Assemble a report and write the summary an executive acts on

applied · 90 min · Objective 1.4

Task

Assemble a full report from a set of findings — executive summary, findings body, consistent severities, and a safe appendix — and make the executive summary answer the four questions a non-technical decision-maker actually has. Objective 1.4 is penetration test reports, and the report is the product.

Steps

  1. Write /tmp/report.md with four findings of varying severity, each in the evidence/impact/reproduction/remediation shape from the short lab.
  2. Write the executive summary to answer four questions: what were we asked to do (restate scope), what did you find in business terms, how bad relative to the client's own risk, and what to do first.
  3. Make severities consistent: two similar findings must not carry different severities without a stated reason, because that is the first thing a sceptic notices.
  4. Build the appendix and then sanitise it: no unredacted credentials, no personal data beyond the minimum, no full extracts. State that raw data was delivered separately and encrypted.
  5. Add a coverage statement: what was tested, what was unreachable, what was out of scope — so a clean area is not read as a guarantee.

Verify

grep -cE "^##\s+(Executive summary|Findings|Appendix|Coverage)" /tmp/report.md
grep -cE "^###\s+Finding" /tmp/report.md
grep -ciE "we were asked|scope|do first|priority" /tmp/report.md
grep -ciE "delivered separately|encrypted|redact" /tmp/report.md

The first count must be at least 4 — the report's required sections. The second must be at least 4 — one heading per finding. The third must be non-zero: an executive summary that never restates the scope or names a first action is a summary of counts, not consequences. The fourth must be non-zero: an appendix that does not say the raw data went separately is probably carrying it.

Notes

The two failure modes to avoid are the summary that is only counts — which tells the reader nothing about consequence — and the summary that is so hedged it reads as "we're fine", which converts your work into false assurance. The report itself is sensitive: it is a map of how to compromise the client, so it is encrypted, its recipients are agreed, and your copy is destroyed on schedule.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.