CS0-003 Reporting and Communication — All Questions With Answers

Question 1easymultiple choice

Read the full Reporting and Communication explanation →

A security analyst needs to communicate the business impact of a newly discovered critical vulnerability to the executive team. Which of the following is the BEST approach?

Question 2mediummultiple choice

Read the full Reporting and Communication explanation →

During an incident response, the SOC team identifies a data breach involving customer PII. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Question 3hardmultiple choice

Read the full Reporting and Communication explanation →

A cybersecurity analyst is preparing a threat intelligence report for the SOC team. Which type of intelligence should be included to provide actionable indicators of compromise (IoCs)?

Question 4mediummultiple choice

Read the full Reporting and Communication explanation →

After a security incident, which component of the incident report provides a chronological sequence of events from detection to recovery?

Question 5easymultiple choice

Read the full Reporting and Communication explanation →

Which metric measures the average time it takes to identify a security incident from the moment it occurs?

Question 6mediummultiple choice

Read the full Reporting and Communication explanation →

A vulnerability report includes a risk acceptance section. Which of the following scenarios is most appropriate to include in this section?

Question 7hardmultiple choice

Read the full Reporting and Communication explanation →

During an audit, the compliance team needs to provide evidence that access reviews are performed regularly. Which of the following is the BEST evidence?

Question 8mediummultiple choice

Read the full Reporting and Communication explanation →

An analyst is creating a compliance dashboard for management. Which of the following is the most relevant metric to include regarding patch management?

Question 9easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following is the primary audience for a strategic threat intelligence report?

Question 10mediummultiple choice

Read the full Reporting and Communication explanation →

After a ransomware incident, the incident report includes lessons learned. Which of the following is the BEST example of a lesson learned?

Question 11hardmultiple choice

Read the full Reporting and Communication explanation →

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Question 12mediummultiple choice

Read the full Reporting and Communication explanation →

Which of the following is a key component of a vulnerability report that provides a high-level overview for management?

Question 13mediummulti select

Read the full Reporting and Communication explanation →

A cybersecurity analyst is preparing an incident report after a data breach. Which TWO components are essential to include? (Select TWO.)

Question 14hardmulti select

Read the full Reporting and Communication explanation →

After a security incident involving a ransomware attack, the organization needs to communicate with various stakeholders. Which THREE of the following are appropriate actions? (Select THREE.)

Question 15mediummulti select

Read the full Reporting and Communication explanation →

A security analyst is selecting Key Performance Indicators (KPIs) for a security operations dashboard. Which THREE metrics are most relevant for measuring incident response effectiveness? (Select THREE.)

Question 16easymultiple choice

Read the full Reporting and Communication explanation →

A cybersecurity analyst is preparing a vulnerability report for the IT manager. Which section should summarize the most critical risks for the organization?

Question 17mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident, a CySA+ analyst needs to communicate the status to the CISO. Which type of report is most appropriate for this purpose?

Question 18hardmultiple choice

Read the full Reporting and Communication explanation →

An analyst is evaluating the performance of the security operations center (SOC). Which metric best indicates the team's ability to contain an active threat?

Question 19mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst must present a risk assessment to the board of directors. Which approach is most effective for communicating technical risks?

Question 20mediummultiple choice

Read the full Reporting and Communication explanation →

A company experiences a data breach involving personal data of EU citizens. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Question 21easymultiple choice

Read the full Reporting and Communication explanation →

Which component of an incident report describes the sequence of events from detection to resolution?

Question 22mediummultiple choice

Read the full Reporting and Communication explanation →

An analyst needs to collect evidence for a compliance audit. Which type of evidence is most appropriate to demonstrate that access reviews are performed regularly?

Question 23hardmultiple choice

Read the full Reporting and Communication explanation →

During an incident, the SOC team identifies indicators of compromise (IoCs) that may affect partners. According to best practices, what should the analyst do first?

Question 24easymultiple choice

Read the full Reporting and Communication explanation →

Which metric measures the average time taken to fix a vulnerability after it is identified?

Question 25mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst is creating a risk register. Which of the following is the most important element to include for each risk?

