Comprehensive and Detailed Explanation:
An external attack surface review focuses on identifying publicly accessible assets that an attacker could exploit. The first step in this process is information gathering, which involves enumerating domains, subdomains, public IPs, DNS records, and other internet-facing resources. This is done using passive reconnaissance tools such as Whois, Shodan, Google Dorking, and OSINT techniques.
Option A is correct because it aligns with the assessment goal-finding public-facing systems and their vulnerabilities before an attacker does.
Option B (phishing assessment) is incorrect because it involves social engineering, which is not part of an external attack surface review.
Option C (physical security review) is incorrect as it pertains to physical penetration testing, not an external attack analysis.
Option D (vulnerability assessment) is incorrect because a vulnerability assessment is a later step after reconnaissance. The first step is identifying assets through information gathering.
Reference: CompTIA PenTest+ PT0-003 Official Guide - Chapter 4 (Information Gathering and OSINT).

The attack narrative is a critical part of the report that tells the story of how the tester exploited vulnerabilities, gained access, and moved laterally. It helps stakeholders understand the real- world impact in a readable and logical sequence.
User activities are more operational logs than part of a pentest report. Customer remediation plan is the client's responsibility. Key management might be discussed but is not a required component of the report.

A blind web application test means that the tester has no prior knowledge of the application's internal workings. The best tool for automated scanning and vulnerability detection is a web application proxy such as OWASP ZAP.
ZAP (Option A):
OWASP Zed Attack Proxy (ZAP) is a widely used web application scanner for finding common vulnerabilities (e.g., SQL injection, XSS, authentication flaws).
It provides passive and active scanning features to test web applications for security weaknesses.
Reference: CompTIA PenTest+ PT0-003 Official Study Guide - "Web Application Testing Tools" Incorrect options:
Option B (Nmap): Nmap is a network scanning tool, not specialized for web application testing.
Option C (Wfuzz): Wfuzz is a fuzzer for brute-force attacks, but it is not a full web vulnerability scanner.
Option D (Trufflehog): Trufflehog is used for secrets detection in repositories, not web testing.

In PenTest+ network enumeration, UDP scanning is emphasized as inherently less reliable than TCP because many UDP services do not respond unless they receive an application-valid request, and many firewalls silently drop unsolicited UDP probes. With Nmap -sU, if the scanner does not receive either (1) an application-layer UDP response indicating the service is listening or (2) an ICMP "port unreachable" message indicating the port is closed, Nmap cannot definitively classify the port. In that case, it reports open|filtered, meaning the port may be open but nonresponsive to the probe, or traffic may be filtered.
SNMP commonly requires a correct community string and properly formed requests before returning data.
snmpwalk generates valid SNMP queries and can succeed even when Nmap's generic probe yields no reply, resulting in an open|filtered label. Root privilege issues do not explain this state, and rate limiting is possible but not the best fit given the standard UDP classification behavior.

Reference: https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/