Which practice best supports improving organizational security through a penetration test?

• A. To create a long report without actionable items
• B. To focus only on high-severity findings
• C. To avoid system owners during remediation
• D. To document all activities, attempted attacks, and vulnerabilities to guide security improvements

Answer: (D)

Documenting all activities, attempted attacks, and vulnerabilities to guide security improvements ensures the test translates into real risk reduction. When every action is logged—from what was tested to how it was tested and what was found—it creates an evidence trail that can be reviewed by technical teams and management. This makes findings actionable: it helps prioritize fixes based on actual risk, guides remediation steps, and provides a clear path for verification that vulnerabilities were addressed. It also supports governance and compliance by showing what was tested, what was discovered, and how improvements were implemented over time, which is essential for building a repeatable security program.

Choosing to produce a long report without actionable items misses the practical outcome of a test; it documents issues without offering concrete steps to fix them. Focusing only on high-severity findings can leave less obvious vulnerabilities unfixed, and it can create dangerous blind spots where attackers could chain lower-severity weaknesses. Avoiding system owners during remediation undermines collaboration, delays fixes, and reduces confidence that the fixes will be properly implemented and sustained.