Q: 9
[Reporting and Communication]
Which of the following elements of a penetration test report can be used to most effectively
prioritize the remediation efforts for all the findings?
Options
Discussion
C. risk score is always used for prioritization. Detailed findings list doesn't actually rank the issues.
Option C solid question clarity here. Risk score lets you tackle what matters first.
Option C since risk score is literally meant for prioritizing which findings to fix first. A detailed list (B) just tells you what exists, not how urgent each one is. At least that's how I remember it from the study guides, but open to other interpretations if anyone disagrees.
Maybe B, not C. I remember seeing practice questions trying to trip you up with the detailed findings list, since it shows all the discovered issues in one spot. Let me know if anyone thinks that’s off.
Isn't B just a list without priority? Wouldn't the risk score be more actionable for remediation?
Probably C. The risk score is what lets you quickly figure out which findings need action first.
Why does CompTIA keep asking these risk score questions, it's always C.
Its C, had something like this in a mock, risk score lets you prioritize easily.
D . If the execs need to actually action stuff, sometimes the executive summary has tailored priorities that override raw risk scores.
C imo, risk score is designed for prioritization, B just lists findings but doesn't order by criticality.
Be respectful. No spam.