Question 26mediummultiple choice

Read the full Reporting and Communication explanation →

A phishing simulation is conducted, and the click rate is reported to management. What does a high click rate indicate?

Question 27hardmultiple choice

Read the full Reporting and Communication explanation →

An organization's compliance dashboard shows a control effectiveness score of 85%. Which type of evidence best supports this score?

Question 28mediummulti select

Read the full Reporting and Communication explanation →

A security analyst needs to provide threat intelligence to different audiences. Which TWO of the following are appropriate dissemination approaches?

Question 29mediummulti select

Read the full Reporting and Communication explanation →

During a security incident, which THREE elements are critical to include in the incident report for a compliance review?

Question 30hardmulti select

Read the full Reporting and Communication explanation →

An organization is preparing for a compliance audit. Which TWO of the following are essential pieces of evidence to demonstrate effective vulnerability management?

Question 31mediummultiple choice

Read the full Reporting and Communication explanation →

A cybersecurity analyst needs to communicate the risk of a newly discovered vulnerability in a legacy system to the executive leadership. Which approach best translates the technical risk into business risk?

Question 32mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident, the SOC team identifies indicators of compromise (IoCs) related to a new malware strain. Which type of threat intelligence report should be produced for the SOC team to enhance detection?

Question 33easymultiple choice

Read the full Reporting and Communication explanation →

Which metric measures the average time it takes for an organization to identify a security incident from the moment it occurs?

Question 34mediummultiple choice

Read the full Reporting and Communication explanation →

A vulnerability report for a critical application shows that a high-risk vulnerability has been accepted by the business owner. What should the analyst include in the report to document this decision?

Question 35hardmultiple choice

Read the full Reporting and Communication explanation →

During an incident, the security team needs to preserve evidence for potential litigation. Which of the following actions is most critical to ensure the admissibility of digital evidence?

Question 36mediummultiple choice

Read the full Reporting and Communication explanation →

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Question 37easymultiple choice

Read the full Reporting and Communication explanation →

After a phishing simulation, the security team wants to report the results to management. Which metric is most appropriate to include in the report?

Question 38mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst is preparing a vulnerability report for the IT operations team. Which section should provide a high-level overview of the organization's risk posture?

Question 39hardmultiple choice

Read the full Reporting and Communication explanation →

During an incident, the security team discovers that customer personally identifiable information (PII) was exfiltrated. Which of the following notifications must be made according to GDPR?

Question 40easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following is the best example of a Key Performance Indicator (KPI) for patch management?

Question 41mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst needs to present a risk register to a non-technical board. Which of the following formats is most appropriate?

Question 42hardmultiple choice

Read the full Reporting and Communication explanation →

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Question 43mediummulti select

Read the full Reporting and Communication explanation →

A security analyst is preparing an incident report after a ransomware attack. Which two components must be included in the report? (Select TWO.)

Question 44mediummulti select

Read the full Reporting and Communication explanation →

Which three metrics are commonly used to measure the effectiveness of a security operations center (SOC)? (Select THREE.)

Question 45hardmulti select

Read the full Reporting and Communication explanation →

A security analyst is collecting evidence for an upcoming compliance audit. Which three types of evidence are typically required? (Select THREE.)

Question 46mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst discovers a critical vulnerability in a web application that stores customer payment data. The analyst needs to report this to the CISO. Which type of report is most appropriate for communicating the business impact of this vulnerability?

Question 47easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following metrics measures the average time it takes to identify a security incident after it occurs?

Question 48mediummultiple choice

Read the full Reporting and Communication explanation →

An organization is preparing for an audit to demonstrate compliance with GDPR. The compliance officer needs to provide evidence of data protection controls. Which of the following would be the BEST evidence to include?

Question 49hardmultiple choice

Read the full Reporting and Communication explanation →

During a security incident, a SOC analyst identifies that customer PII has been exfiltrated. The company operates in multiple states and processes EU residents' data. Which of the following is the MOST critical immediate communication requirement?

Question 50easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following best describes the purpose of a threat intelligence report at the operational level?

Question 51mediummultiple choice

Read the full Reporting and Communication explanation →

A vulnerability report is presented to the IT manager. The report lists 15 critical, 40 high, 100 medium, and 200 low vulnerabilities. The IT manager asks which vulnerabilities should be prioritized for remediation. According to the vulnerability report structure, which section should the analyst reference?

