CS0-003 Reporting and Communication — 20 Questions

Question 1

During a security incident, which THREE elements are critical to include in the incident report for a compliance review?

Accepted Answer

Impact assessment. The incident report must include B, the impact assessment, because a compliance review needs to know the scope, affected systems/data, and business or regulatory consequences of the breach. It must include D, the timeline of events, since auditors require a chronological record of detection, escalation, containment, and recovery to verify the response followed policy. It must include E, the root cause analysis, because compliance frameworks require evidence that the underlying weakness was identified and addressed to prevent recurrence. Options A and C are useful operational artifacts but are not among the three critical elements marked for this compliance-focused report.

Answer

Lessons learned

Answer

Remediation timeline

Question 2

Which of the following best describes the purpose of a threat intelligence report at the operational level?

Accepted Answer

Offer detailed analysis of threat actor TTPs for specific campaigns. Operational-level threat intelligence is consumed by security operations teams (SOC analysts, threat hunters, IR responders) and focuses on the specific TTPs, tools, and infrastructure of threat actors actively targeting the organization. It bridges the strategic (executive) and tactical (IoCs) layers by explaining how adversaries operate in concrete campaigns, enabling defenders to build detections and hunting hypotheses. Option A captures this TTP-focused campaign analysis, which is the defining characteristic of operational CTI.

Answer

Deliver technical indicators like IoCs to SOC analysts

Answer

Provide high-level trends to executive leadership

Answer

Summarize geopolitical risks affecting the organization

Question 3

A SOC manager needs to share threat intelligence with the SOC analysts to help them identify and block malicious activity. Which type of intelligence report is MOST appropriate?

Accepted Answer

Tactical intelligence report. Tactical threat intelligence focuses on TTPs (tactics, techniques, and procedures) of adversaries and is designed for defenders — SOC analysts use it to build detections, tune SIEM rules, and block known adversary behaviors. Because the SOC manager wants analysts to identify and block malicious activity, tactical intelligence is the right fit.

Answer

Operational intelligence report

Answer

Technical intelligence report

Answer

Strategic intelligence report

Question 4

A security analyst is creating a compliance dashboard for a PCI DSS audit. Which THREE metrics should be included to demonstrate compliance with access control requirements? (Select THREE.)

Accepted Answer

Number of active user accounts with privileged access. Option C is correct because PCI DSS Requirement 7 mandates restricting access to system components and cardholder data by business need-to-know, so tracking the number of active user accounts with privileged access directly demonstrates that access is limited and monitored. Option D is correct because PCI DSS requires timely removal or disabling of inactive accounts (Requirement 8.1.4), so the percentage of accounts inactive for more than 90 days evidences that dormant accounts are being identified and deprovisioned. Option E is correct because periodic access reviews (at least every six months per PCI DSS Requirement 7.2.4) verify that user access rights remain appropriate, and the quarterly review percentage proves this control is operating. Option A is not correct because failed login attempts relate to authentication monitoring and logging (Requirement 10), not access control metrics. Option B is not correct because critical vulnerabilities in network devices fall under vulnerability management (Requirement 6/11), not access control requirements.

Answer

Number of failed login attempts in the last 24 hours

Answer

Number of critical vulnerabilities in network devices

Question 5

A security analyst needs to communicate the business impact of a newly discovered critical vulnerability to the executive team. Which of the following is the BEST approach?

Accepted Answer

Explain the vulnerability in layman's terms and estimate potential financial loss.. Translating technical risk into business terms (financial, reputational, regulatory) helps executives understand the impact and make informed decisions.

Answer

Send the raw vulnerability scan report.

Answer

Recommend immediate patching without further context.

Answer

Provide a detailed CVSS score and exploit code.

Question 6

During an incident response, the SOC team identifies a data breach involving customer PII. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification of the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is a hard regulatory deadline and applies to breaches involving customer PII. Failure to notify can trigger fines under Article 83.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 7

A cybersecurity analyst is preparing a threat intelligence report for the SOC team. Which type of intelligence should be included to provide actionable indicators of compromise (IoCs)?

Accepted Answer

Tactical intelligence. Tactical intelligence includes IoCs such as IP addresses, domain names, and hashes that can be used for detection and blocking.

Answer

Strategic intelligence

Answer

Technical intelligence

Answer

Operational intelligence

Question 8

After a security incident, which component of the incident report provides a chronological sequence of events from detection to recovery?

Accepted Answer

Timeline. The Timeline section of an incident report presents a chronological sequence of events — detection, containment, eradication, recovery — with timestamps. It is specifically designed to reconstruct what happened and when, which is exactly what the question asks for.

Answer

Lessons learned

Answer

Root cause

Answer

Impact assessment

Question 9

Which metric measures the average time it takes to identify a security incident from the moment it occurs?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) measures the average time to detect an incident.

Answer

MTTRem

Answer

MTTR

Answer

SLA compliance

Question 10

A vulnerability report includes a risk acceptance section. Which of the following scenarios is most appropriate to include in this section?

Accepted Answer

A medium-severity vulnerability with a compensating control that reduces risk to acceptable levels. Risk acceptance is documented when the organization decides not to remediate a vulnerability due to compensating controls or low risk.

Answer

A vulnerability that has been exploited in the wild

Answer

A critical vulnerability that has been patched

Answer

All open vulnerabilities regardless of severity

Question 11

During an audit, the compliance team needs to provide evidence that access reviews are performed regularly. Which of the following is the BEST evidence?

