CS0-003 Reporting and Communication — 15 Questions

Question 1

A security analyst needs to communicate the business impact of a newly discovered critical vulnerability to the executive team. Which of the following is the BEST approach?

Accepted Answer

Explain the vulnerability in layman's terms and estimate potential financial loss.. Translating technical risk into business terms (financial, reputational, regulatory) helps executives understand the impact and make informed decisions.

Answer

Send the raw vulnerability scan report.

Answer

Recommend immediate patching without further context.

Answer

Provide a detailed CVSS score and exploit code.

Question 2

A cybersecurity analyst is preparing a threat intelligence report for the SOC team. Which type of intelligence should be included to provide actionable indicators of compromise (IoCs)?

Accepted Answer

Tactical intelligence. Tactical intelligence includes IoCs such as IP addresses, domain names, and hashes that can be used for detection and blocking.

Answer

Strategic intelligence

Answer

Technical intelligence

Answer

Operational intelligence

Question 3

Which metric measures the average time it takes to identify a security incident from the moment it occurs?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) measures the average time to detect an incident.

Answer

MTTRem

Answer

MTTR

Answer

SLA compliance

Question 4

A vulnerability report includes a risk acceptance section. Which of the following scenarios is most appropriate to include in this section?

Accepted Answer

A medium-severity vulnerability with a compensating control that reduces risk to acceptable levels. Risk acceptance is documented when the organization decides not to remediate a vulnerability due to compensating controls or low risk.

Answer

A vulnerability that has been exploited in the wild

Answer

A critical vulnerability that has been patched

Answer

All open vulnerabilities regardless of severity

Question 5

During an audit, the compliance team needs to provide evidence that access reviews are performed regularly. Which of the following is the BEST evidence?

Accepted Answer

Signed and dated access review reports. Completed access review reports with timestamps and signatures provide clear evidence that reviews were conducted.

Answer

A list of user accounts with last login dates

Answer

A policy stating that access reviews should be done quarterly

Answer

Email reminders sent to managers to perform reviews

Question 6

Which of the following is a key component of a vulnerability report that provides a high-level overview for management?

Accepted Answer

Executive summary. The executive summary condenses findings for management to quickly understand the state of vulnerabilities.

Answer

Remediation timeline

Answer

Findings by severity

Answer

Risk acceptance

Question 7

A cybersecurity analyst is preparing a vulnerability report for the IT manager. Which section should summarize the most critical risks for the organization?

Accepted Answer

Executive summary. The executive summary provides a high-level overview of the most critical risks and recommended actions for management.

Answer

Remediation timeline

Answer

Risk acceptance

Answer

Findings by severity

Question 8

During a security incident, a CySA+ analyst needs to communicate the status to the CISO. Which type of report is most appropriate for this purpose?

Accepted Answer

Executive dashboard. An executive dashboard provides a high-level, real-time view of key metrics and incident status suitable for executive communication.

Answer

Technical report with packet captures

Answer

Vulnerability scan report

Answer

Threat intelligence feed

Question 9

An analyst is evaluating the performance of the security operations center (SOC). Which metric best indicates the team's ability to contain an active threat?

Accepted Answer

Mean time to respond (MTTR). Mean Time to Respond (MTTR) measures the average time taken to contain and remediate an incident, directly reflecting containment speed.

Answer

Mean time to detect (MTTD)

Answer

Patch SLA compliance %

Answer

Open vulnerability counts by severity

Question 10

A security analyst must present a risk assessment to the board of directors. Which approach is most effective for communicating technical risks?

Accepted Answer

Translate technical risk into business impact. Translating technical risks into business impact (e.g., financial, reputational) helps non-technical stakeholders understand and prioritize risks.

Answer

Focus solely on CVSS scores

Answer

Provide raw log data

Answer

Use technical jargon to demonstrate expertise

Question 11

A company experiences a data breach involving personal data of EU citizens. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a breach.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 12

Which component of an incident report describes the sequence of events from detection to resolution?

Accepted Answer

Timeline. The timeline provides a chronological account of events, crucial for understanding the incident's progression.

Answer

Root cause

Answer

Impact assessment

Answer

Lessons learned

Question 13

An analyst needs to collect evidence for a compliance audit. Which type of evidence is most appropriate to demonstrate that access reviews are performed regularly?

Accepted Answer

Access review reports. Access review reports serve as direct evidence that reviews are conducted, showing dates and outcomes.

Answer

Vulnerability scan reports

Answer

Configuration backups

Answer

Log exports of user activity

Question 14

During an incident, the SOC team identifies indicators of compromise (IoCs) that may affect partners. According to best practices, what should the analyst do first?

Accepted Answer

Follow the incident response communication plan. An incident response plan should define communication procedures; typically, the team should escalate internally to leadership who can authorize external notifications.

Answer

Wait until the incident is fully resolved

Answer

Post the IoCs on a public threat sharing platform

Answer

Directly notify all affected partners

Question 15

Which metric measures the average time taken to fix a vulnerability after it is identified?

Accepted Answer

Mean time to remediate (MTTRem). Mean Time to Remediate (MTTRem) specifically tracks the time from identification to remediation.

Answer

Mean time to detect (MTTD)

Answer

Mean time to respond (MTTR)

Answer

Patch SLA compliance %