Question 52hardmultiple choice

Read the full Reporting and Communication explanation →

A security analyst is communicating a complex security risk about a new zero-day vulnerability to the board of directors. The board members have varying technical backgrounds. Which approach would be MOST effective?

Question 53mediummultiple choice

Read the full Reporting and Communication explanation →

An incident report includes a section that details the sequence of events from initial compromise to containment. Which component of the incident report does this describe?

Question 54easymultiple choice

Read the full Reporting and Communication explanation →

Which metric would best indicate the effectiveness of an organization's patch management program?

Question 55mediummultiple choice

Read the full Reporting and Communication explanation →

A SOC manager needs to share threat intelligence with the SOC analysts to help them identify and block malicious activity. Which type of intelligence report is MOST appropriate?

Question 56hardmultiple choice

Read the full Reporting and Communication explanation →

An organization has a risk acceptance process for vulnerabilities that cannot be remediated immediately. Which of the following should be documented in the risk acceptance paperwork?

Question 57mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident, which of the following should be the FIRST communication to internal stakeholders?

Question 58mediummulti select

Read the full Reporting and Communication explanation →

A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)

Question 59hardmulti select

Read the full Reporting and Communication explanation →

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Question 60easymulti select

Read the full Reporting and Communication explanation →

A security analyst is creating metrics for a security dashboard aimed at executive leadership. Which THREE metrics are most appropriate for this audience? (Select THREE.)

Question 61easymultiple choice

Read the full Reporting and Communication explanation →

Which metric is commonly used to measure the average time it takes to identify that a security incident has occurred?

Question 62mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident involving a potential data breach, the CISO asks you to prepare a communication for the board of directors. What is the MOST important aspect to emphasize in this communication?

Question 63hardmultiple choice

Read the full Reporting and Communication explanation →

A vulnerability report is being prepared for an organization's management. Which of the following is the MOST appropriate structure for this report?

Question 64mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst is preparing an after-action report for a phishing incident. Which component is MOST critical to include to prevent recurrence?

Question 65easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following is a key performance indicator (KPI) for measuring the efficiency of patch management?

Question 66mediummultiple choice

Read the full Reporting and Communication explanation →

During a compliance audit, the auditor requests evidence of access reviews. Which of the following would be the MOST appropriate evidence to provide?

Question 67hardmultiple choice

Read the full Reporting and Communication explanation →

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the supervisory authority?

Question 68mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst receives a threat intelligence report containing detailed Indicators of Compromise (IoCs) such as IP addresses, file hashes, and domain names. What is the MOST appropriate audience for distributing this type of report?

Question 69mediummultiple choice

Read the full Reporting and Communication explanation →

Which of the following BEST describes the purpose of a risk register in the context of reporting and communication?

Question 70hardmultiple choice

Read the full Reporting and Communication explanation →

An organization is preparing evidence for a compliance audit. Which of the following pieces of evidence would BEST demonstrate that a security control is effective?

Question 71mediummultiple choice

Read the full Reporting and Communication explanation →

During an incident, which of the following should be the FIRST priority when communicating with law enforcement?

Question 72easymultiple choice

Read the full Reporting and Communication explanation →

Which type of threat intelligence report is MOST appropriate for a Chief Information Security Officer (CISO) to understand the overall threat landscape and make strategic decisions?

Question 73mediummulti select

Read the full Reporting and Communication explanation →

A security analyst is preparing a vulnerability report for management. Which TWO elements should be included in the executive summary? (Select TWO.)

Question 74mediummulti select

Read the full Reporting and Communication explanation →

An incident responder is documenting the root cause of a data breach. Which THREE components are essential to include in the root cause analysis section of the incident report? (Select THREE.)

Question 75hardmulti select

Read the full Reporting and Communication explanation →

A security analyst is creating a compliance dashboard for a PCI DSS audit. Which THREE metrics should be included to demonstrate compliance with access control requirements? (Select THREE.)

