Soft Skills and Assessment Management
Assessment work is as much about scoping, communication and reporting as it is about tooling. A candidate must understand the phases of an engagement: scoping and rules of engagement, reconnaissance, testing, reporting, and retest/closure. Know the difference between a vulnerability assessment (breadth, identification) and a penetration test (depth, exploitation, chained impact). Understand authorization: written scope, defined targets, testing windows, and escalation contacts. Legal and ethical boundaries (staying in scope, data handling, confidentiality) are frequently tested.
Risk communication matters. Findings should be rated using a consistent method (e.g., likelihood x impact, or CVSS as an input) and written for two audiences: technical remediation detail and management summary. Traps in questions include confusing "risk" with "severity", treating a raw CVSS score as the whole story, and forgetting business context. Another common trap is the reporting lifecycle: findings must be validated, evidence retained, and retests tracked.
Rule of thumb: if a question asks what to do when you discover something out of scope (e.g., a shared hosting neighbour), the answer is stop, do not exploit, document, and notify the client contact - never "keep going because you found it".
Worked example: A critical finding is found late in the window. You have no time to fully exploit it. Correct action: report it as a validated finding with evidence of the vulnerability and its potential impact, note the limitation, and recommend a follow-up test - you do not inflate it to "exploited" without proof.