CSC Report Writing & Documentation 3 — Questions and Answers
Question 1: Which of the following BEST describes the 'remediation' section of a security vulnerability finding?
- A legal disclaimer limiting the consultant's liability
- Actionable steps the client can take to fix or mitigate the identified weakness (Correct answer)
- A summary of all tools used during testing
- A timeline of when the vulnerability was first discovered historically
Correct answer: Actionable steps the client can take to fix or mitigate the identified weakness
The remediation section provides practical guidance so the client can resolve the identified issue.
Question 2: When classifying information sensitivity in security documentation, which classification level typically requires the MOST restrictive handling controls?
- Public
- Internal Use Only
- Confidential
- Top Secret / Restricted (Correct answer)
Correct answer: Top Secret / Restricted
Top Secret or Restricted classification demands the strictest access controls, encryption, and handling procedures.
Question 3: A penetration test report lists a finding with 'High' likelihood but 'Low' impact. How should this finding be prioritized relative to one with 'Low' likelihood but 'Critical' impact?
- The High likelihood finding always takes priority
- Priority depends on the risk matrix; Critical impact may outweigh High likelihood (Correct answer)
- Both should be treated identically
- Low impact findings are never included in reports
Correct answer: Priority depends on the risk matrix; Critical impact may outweigh High likelihood
Risk ratings are derived from both likelihood and impact; a critical impact finding may rank higher despite lower likelihood.
Question 4: What is the MAIN reason security consultants use standardized templates for report writing?
- To reduce the time required to complete assessments
- To ensure consistency, completeness, and professional quality across all deliverables (Correct answer)
- To avoid having to customize reports for individual clients
- To comply with international export control regulations
Correct answer: To ensure consistency, completeness, and professional quality across all deliverables
Standardized templates enforce consistent structure and reduce the risk of omitting critical sections.
Question 5: Which element should a security consultant include when documenting proof-of-concept (PoC) exploit evidence in a report?
- Full working exploit code available to all readers without restriction
- Redacted or sanitized evidence sufficient to validate the finding without enabling weaponization (Correct answer)
- No evidence at all, to protect client confidentiality
- Only a verbal description in the executive summary
Correct answer: Redacted or sanitized evidence sufficient to validate the finding without enabling weaponization
PoC evidence should validate the finding's existence without providing a ready-to-use attack tool.
Question 6: When a security report must be transmitted electronically to a client, which control is MOST important to apply to the document?
- Printing the report and mailing a physical copy instead
- Encrypting the document and using a secure transmission channel (Correct answer)
- Sending via standard email without attachments
- Publishing the report on a public web server for client access
Correct answer: Encrypting the document and using a secure transmission channel
Sensitive assessment reports must be encrypted at rest and in transit to prevent unauthorized disclosure.
Question 7: A client asks a security consultant to remove a critical finding from the final report before it is shared with the board. What is the APPROPRIATE response?
- Remove the finding to maintain the client relationship
- Explain that omitting validated findings undermines the report's integrity and the client's security posture (Correct answer)
- Downgrade the finding's severity instead of removing it
- Issue two separate reports: one complete and one redacted
Correct answer: Explain that omitting validated findings undermines the report's integrity and the client's security posture
Omitting confirmed findings violates professional ethics and may expose both the consultant and client to greater risk.
CSC Report Writing & Documentation 3
Which of the following BEST describes the 'remediation' section of a security vulnerability finding?