CS0-003 Reporting and Communication — 10 Questions

Question 1

A security analyst needs to communicate the business impact of a newly discovered critical vulnerability to the executive team. Which of the following is the BEST approach?

Accepted Answer

Explain the vulnerability in layman's terms and estimate potential financial loss.. Translating technical risk into business terms (financial, reputational, regulatory) helps executives understand the impact and make informed decisions.

Answer

Send the raw vulnerability scan report.

Answer

Recommend immediate patching without further context.

Answer

Provide a detailed CVSS score and exploit code.

Question 2

A cybersecurity analyst is preparing a threat intelligence report for the SOC team. Which type of intelligence should be included to provide actionable indicators of compromise (IoCs)?

Accepted Answer

Tactical intelligence. Tactical intelligence includes IoCs such as IP addresses, domain names, and hashes that can be used for detection and blocking.

Answer

Strategic intelligence

Answer

Technical intelligence

Answer

Operational intelligence

Question 3

Which metric measures the average time it takes to identify a security incident from the moment it occurs?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) measures the average time to detect an incident.

Answer

MTTRem

Answer

MTTR

Answer

SLA compliance

Question 4

A vulnerability report includes a risk acceptance section. Which of the following scenarios is most appropriate to include in this section?

Accepted Answer

A medium-severity vulnerability with a compensating control that reduces risk to acceptable levels. Risk acceptance is documented when the organization decides not to remediate a vulnerability due to compensating controls or low risk.

Answer

A vulnerability that has been exploited in the wild

Answer

A critical vulnerability that has been patched

Answer

All open vulnerabilities regardless of severity

Question 5

During an audit, the compliance team needs to provide evidence that access reviews are performed regularly. Which of the following is the BEST evidence?

Accepted Answer

Signed and dated access review reports. Completed access review reports with timestamps and signatures provide clear evidence that reviews were conducted.

Answer

A list of user accounts with last login dates

Answer

A policy stating that access reviews should be done quarterly

Answer

Email reminders sent to managers to perform reviews

Question 6

Which of the following is a key component of a vulnerability report that provides a high-level overview for management?

Accepted Answer

Executive summary. The executive summary condenses findings for management to quickly understand the state of vulnerabilities.

Answer

Remediation timeline

Answer

Findings by severity

Answer

Risk acceptance

Question 7

A cybersecurity analyst is preparing a vulnerability report for the IT manager. Which section should summarize the most critical risks for the organization?

Accepted Answer

Executive summary. The executive summary provides a high-level overview of the most critical risks and recommended actions for management.

Answer

Remediation timeline

Answer

Risk acceptance

Answer

Findings by severity

Question 8

During a security incident, a CySA+ analyst needs to communicate the status to the CISO. Which type of report is most appropriate for this purpose?

Accepted Answer

Executive dashboard. An executive dashboard provides a high-level, real-time view of key metrics and incident status suitable for executive communication.

Answer

Technical report with packet captures

Answer

Vulnerability scan report

Answer

Threat intelligence feed

Question 9

An analyst is evaluating the performance of the security operations center (SOC). Which metric best indicates the team's ability to contain an active threat?

Accepted Answer

Mean time to respond (MTTR). Mean Time to Respond (MTTR) measures the average time taken to contain and remediate an incident, directly reflecting containment speed.

Answer

Mean time to detect (MTTD)

Answer

Patch SLA compliance %

Answer

Open vulnerability counts by severity

Question 10

A security analyst must present a risk assessment to the board of directors. Which approach is most effective for communicating technical risks?

Accepted Answer

Translate technical risk into business impact. Translating technical risks into business impact (e.g., financial, reputational) helps non-technical stakeholders understand and prioritize risks.

Answer

Focus solely on CVSS scores

Answer

Provide raw log data

Answer

Use technical jargon to demonstrate expertise