312-50 Question 126
Single answer▪ Vulnerability Assessment ReportsA security consultant completes a vulnerability assessment for a midsize company and must present the final report to both the IT operations team and executive management. The raw scanner output includes several hundred findings, including informational items, medium-risk issues, and a critical remote code execution vulnerability on an Internet-facing application server that has a known public exploit. The client previously complained that past reports were too technical for management and did not clearly indicate what to fix first. Which reporting approach would BEST address the client's needs while following good vulnerability assessment reporting practices?
- A
Provide the full scanner export only, because unfiltered technical data is the most complete and avoids analyst bias
- B
Create a report that groups findings by scan plugin category and lists them alphabetically so both executives and administrators can review the same document
- C
Produce an executive summary highlighting business risk and remediation priorities, along with a separate technical section that validates the critical findings, explains affected assets, likelihood, impact, and recommended fixes
- D
Exclude informational and medium findings from the report so the client focuses only on the single critical vulnerability
Show answer and explanation
Correct answer: C
Explanation
The best answer is to produce a layered report tailored to the audience: an executive summary for leadership and a detailed technical section for remediation teams. In practice, vulnerability assessment reports should do more than list findings. They should validate significant results, identify false positives when possible, rank issues by risk, explain business impact, and provide clear remediation guidance. This is especially important when a critical vulnerability is Internet-facing and has a known public exploit, because exploitability and exposure increase remediation urgency. Common best practices reflected in industry guidance, including NIST vulnerability management and reporting principles, emphasize risk-based prioritization, clear communication for different stakeholders, and actionable recommendations rather than raw tool output alone.
- A. Incorrect.
Incorrect. Raw scanner output is useful as supporting evidence, but by itself it does not meet the needs of different audiences. Vulnerability assessment reports should interpret results, reduce false positives where possible, prioritize remediation, and translate technical findings into business impact. Simply handing over scanner data often leads to confusion and poor remediation planning.
- B. Incorrect.
Incorrect. Organizing findings alphabetically or by plugin category may be convenient for the assessor, but it is not the best way to communicate risk or remediation priority. Executives typically need a concise business-focused summary, while administrators need validated technical details. A single undifferentiated document organized by scanner internals does not effectively support decision-making.
- C. Correct.
Correct. This is the best practice approach. A strong vulnerability assessment report normally includes an executive summary for nontechnical stakeholders and a technical section for operational teams. It should prioritize findings by risk, especially when a critical Internet-facing vulnerability has a public exploit, and provide context such as affected systems, likelihood of exploitation, impact, evidence, and actionable remediation guidance. This structure helps management understand urgency and helps technical teams fix the right issues first.
- D. Incorrect.
Incorrect. Medium and informational findings should not automatically be removed. While the critical issue should be prioritized, lower-severity findings may still matter for defense in depth, compliance, trend analysis, or future attack paths. Good reporting emphasizes prioritization rather than suppressing all noncritical issues. Omitting them entirely can create blind spots and reduce the usefulness of the assessment.