Pentesting and Advisory: Risk Translation, Remediation, and Client Communication
What this domain tests
The Pentesting and Advisory domain tests the second half of the job: turning validated technical findings into risk-ranked, actionable advice for mixed audiences. It rewards judgment about business impact, exploitability, compensating controls, and clear remediation-not just a list of scanner output.
Core rules and concepts
- Report architecture matters. A professional report typically includes an executive summary, scope and objectives, methodology, timeline, findings, risk ratings, remediation guidance, and appendices. The executive summary states overall risk posture and the few decisions leadership must make; technical detail belongs in findings and appendices.
- Risk is contextual. CVSS base score is a common language, not a final verdict. Adjust for exposure (internet-facing versus internal), required privileges, user interaction, data sensitivity, business criticality, threat activity, and compensating controls. State the CVSS vector, then justify any contextual uplift or downgrade.
- Findings must be falsifiable. Include affected asset, condition, evidence, reproduction steps, business impact, root cause, recommendation, and references such as CWE or OWASP categories. Separate symptoms from root cause.
- Remediation should be operational. Distinguish immediate containment from structural fix. Give a specific configuration or code change, an owner, a validation method, and residual risk. “Patch it” is not remediation guidance.
- Advisory tone is evidence-bound. Avoid blame, sensationalism, and claims beyond what you proved. State assumptions and limitations, protect client data, and explain uncertainty.
- Tailor communication. Executives need impact and priority; engineers need reproduction and fix detail. Use a short prioritized action list rather than a wall of CVE identifiers.
Worked example
An internal scan shows SMB signing is not required on a file server. A base CVSS score may look moderate, but if any workstation can relay authentication to that server and privileged accounts authenticate to it, an attacker could relay NTLM and escalate within the domain. Reasoning: the contextual impact is much higher than the base score suggests because the server participates in privileged authentication flows. Recommend requiring SMB signing by policy, disabling obsolete SMB/NTLM settings, segmenting the server, and monitoring relay indicators. Validate by checking the effective policy and repeating the SMB signing check. Report the affected asset group, precondition, evidence, domain impact, and residual risk.
Traps that cost marks
- Rating every high-CVSS item “Critical” without exposure or business context.
- Recommending “patch” or “harden” with no version, setting, owner, or validation.
- Claiming a data breach when you only read one proof file.
- Omitting limitations and assumptions, then overstating coverage.
- Writing an executive summary full of CVE IDs and exploit details.
- Confusing a root cause with its visible symptom.