Write remediation at the cause, sequenced and affordable

short · 50 min · Objective 5.2

Task

Take a set of findings from your own lab engagement and write remediation that fixes the cause rather than the instance, sequenced by what to do first, and priced by disruption — because a recommendation a client cannot afford is one they will not act on, and remediation is scored on whether anything moves.

Steps

  1. Take three or four findings from your own lab work into /tmp/remediation.md.
  2. For each, write remediation at the cause, not the instance — parameterised queries across the codebase, not an escape on one field; unique per-machine passwords, not a reset of the one you cracked.
  3. Sequence them: what to do this week versus this quarter, and why that order.
  4. Note cost and disruption for each, and where a compensating control is the right interim step because the real fix is not immediately available.
  5. Write a re-test criterion for each: what you would check to confirm it is actually fixed.
  6. Confirm each recommendation is something the client could realistically do.

Verify

grep -cE "^finding:" /tmp/remediation.md
grep -cE "^(cause|sequence|retest):" /tmp/remediation.md
grep -ciE "this week|this quarter|compensating|interim|disruption" /tmp/remediation.md

The first count must be non-zero: you wrote remediation for several findings. The second must be non-zero: each carries the cause-level fix, a sequence, and a re-test criterion. The third must be non-zero: you sequenced by urgency and noted cost, disruption or a compensating control — which is what makes a recommendation one a client acts on rather than files.

Notes

Fix the cause, not the instance you found — the instance is one symptom of a pattern. Sequence by what matters first, and price by disruption, because a recommendation a client cannot afford is one they will not act on. A compensating control is the right answer when the real fix is not yet available, and a re-test criterion agreed in writing is what closes the loop. All findings came from your own lab work.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.