Write one finding four ways and keep the one that survives

short · 50 min · Objective 1.4

Task

Take a single technical result and write it as a proper finding — evidence, impact, reproduction, remediation — then check it has every part a client's engineer needs to verify it and act on it. A finding missing any of the four is the one that gets disputed.

Steps

  1. Invent a concrete lab result: an internal web server exposes a configuration file containing a database password. Write /tmp/finding.md.
  2. Write the evidence: the request and the response, redacted so the password's value is masked but its presence and location are shown.
  3. Write the impact for this client specifically — not "arbitrary file read", but what that file being readable actually allows here.
  4. Write the reproduction: enough for their engineer to see it themselves.
  5. Write the remediation at the level of the cause, not the instance.
  6. Assign a severity: a base score, your adjustment, and the reason for the adjustment written out.
  7. Confirm the finding contains no live credential value anywhere — a password quoted in full is a new exposure you created.

Verify

grep -cE "^##\s+(Evidence|Impact|Reproduction|Remediation|Severity)" /tmp/finding.md
grep -ciE "because|adjust|raised|lowered" /tmp/finding.md
grep -cE "REDACTED|\*{3,}|<masked>" /tmp/finding.md

The first count must be 5 — all four parts plus severity. The second must be non-zero: a severity with no stated reason is an opinion, not a position, and it will not survive a challenge. The third must be non-zero: the evidence must show a masked value, because proving the file is readable does not require shipping the password with the report.

Notes

The impact line is where findings are won or lost. "Allows arbitrary file read" is a class; "any unauthenticated user can read the config file, which holds the database credentials shown below" is a finding. Reproduce before you report — one finding disproved in a meeting puts every other finding in the report in question, and you will not get to defend each one.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.