Question 76easymultiple choice

Read the full Reporting and Communication explanation →

A cybersecurity analyst is preparing a report for the executive leadership team. Which type of report is most appropriate for communicating high-level security posture and risk to non-technical stakeholders?

Question 77mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident, the incident response team has identified that a phishing email led to credential theft and lateral movement. Which component of the incident report should detail the sequence of events from initial compromise to containment?

Question 78hardmultiple choice

Read the full Reporting and Communication explanation →

An organization needs to report a data breach involving personal data of EU residents. Under GDPR, what is the maximum time allowed for notifying the supervisory authority after becoming aware of the breach?

Question 79easymulti select

Read the full Reporting and Communication explanation →

A cybersecurity analyst is building a compliance dashboard for an upcoming audit. Which TWO metrics are most relevant for demonstrating effective patch management? (Select TWO.)

Question 80mediummulti select

Read the full Reporting and Communication explanation →

An analyst is preparing a vulnerability report for management. Which THREE sections should be included to effectively communicate findings and remediation? (Select THREE.)

Question 81mediummulti select

Read the full Reporting and Communication explanation →

During a security incident, a cybersecurity analyst must communicate with various stakeholders. Which TWO are appropriate internal escalation paths? (Select TWO.)

Question 82hardmulti select

Read the full Reporting and Communication explanation →

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Question 83mediummulti select

Read the full Reporting and Communication explanation →

An organization is preparing evidence for an audit of access controls. Which THREE types of evidence should be collected? (Select THREE.)

Question 84hardmulti select

Read the full Reporting and Communication explanation →

A threat intelligence analyst has produced a report containing specific Indicators of Compromise (IoCs) such as IP addresses, domain names, and file hashes. Which TWO audiences are most appropriate for this type of intelligence? (Select TWO.)

Question 1easymultiple choice

Read the full Reporting and Communication explanation →

A security analyst needs to communicate the business impact of a newly discovered critical vulnerability to the executive team. Which of the following is the BEST approach?

Question 2mediummultiple choice

Read the full Reporting and Communication explanation →

During an incident response, the SOC team identifies a data breach involving customer PII. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Question 3hardmultiple choice

Read the full Reporting and Communication explanation →

A cybersecurity analyst is preparing a threat intelligence report for the SOC team. Which type of intelligence should be included to provide actionable indicators of compromise (IoCs)?

Question 4mediummultiple choice

Read the full Reporting and Communication explanation →

After a security incident, which component of the incident report provides a chronological sequence of events from detection to recovery?

Question 5easymultiple choice

Read the full Reporting and Communication explanation →

Which metric measures the average time it takes to identify a security incident from the moment it occurs?

Question 6mediummultiple choice

Read the full Reporting and Communication explanation →

A vulnerability report includes a risk acceptance section. Which of the following scenarios is most appropriate to include in this section?

Question 7hardmultiple choice

Read the full Reporting and Communication explanation →

During an audit, the compliance team needs to provide evidence that access reviews are performed regularly. Which of the following is the BEST evidence?

Question 8mediummultiple choice

Read the full Reporting and Communication explanation →

An analyst is creating a compliance dashboard for management. Which of the following is the most relevant metric to include regarding patch management?

Question 9easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following is the primary audience for a strategic threat intelligence report?

Question 10mediummultiple choice

Read the full Reporting and Communication explanation →

After a ransomware incident, the incident report includes lessons learned. Which of the following is the BEST example of a lesson learned?

Question 11hardmultiple choice

Read the full Reporting and Communication explanation →

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Question 12mediummultiple choice

Read the full Reporting and Communication explanation →

Which of the following is a key component of a vulnerability report that provides a high-level overview for management?

Question 13mediummulti select

Read the full Reporting and Communication explanation →

A cybersecurity analyst is preparing an incident report after a data breach. Which TWO components are essential to include? (Select TWO.)

Question 14hardmulti select

Read the full Reporting and Communication explanation →

After a security incident involving a ransomware attack, the organization needs to communicate with various stakeholders. Which THREE of the following are appropriate actions? (Select THREE.)

Question 15mediummulti select

Read the full Reporting and Communication explanation →

A security analyst is selecting Key Performance Indicators (KPIs) for a security operations dashboard. Which THREE metrics are most relevant for measuring incident response effectiveness? (Select THREE.)