Accepted Answer

Signed and dated access review reports. Completed access review reports with timestamps and signatures provide clear evidence that reviews were conducted.

Answer

A list of user accounts with last login dates

Answer

A policy stating that access reviews should be done quarterly

Answer

Email reminders sent to managers to perform reviews

Question 12

An analyst is creating a compliance dashboard for management. Which of the following is the most relevant metric to include regarding patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance percentage directly measures how well the organization meets patch deadlines, which is a key compliance metric.

Answer

Number of antivirus alerts

Answer

Phishing simulation click rate

Answer

Mean time to detect incidents

Question 13

Which of the following is the primary audience for a strategic threat intelligence report?

Accepted Answer

Executive leadership. Strategic intelligence is high-level and intended for executive leadership to inform business decisions.

Answer

System administrators

Answer

SOC analysts

Answer

Incident responders

Question 14

After a ransomware incident, the incident report includes lessons learned. Which of the following is the BEST example of a lesson learned?

Accepted Answer

Implement multi-factor authentication for remote access to reduce risk.. A lesson learned is a forward-looking recommendation that changes future posture, such as implementing MFA for remote access to reduce risk. It translates incident findings into actionable improvements. The other options are factual observations or analysis, not corrective recommendations.

Answer

The ransomware encrypted 500 files.

Answer

The incident started at 2:00 AM.

Answer

The root cause was a phishing email.

Question 15

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Accepted Answer

Explain the potential financial loss and reputational damage.. When communicating risk to a board of directors, the most effective approach is to translate the technical vulnerability into business impact—potential financial loss, regulatory fines, and reputational damage—because executives prioritize strategic and financial consequences over technical detail. This framing enables informed risk acceptance or remediation decisions at the governance level. CVSS scores and technical descriptions, while useful to security teams, do not resonate with non-technical leadership.

Answer

Show the CVSS score and exploit complexity.

Answer

Recommend immediate patching without details.

Answer

Describe the vulnerability in technical terms.

Question 16

Which of the following is a key component of a vulnerability report that provides a high-level overview for management?

Accepted Answer

Executive summary. The executive summary condenses findings for management to quickly understand the state of vulnerabilities.

Answer

Remediation timeline

Answer

Findings by severity

Answer

Risk acceptance

Question 17

A cybersecurity analyst is preparing an incident report after a data breach. Which TWO components are essential to include? (Select TWO.)

Accepted Answer

Root cause. Option A (Root cause) is correct because an incident report must document the underlying vulnerability or failure that enabled the breach, such as an unpatched CVE, misconfigured firewall rule, or successful phishing vector, so remediation can prevent recurrence. Option B (Timeline) is correct because a chronological sequence of events—initial compromise, detection, containment, and eradication timestamps—establishes scope, supports forensic reconstruction, and satisfies regulatory/audit requirements. The unmarked options do not belong: budget forecast (C) is a financial planning artifact, employee performance review (D) is an HR matter, and marketing analysis (E) is unrelated to security incident documentation.

Answer

Budget forecast

Answer

Employee performance review

Answer

Marketing analysis

Question 18

After a security incident involving a ransomware attack, the organization needs to communicate with various stakeholders. Which THREE of the following are appropriate actions? (Select THREE.)

Accepted Answer

Place legal holds on relevant data. Option A is correct because placing legal holds on relevant data preserves logs, backups, and affected systems as potential evidence for forensic investigation, regulatory inquiries, and possible litigation, preventing routine deletion or overwriting. Option D is correct because coordinating with law enforcement (e.g., FBI, Secret Service, or local cybercrime units) is a standard incident-response step that supports evidence handling, threat attribution, and may be legally required or beneficial for the organization. Option E is correct because notifying affected customers as required by law satisfies breach-notification obligations under regulations such as GDPR, HIPAA, or state data-breach statutes, which mandate timely disclosure when personal or protected data is compromised. Option B is not appropriate because deleting logs destroys forensic evidence, violates legal-hold and retention requirements, and impedes incident investigation. Option C is not appropriate because publishing details on social media immediately can compromise the investigation, leak sensitive information, and should instead be handled through a coordinated, approved communications plan.

Answer

Delete all logs to prevent data leakage

Answer

Publish details on social media immediately

Question 19

A security analyst is selecting Key Performance Indicators (KPIs) for a security operations dashboard. Which THREE metrics are most relevant for measuring incident response effectiveness? (Select THREE.)

Accepted Answer

Mean time to detect (MTTD). Option B, Mean time to detect (MTTD), is correct because it directly measures how quickly the security operations team identifies a potential incident from the moment it occurs, which is a core indicator of detection capability and monitoring effectiveness. Option C, Mean time to remediate (MTTRem), is correct because it quantifies the time required to fully resolve or contain an incident after detection, reflecting the team's ability to restore normal operations and limit business impact. Option E, Mean time to respond (MTTR), is correct because it measures the elapsed time from detection to the start of active response actions, showing how promptly analysts engage with and begin handling a confirmed incident. Option A, Number of employees, is not a security operations performance metric and does not reflect incident response effectiveness. Option D, Revenue growth, is a business financial metric unrelated to the speed or quality of incident detection, response, or remediation.

Answer

Number of employees

Answer

Revenue growth

Question 20

A cybersecurity analyst is preparing a vulnerability report for the IT manager. Which section should summarize the most critical risks for the organization?

Accepted Answer

Executive summary. The executive summary provides a high-level overview of the most critical risks and recommended actions for management.

Answer

Remediation timeline

Answer

Risk acceptance

Answer

Findings by severity