Engagement Management · Topic 5 of 5
Findings and Remediation Recommendations
Write report findings with evidence and CVSS severity, then recommend practical fixes: short and long term actions, compensating controls and priorities.
- 5 min
- A complete finding has a title, severity, affected assets, description, evidence, impact and remediation.
- CVSS base scores run from 0.0 to 10.0, with 9.0 and above rated critical.
- Context changes priority: exposure, data value, known exploitation and compensating controls.
What it is
A finding is one documented weakness, with enough detail for the client to understand, reproduce and fix it. Remediation recommendations are the advice on how to remove or reduce the risk.
These parts make up most of a report. The exam checks that you can rate findings, choose sensible fixes and separate immediate actions from long term ones.
How it works
What a finding contains
Each finding follows a consistent template so that readers can scan it.
| Element | Purpose |
|---|---|
| Title | Short name of the weakness |
| Severity | Rating, such as critical, high, medium, low or informational |
| Affected assets | Hosts, applications or accounts involved |
| Description | What the flaw is and why it matters |
| Evidence | Screenshots, request and response excerpts, timestamps |
| Impact | What an attacker could achieve in this environment |
| Remediation | Specific steps to fix or reduce the risk |
| References | CVE numbers, CWE entries or vendor advisories |
CVE is the Common Vulnerabilities and Exposures list of public vulnerability identifiers. CWE is the Common Weakness Enumeration, a catalogue of weakness types such as improper input validation.
Rating severity
The Common Vulnerability Scoring System (CVSS) gives a base score from 0.0 to 10.0. The commonly used bands for version 3.x are shown below.
| Score | Rating |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
The base score describes the flaw itself. The tester then adjusts the priority using context: how exposed the system is, how valuable the data is, whether the flaw has already been used in real attacks, and whether other controls reduce the risk.
Evidence quality
Evidence should be accurate, minimal and safe. Screenshots with timestamps, short output excerpts and the steps in plain words are usually enough.
Sensitive values such as passwords, tokens and personal data should be masked in the report. The tester also keeps the original evidence under protection in case the client asks questions.
Writing remediation
Good recommendations are specific, achievable and ordered. "Improve security" is not helpful, but "apply the vendor patch and restrict the management port to the administration network" is.
Fixes are often split by time frame.
| Time frame | Examples |
|---|---|
| Short term | Apply a patch, change default credentials, close an exposed port |
| Medium term | Roll out multifactor authentication (MFA), improve logging, segment a network |
| Long term | Secure development training, asset management, regular testing |
Types of remediation
- Remove the cause: patch, reconfigure or replace the component.
- Compensating control: a different measure that lowers the risk when the real fix is not possible, such as a web application firewall (WAF) in front of a legacy application.
- Detect and respond: improve monitoring so that attempts are seen early.
- Accept the risk: a documented business decision, made by the right owner.
Control categories
Remediation controls fall into categories, and the exam asks you to place a control in the right one.
| Category | Examples |
|---|---|
| Technical | System hardening, input validation, multifactor authentication, encryption, patch and key management, certificate management, network segmentation |
| Administrative | Role-based access control (RBAC), secure development life cycle, password policy, procedures |
| Operational | Job rotation, time-of-day restrictions, mandatory vacations, user training |
| Physical | Access control vestibule, biometric controls, video surveillance |
Certificate management covers expired, self-signed or weak certificates: validate them, automate renewal, and revoke and replace any that are compromised. RBAC grants permissions by job role with least privilege and periodic access reviews.
Job rotation and mandatory vacations expose misuse when another person covers a role, and time-of-day restrictions block access outside working hours. An access control vestibule stops tailgating, biometrics tie entry to a person, and video surveillance is a detective control.
Prioritising
Priority combines severity, how easy the attack is, how much damage it could do and how hard the fix is. A medium flaw on an internet facing payment server can outrank a high flaw on an isolated lab machine.
Where several findings chain together into a serious path, fixing one link may break the whole path. The report should point this out.
Do not give exploit code or full attack steps in the remediation advice. State the fix, and keep technical reproduction detail to what the client needs to verify the issue.
What to remember for the exam
- A complete finding has a title, severity, affected assets, description, evidence, impact and remediation.
- CVSS base scores run from 0.0 to 10.0, with 9.0 and above rated critical.
- Context changes priority: exposure, data value, known exploitation and compensating controls.
- Mask sensitive values in evidence, and keep the originals secured.
- Recommendations should be specific and split into short, medium and long term actions.
- A compensating control reduces risk when a direct fix is not available.
- References such as CVE and CWE help the client research the issue.
- Chained findings should be shown together because one fix may break the chain.
Common mistakes
Copying the scanner's severity without checking. A scanner score ignores your client's context, so validate and adjust it.
Vague advice. Statements such as "harden the server" give the client no action to take.
Treating compensating controls as permanent. They are a bridge until the real fix is applied.
Overstating findings. Calling every issue critical removes trust and hides the ones that truly matter.
Missing the root cause. Fixing five symptoms while ignoring the missing patching process means the same issues return.
Check yourself
Which CVSS base score range is rated high?
7.0 to 8.9.
What is a compensating control?
A different measure that lowers risk when the direct fix cannot be applied yet.
Why add context to a CVSS score?
Because exposure, data value and existing controls change how urgent the real risk is.
Topic 5 of 5 in Engagement Management
Test yourself on Engagement Management
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.