Professional Reporting and Live Debrief
Professional reporting and live debrief
This domain tests whether you can turn technical work into a client-ready deliverable and defend it in a live debrief. The exam expects a clear report structure, accurate risk ratings, reproducible evidence, and remediation guidance that a mixed technical and executive audience can act on.
Core rules and concepts
- Write for two audiences: an executive summary with business impact, and technical findings with reproduction steps.
- Every finding needs a title, severity, affected asset, evidence, impact, and remediation.
- Rate risk consistently; explain the rationale when CVSS and business context disagree.
- Keep evidence clean: redact passwords and sensitive data, but retain enough proof.
- In the debrief, walk the client through the attack path, not a tool-by-tool log.
- Be honest about limitations, failed attempts, and scope exclusions.
Worked example
Finding: 'Domain Admin compromise via Kerberoasting.' Severity: Critical. Evidence: the SPN account, the cracked password hash (redacted), the BloodHound path, and the DCSync output showing krbtgt. Impact: an attacker could forge Kerberos tickets and persist across the domain. Remediation: rotate the service account, use managed service accounts, enforce 25+ character passwords, monitor Kerberoasting, and tier admin accounts. In the debrief, you show the three-step path-foothold, Kerberoast, DCSync-and the control that would have broken it at each step.
Traps that cost marks
- Writing generic findings with no asset or evidence.
- Inflating severity without business impact.
- Hiding failed attempts or scope gaps.
- Reading the report aloud instead of telling the attack story.