Question 16easymultiple choice

Read the full Reporting and Communication explanation →

A cybersecurity analyst is preparing a vulnerability report for the IT manager. Which section should summarize the most critical risks for the organization?

Question 17mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident, a CySA+ analyst needs to communicate the status to the CISO. Which type of report is most appropriate for this purpose?

Question 18hardmultiple choice

Read the full Reporting and Communication explanation →

An analyst is evaluating the performance of the security operations center (SOC). Which metric best indicates the team's ability to contain an active threat?

Question 19mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst must present a risk assessment to the board of directors. Which approach is most effective for communicating technical risks?

Question 20mediummultiple choice

Read the full Reporting and Communication explanation →

A company experiences a data breach involving personal data of EU citizens. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Question 21easymultiple choice

Read the full Reporting and Communication explanation →

Which component of an incident report describes the sequence of events from detection to resolution?

Question 22mediummultiple choice

Read the full Reporting and Communication explanation →

An analyst needs to collect evidence for a compliance audit. Which type of evidence is most appropriate to demonstrate that access reviews are performed regularly?

Question 23hardmultiple choice

Read the full Reporting and Communication explanation →

During an incident, the SOC team identifies indicators of compromise (IoCs) that may affect partners. According to best practices, what should the analyst do first?

Question 24easymultiple choice

Read the full Reporting and Communication explanation →

Which metric measures the average time taken to fix a vulnerability after it is identified?

Question 25mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst is creating a risk register. Which of the following is the most important element to include for each risk?

Question 26mediummultiple choice

Read the full Reporting and Communication explanation →

A phishing simulation is conducted, and the click rate is reported to management. What does a high click rate indicate?

Question 27hardmultiple choice

Read the full Reporting and Communication explanation →

An organization's compliance dashboard shows a control effectiveness score of 85%. Which type of evidence best supports this score?

Question 28mediummulti select

Read the full Reporting and Communication explanation →

A security analyst needs to provide threat intelligence to different audiences. Which TWO of the following are appropriate dissemination approaches?

Question 29mediummulti select

Read the full Reporting and Communication explanation →

During a security incident, which THREE elements are critical to include in the incident report for a compliance review?

Question 30hardmulti select

Read the full Reporting and Communication explanation →

An organization is preparing for a compliance audit. Which TWO of the following are essential pieces of evidence to demonstrate effective vulnerability management?

Question 31mediummultiple choice

Read the full Reporting and Communication explanation →

A cybersecurity analyst needs to communicate the risk of a newly discovered vulnerability in a legacy system to the executive leadership. Which approach best translates the technical risk into business risk?

Question 32mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident, the SOC team identifies indicators of compromise (IoCs) related to a new malware strain. Which type of threat intelligence report should be produced for the SOC team to enhance detection?

Question 33easymultiple choice

Read the full Reporting and Communication explanation →

Which metric measures the average time it takes for an organization to identify a security incident from the moment it occurs?

Question 34mediummultiple choice

Read the full Reporting and Communication explanation →

A vulnerability report for a critical application shows that a high-risk vulnerability has been accepted by the business owner. What should the analyst include in the report to document this decision?

Question 35hardmultiple choice

Read the full Reporting and Communication explanation →

During an incident, the security team needs to preserve evidence for potential litigation. Which of the following actions is most critical to ensure the admissibility of digital evidence?

Question 36mediummultiple choice

Read the full Reporting and Communication explanation →

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Question 37easymultiple choice

Read the full Reporting and Communication explanation →

After a phishing simulation, the security team wants to report the results to management. Which metric is most appropriate to include in the report?

Question 38mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst is preparing a vulnerability report for the IT operations team. Which section should provide a high-level overview of the organization's risk posture?

Question 39hardmultiple choice

Read the full Reporting and Communication explanation →

During an incident, the security team discovers that customer personally identifiable information (PII) was exfiltrated. Which of the following notifications must be made according to GDPR?

Question 40easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following is the best example of a Key Performance Indicator (KPI) for patch management?

Question 41mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst needs to present a risk register to a non-technical board. Which of the following formats is most appropriate?

