerabilities found), business impact, and top recommendations — without technical jargon. It is often the only section read by executives and board members.
2 / 10
What is a 'finding' in a penetration test report?
A finding is a documented security issue with a standard structure: vulnerability title, severity rating (Critical/High/Medium/Low), description of the issue, proof-of-concept evidence, business impact, and step-by-step remediation guidance.
3 / 10
What does 'proof of concept' (PoC) mean in a pentest finding?
A PoC in a pentest finding is concrete evidence of exploitability: screenshots of unauthorized access, database query results, command execution output. It proves the vulnerability is real and exploitable — not just theoretical — and helps clients understand the actual risk.
4 / 10
What is 'CVSS score' and how is it used in a pentest report?
CVSS (Common Vulnerability Scoring System) provides a standardized numerical severity rating (0–10): Critical (9–10), High (7–8.9), Medium (4–6.9), Low (0.1–3.9). Pentest reports use CVSS scores alongside qualitative ratings so clients can prioritize remediation objectively.
5 / 10
What is the 'attack narrative' section in a pentest report?
The attack narrative (or attack chain) tells the story of the successful attack path: how initial access was gained, privilege escalation steps, lateral movement, and ultimate objective achievement. It shows the client the real-world impact of vulnerability combinations that look low-severity individually.
6 / 10
Code Review Comment: 'The script successfully exploited the vulnerability, but the report lacks sufficient detail regarding the specific parameters used to trigger the bypass. It needs a more granular breakdown of the payloads tested.' What does this comment primarily indicate about the penetration test report?
This comment focuses on the *lack of detail* concerning the specific payloads and parameters. The reviewer is requesting a more granular breakdown – essentially wanting to understand how the vulnerability was exploited in order to properly assess and recommend mitigation strategies. Option A misinterprets the concern as solely about audience; Options B, C and D are tangential to the core issue of insufficient reporting.
7 / 10
Slack Message: '@john.doe – Just saw the final report on the web server compromise. The 'Rootkit' finding is flagged as High severity, but I'm not entirely clear on what that means in terms of immediate action. Can you elaborate?' What does @john.doe likely need from the penetration tester?
The Slack message highlights @john.doe's uncertainty about the 'High severity' finding – specifically, what it *means* practically. He needs a technical explanation of the rootkit's functionality and its potential impact to understand the immediate risk and guide remediation efforts. Options B, C and D are all related to broader security practices, not clarifying the specific finding.
8 / 10
PR Description: 'Added a new test case targeting the authentication module. The vulnerability was confirmed using a crafted HTTP request. This is documented in section 3.2 of the penetration report.' What role does this PR description play within the context of the pentest?
The PR description's purpose is to *align* the developer's work (the test case) with the broader findings detailed in the penetration report. It's a confirmation that the issue they're addressing is part of the overall vulnerability landscape. Options A and B are irrelevant; Option D represents a potentially destructive action.
9 / 10
API Response (Partial): `{"status": "success", "vulnerability_id": "CVE-2023-12345", "severity": "Critical", "cvss_score": 9.8, "recommendation": "Implement input validation"}` What does the 'CVSS score' in this response signify?
The CVSS (Common Vulnerabilities and Exposures) score is a standardized metric for quantifying the risk associated with a vulnerability. It's calculated based on factors like attack vector, complexity, privileges required, and user interaction – representing the *potential impact* of the exploit. Options A, B, C and D have completely different meanings.
10 / 10
Standup Update: 'I've been working on documenting the 'SQL Injection' finding from the penetration test. The report outlines multiple attack vectors and suggests implementing parameterized queries.' What is the primary purpose of including information about *attack vectors* in a pentest report?
Including information about 'attack vectors' is crucial for understanding *how* an attacker could exploit the vulnerability. It goes beyond simply stating the vulnerability exists; it details the specific methods and techniques used during the penetration test, allowing developers to address the root cause of the problem effectively. Options A, C and D are misinterpretations of the information's purpose.
What will I practise in "Penetration Test Report — Vocabulary and Structure"?
This module focuses on Pentest Communication — real workplace phrasing you'll use on the job. It contains 10 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 10 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Pentest Communication exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around pentest communication — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Pentest Communication exercises?
See the Pentest Communication hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.