CompTIA PenTest+ Practice Test

What must a vulnerability report include to accurately reflect the assets scanned?

1. Incident response plan

2. Risk assessment

3. Log disposition

4. Threat analysis

The correct answer is: Log disposition

For a vulnerability report to accurately reflect the assets scanned, it is essential to include a detailed account of log disposition. Log disposition involves documenting the status and management of logs generated during the scanning process. This includes indicating how logs should be retained, archived, or deleted, as well as noting any relevant metadata associated with those logs, such as timestamps, sources, and any pertinent activity captured during the scan. Including log disposition helps in tracing any findings back to their source, providing a clearer understanding of the scan results and the context in which they were generated. It supports accountability and transparency in the vulnerability assessment process, making it easier to correlate issues with specific assets and actions taken during the scan. Other options, while important in a broader security context, do not specifically pertain to accurately reflecting the assets scanned. An incident response plan is crucial for addressing vulnerabilities once identified but is not part of the scanner result itself. A risk assessment evaluates the potential impact of vulnerabilities but does not directly report on the findings. Threat analysis focuses on understanding potential threats but again doesn't provide the necessary detail on the disposition of scanned logs that would enhance the accuracy of a vulnerability report.