Penetration test report and remediation

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which item belongs in a penetration test report finding?

A The risk rating, the evidence and a recommended fix

B Only the tester's opinion with no proof

2. How should a penetration test report be handled?

A Published online so everyone can learn from it

B Kept confidential between the tester and the client

3. What is the purpose of a risk rating on a finding?

A To show which problems to fix first

B To show how long the test took

4. Which is the best example of evidence in a report?

A A note saying the login page looks unsafe

B A screenshot showing the tester logged in using a default password

5. After the client has applied the recommended fixes, what should happen next?

A Retest to confirm the problems are actually fixed

B Assume the fixes worked and close the report

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Finding: SQL injection on login form \| Risk: High		ARecommendation: use parameterised queries and validate all input
2Evidence: screenshot of admin page opened with ' OR 1=1 --		BA report entry that names the weakness found and gives it a risk rating so the client knows what to fix first
3Each finding includes a recommended fix so the client can remediate the problem		CThe finding has no risk rating or recommended fix, so the client cannot prioritise or remediate it
4After the client applies fixes, the tester retests to confirm the weakness is closed		DA penetration test report must be kept confidential because it describes weaknesses attackers could exploit
5Finding: Weak admin password found. Risk: (none given). Fix: (none given)		EProof recorded in the report showing the weakness was really exploited, so the client can see and reproduce it
6Report emailed to all staff and posted on the public company website		FRetest 2 weeks later: login form injection no longer works. Status: Fixed

Definitions

penetration test report

Fill in the Blanks

Complete each line of code by filling in the missing parts.

finding: SQL injection in login form ____: High

risk: Critical ________: screenshot of admin page access

evidence: screenshot of leaked user table ___: use parameterised queries

fix: update the web server software ______: Pass

report: Pen Test Q1 confidential: ____

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A finding = "Weak password"

B risk = "High"

C evidence = "Login screenshot"

D report.confidential = False

Question 2

A finding = "Open port 23"

B risk = "High"

C evidence = "Looks risky to me"

D fix = "Close port 23"

Question 3

A finding = "SQL injection"

B risk = "Low"

C evidence = "Dumped user data"

D fix = "Use prepared queries"

Question 4

A skip the recommended fix

B retest the system

C if issue is gone:

D mark finding closed

Question 5

A for finding in fixed_list:

B skip(finding)

C if result == "pass":

D close(finding)

Answer Key

Penetration test report and remediation

Section A: Quick Questions

A — The risk rating, the evidence and a recommended fix

B — Kept confidential between the tester and the client

A — To show which problems to fix first

B — A screenshot showing the tester logged in using a default password

A — Retest to confirm the problems are actually fixed

Section B: Match the Pairs

Finding: SQL injection on login form | Risk: High → A report entry that names the weakness found and gives it a risk rating so the client knows what to fix first

Evidence: screenshot of admin page opened with ' OR 1=1 -- → Proof recorded in the report showing the weakness was really exploited, so the client can see and reproduce it

Each finding includes a recommended fix so the client can remediate the problem → Recommendation: use parameterised queries and validate all input

After the client applies fixes, the tester retests to confirm the weakness is closed → Retest 2 weeks later: login form injection no longer works. Status: Fixed

Finding: Weak admin password found. Risk: (none given). Fix: (none given) → The finding has no risk rating or recommended fix, so the client cannot prioritise or remediate it

Report emailed to all staff and posted on the public company website → A penetration test report must be kept confidential because it describes weaknesses attackers could exploit

Section C: Definitions

penetration test report — A confidential document listing each finding with its risk rating, evidence and recommended fix, so the client can remediate the problems and then retest to confirm they are fixed.

Section D: Fill in the Blanks

finding: SQL injection in login form
risk: High

risk: Critical
evidence: screenshot of admin page access

evidence: screenshot of leaked user table
fix: use parameterised queries

fix: update the web server software
retest: Pass

report: Pen Test Q1
confidential: true

Section E: Spot the Error

D — A penetration test report lists weaknesses an attacker could exploit, so it must be kept confidential. It should be report.confidential = True.

C — Evidence must be proof the client can check, such as a scan log or screenshot. An opinion is not evidence. It should be something like "Port 23 scan log".

B — The evidence shows user data was dumped, so the impact is severe and the risk rating should be "High". A wrong rating means the client fixes the wrong things first.

A — Remediation means applying the recommended fix before retesting. Skipping the fix would leave the vulnerability open. The line should be apply the recommended fix.

B — Every fixed finding must be retested to confirm the fix worked. Skipping it means the problem could still exist. It should be retest(finding).