← WA Computer Science ATAR Unit 2

Penetration test report and remediation

A confidential document listing each finding with its risk rating, evidence and recommended fix, so the client can remediate the problems and then retest to confirm they are fixed.

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 146

Understanding Penetration test report and remediation in WA Computer Science ATAR Unit 2

What it does: The recommended fix tells the client what action to take to remediate the finding. Retesting after fixes checks that remediation worked, and the report is updated with the new status. The report describes real weaknesses in the client's systems. If attackers read it, it becomes a guide for breaking in, so it stays confidential. A risk rating (such as high, medium or low) is based on likelihood and impact. It helps the client prioritise remediation. Evidence proves the finding is real. Screenshots, logs or captured output show exactly what the tester did and found. A good recommendation is specific and actionable. A vague statement does not tell the client what to change.

Common mistakes: A penetration test report lists weaknesses an attacker could exploit, so it must be kept confidential. It should be report.confidential = True. Evidence must be proof the client can check, such as a scan log or screenshot. An opinion is not evidence. It should be something like "Port 23 scan log".

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Penetration test report and remediation to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which item belongs in a penetration test report finding?
The risk rating, the evidence and a recommended fixOnly the tester's opinion with no proof
Matches
Finding: Weak admin password found. Risk: (none given). Fix: (none given)
↓
The finding has no risk rating or recommended fix, so the client cannot prioritise or remediate it
Applying
Meanings
Term
penetration test report
Meaning
A confidential document listing each finding with its risk rating, evidence and recommended fix, so the client can remediate the problems and then retest to confirm they are fixed.
Practice
REPORT: Confidential - client only
Testing
Gaps
: High
Check Answer
Spots
3evidence = "Login screenshot"
4report.confidential = False

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Blue-Ringed Octopus' badge — Reef Legend, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which item belongs in a penetration test report finding?
A. The risk rating, the evidence and a recommended fix ✓
B. Only the tester's opinion with no proof
Each finding needs a risk rating, evidence that it exists and a recommended fix so the client can act on it.
2. How should a penetration test report be handled?
A. Published online so everyone can learn from it
B. Kept confidential between the tester and the client ✓
The report describes real weaknesses in the client's systems. If attackers read it, it becomes a guide for breaking in, so it stays confidential.
3. What is the purpose of a risk rating on a finding?
A. To show which problems to fix first ✓
B. To show how long the test took
A risk rating (such as high, medium or low) is based on likelihood and impact. It helps the client prioritise remediation.
4. Which is the best example of evidence in a report?
A. A note saying the login page looks unsafe
B. A screenshot showing the tester logged in using a default password ✓
Evidence proves the finding is real. Screenshots, logs or captured output show exactly what the tester did and found.
5. After the client has applied the recommended fixes, what should happen next?
A. Retest to confirm the problems are actually fixed ✓
B. Assume the fixes worked and close the report
Retesting checks that each fix works and that it has not created a new weakness. Never assume a fix worked.

Match the Pairs

Finding: SQL injection on login form | Risk: High → A report entry that names the weakness found and gives it a risk rating so the client knows what to fix first
Evidence: screenshot of admin page opened with ' OR 1=1 -- → Proof recorded in the report showing the weakness was really exploited, so the client can see and reproduce it
Each finding includes a recommended fix so the client can remediate the problem → Recommendation: use parameterised queries and validate all input
After the client applies fixes, the tester retests to confirm the weakness is closed → Retest 2 weeks later: login form injection no longer works. Status: Fixed
Finding: Weak admin password found. Risk: (none given). Fix: (none given) → The finding has no risk rating or recommended fix, so the client cannot prioritise or remediate it
Report emailed to all staff and posted on the public company website → A penetration test report must be kept confidential because it describes weaknesses attackers could exploit

Key Term

penetration test report
A confidential document listing each finding with its risk rating, evidence and recommended fix, so the client can remediate the problems and then retest to confirm they are fixed.

Fill in the Blanks

1. finding: SQL injection in login form risk: High
Hint: Type the field name that records how serious the finding is rated.
2. risk: Critical evidence: screenshot of admin page access
Hint: Type the field name that holds the proof the tester collected.
3. evidence: screenshot of leaked user table fix: use parameterised queries
Hint: Type the field name for the action the client should take to solve the problem.
4. fix: update the web server software retest: Pass
Hint: Type the field name for the check done after the fix to confirm the problem is gone.
5. report: Pen Test Q1 confidential: true
Hint: Type the Boolean value showing the report must be kept private.

Spot the Error

Question 1
A finding = "Weak password"
B risk = "High"
C evidence = "Login screenshot"
D report.confidential = False
Line D — A penetration test report lists weaknesses an attacker could exploit, so it must be kept confidential. It should be report.confidential = True.
Question 2
A finding = "Open port 23"
B risk = "High"
C evidence = "Looks risky to me"
D fix = "Close port 23"
Line C — Evidence must be proof the client can check, such as a scan log or screenshot. An opinion is not evidence. It should be something like "Port 23 scan log".
Question 3
A finding = "SQL injection"
B risk = "Low"
C evidence = "Dumped user data"
D fix = "Use prepared queries"
Line B — The evidence shows user data was dumped, so the impact is severe and the risk rating should be "High". A wrong rating means the client fixes the wrong things first.
Question 4
A skip the recommended fix
B retest the system
C if issue is gone:
D mark finding closed
Line A — Remediation means applying the recommended fix before retesting. Skipping the fix would leave the vulnerability open. The line should be apply the recommended fix.
Question 5
A for finding in fixed_list:
B skip(finding)
C if result == "pass":
D close(finding)
Line B — Every fixed finding must be retested to confirm the fix worked. Skipping it means the problem could still exist. It should be retest(finding).

Student with a class code? Join your class →