Which information is typically included for findings discovered during the test?

• A. System Name, IP Address, Risk Level, Ease of Exploitation, Two-Sentence Summary
• B. Target System, Open Ports, CVSS Score, Exploit Details
• C. Asset Owner, Location, Password Policy
• D. Vendor, Firmware Version, Patch Date

Answer: (A)

When reporting findings from a penetration test, you want a concise, clear snapshot of what was found and why it matters. The best choice includes the asset’s identity (System Name and IP Address) so anyone can pinpoint where the issue exists. It also states the Risk Level to show how severe the finding is, and the Ease of Exploitation to convey how practical it is for a attacker to exploit. A brief Two-Sentence Summary gives a quick, readable takeaway that non-technical stakeholders can grasp.

The other options mix in details that belong in other parts of a report or are too granular for a finding’s high-level summary. For example, keeping open ports or exploit details in the finding can overwhelm the reader; asset-related data like owner or location fits more with asset management or scoping, and CVSS scores or vendor/patch data are useful but not core to the concise finding narrative itself.