Exam PT1-002 topic 1 question 68 discussion

In Comptia certmaster states: Conclusion: This section wraps up the report. It should include a general summary statement about failures and successes, with supporting evidence that can be written in a sentence or two. It should also include a statement of the PenTest goals and whether those goals were met. You can get more specific about potential attacks and what assets such an attack could leverage. Identify the areas that are most likely to be compromised and recommend that those be dealt with as soon as possible.

I will go with A & F https://cobalt.io/blog/how-to-write-an-effective-pentest-report-vulnerability-reports

Including the vulnerability identifier is crucial for clear identification and reference of the specific vulnerabilities discovered during the penetration test. This helps the client and other stakeholders easily understand and track the identified issues. Including the CVSS (Common Vulnerability Scoring System) score of the findings provides an objective measure of the severity and potential impact of the vulnerabilities. This scoring system allows the client to prioritize and address the identified vulnerabilities based on their severity levels.

I think

A. The CVSS score of the finding and C. The vulnerability identifier. The CVSS score is important for providing an indication of the severity of the vulnerability and its potential impact. The vulnerability identifier is important for providing a way to cross reference the finding with other sources of information and for tracking the progress of remediation efforts.

I agree with @Setsunarcangel..... why would it matter what tools were used to find the vulnerabilities guys? Companies don't care if you used nmap or angry ip-scanner...? All they care is what is the vulnerability, where is it, how do we fix it, etc. D, E, F ARE OUT right off the bat. A, B, C, are left. A, the CVSS score, is not helpful with only the score, the CVE will be helpful, and will include CVSS score, but CVSS score alone will not help them to remediate, they need to IDENTIFY the vulnerability WHAT and WHERE.

I think it should be B and F

I would go with A and F on this one.