Reporting, Remediation, and Defensive Countermeasures
This domain tests how you turn testing into decisions: clear findings, honest risk ratings, practical remediation, and retesting. The exam rewards reports that a technical team can reproduce and an executive can act on.
Core rules and concepts
- A finding needs a title, affected asset, evidence, reproduction steps, impact, likelihood, risk rating, and remediation. Separate observations from confirmed vulnerabilities.
- Use CVSS as a base, then adjust for context such as exposure, data sensitivity, segmentation, and compensating controls. Explain the adjustment.
- The executive summary should state the engagement scope, overall risk, key themes, and prioritized actions without raw payloads.
- Remediation should be specific: patch version, configuration change, code fix, or control. Include owner and verification method.
- Retesting confirms fixes and checks for regressions; close findings only with evidence.
Worked example
A scanner reports CVSS 9.8 on an internal Jenkins server. The server is segmented, requires VPN and MFA, and holds no production data. You keep the technical severity but rate business risk lower and explain the compensating controls. You still recommend patching promptly, because a foothold could enable lateral movement. The reasoning: risk communicates business impact, not just technical severity.
Traps
Do not paste scanner output as a report. Avoid inflating severity to get attention or downplaying it to please the client. Do not omit failed tests or scope limitations. Never include real passwords, personal data, or exploit code that creates unnecessary risk.