Reporting, Remediation, and Professional Ethics
The final domain tests the professional half of the job: whether your findings are reproducible, correctly rated, actionable, and produced within authorization. A technically correct finding delivered badly, or delivered outside scope, is a failure on this exam.
Report structure
- Executive summary for non-technical readers: business risk, overall posture, count by severity.
- Scope and methodology: assets, dates, accounts used, testing windows, references to OWASP WSTG or ASVS identifiers.
- Findings, each self-contained: title, identifier, severity with the CVSS vector string, affected asset and parameter, description of the flaw, numbered reproduction steps, request/response evidence (redacted for PII and credentials), business impact, root cause, and remediation with a specific configuration or code change.
- Appendices: tool output, out-of-scope observations, retest results.
Rating and remediation
Use CVSS v3.1 base metrics consistently and state the vector so the score can be audited. Contextualize with the client's threat model: internet-facing versus internal, data sensitivity, compensating controls. Remediation must address root cause - parameterized queries, output encoding, server-side authorization checks, Argon2id hashing - not "deploy a WAF" or "add input validation". Always offer a retest criterion so the fix is verifiable.
Ethics and law
Work only under written authorization that defines scope, time windows, prohibited techniques (denial of service, social engineering, data exfiltration), and escalation contacts. Stop and report immediately if you encounter third-party data or evidence of an active breach. Handle evidence per the client's data classification, encrypt it at rest, and delete it on an agreed schedule. Follow coordinated disclosure timelines (commonly 90 days) and never publish before the client agrees. Legal exposure includes the US CFAA, the UK Computer Misuse Act, and GDPR obligations for personal data you touch. Never claim certification-body endorsement or invent credentials.
Worked example
An unauthenticated endpoint returns other customers' order records when the order_id is incremented. Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N → 7.5 High. Reasoning: network-exploitable, no privileges, no user interaction, confidentiality-only impact on a large dataset - High, not Critical, because integrity and availability are untouched. Reproduction steps list two adjacent IDs and both responses with names redacted. Remediation is an ownership check against the session subject on every read.
Traps that cost marks
- Inflating severity to please the client, or deflating it to avoid a difficult conversation.
- Quoting a CVSS score without the vector, making it unauditable.
- Recommending a WAF as the primary fix for an injection flaw.
- Continuing testing after detecting an active compromise or out-of-scope data.