Question 42hardmultiple choice

Read the full Reporting and Communication explanation →

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Question 43mediummulti select

Read the full Reporting and Communication explanation →

A security analyst is preparing an incident report after a ransomware attack. Which two components must be included in the report? (Select TWO.)

Question 44mediummulti select

Read the full Reporting and Communication explanation →

Which three metrics are commonly used to measure the effectiveness of a security operations center (SOC)? (Select THREE.)

Question 45hardmulti select

Read the full Reporting and Communication explanation →

A security analyst is collecting evidence for an upcoming compliance audit. Which three types of evidence are typically required? (Select THREE.)

Question 46mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst discovers a critical vulnerability in a web application that stores customer payment data. The analyst needs to report this to the CISO. Which type of report is most appropriate for communicating the business impact of this vulnerability?

Question 47easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following metrics measures the average time it takes to identify a security incident after it occurs?

Question 48mediummultiple choice

Read the full Reporting and Communication explanation →

An organization is preparing for an audit to demonstrate compliance with GDPR. The compliance officer needs to provide evidence of data protection controls. Which of the following would be the BEST evidence to include?

Question 49hardmultiple choice

Read the full Reporting and Communication explanation →

During a security incident, a SOC analyst identifies that customer PII has been exfiltrated. The company operates in multiple states and processes EU residents' data. Which of the following is the MOST critical immediate communication requirement?

Question 50easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following best describes the purpose of a threat intelligence report at the operational level?

Question 51mediummultiple choice

Read the full Reporting and Communication explanation →

A vulnerability report is presented to the IT manager. The report lists 15 critical, 40 high, 100 medium, and 200 low vulnerabilities. The IT manager asks which vulnerabilities should be prioritized for remediation. According to the vulnerability report structure, which section should the analyst reference?

Question 52hardmultiple choice

Read the full Reporting and Communication explanation →

A security analyst is communicating a complex security risk about a new zero-day vulnerability to the board of directors. The board members have varying technical backgrounds. Which approach would be MOST effective?

Question 53mediummultiple choice

Read the full Reporting and Communication explanation →

An incident report includes a section that details the sequence of events from initial compromise to containment. Which component of the incident report does this describe?

Question 54easymultiple choice

Read the full Reporting and Communication explanation →

Which metric would best indicate the effectiveness of an organization's patch management program?

Question 55mediummultiple choice

Read the full Reporting and Communication explanation →

A SOC manager needs to share threat intelligence with the SOC analysts to help them identify and block malicious activity. Which type of intelligence report is MOST appropriate?

Question 56hardmultiple choice

Read the full Reporting and Communication explanation →

An organization has a risk acceptance process for vulnerabilities that cannot be remediated immediately. Which of the following should be documented in the risk acceptance paperwork?

Question 57mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident, which of the following should be the FIRST communication to internal stakeholders?

Question 58mediummulti select

Read the full Reporting and Communication explanation →

A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)

Question 59hardmulti select

Read the full Reporting and Communication explanation →

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Question 60easymulti select

Read the full Reporting and Communication explanation →

A security analyst is creating metrics for a security dashboard aimed at executive leadership. Which THREE metrics are most appropriate for this audience? (Select THREE.)

Question 61easymultiple choice

Read the full Reporting and Communication explanation →

Which metric is commonly used to measure the average time it takes to identify that a security incident has occurred?

Question 62mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident involving a potential data breach, the CISO asks you to prepare a communication for the board of directors. What is the MOST important aspect to emphasize in this communication?

Question 63hardmultiple choice

Read the full Reporting and Communication explanation →

A vulnerability report is being prepared for an organization's management. Which of the following is the MOST appropriate structure for this report?

Question 64mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst is preparing an after-action report for a phishing incident. Which component is MOST critical to include to prevent recurrence?

Question 65easymultiple choice

Read the full Reporting and Communication explanation →

Which of the following is a key performance indicator (KPI) for measuring the efficiency of patch management?

Question 66mediummultiple choice

Read the full Reporting and Communication explanation →

During a compliance audit, the auditor requests evidence of access reviews. Which of the following would be the MOST appropriate evidence to provide?

Question 67hardmultiple choice

Read the full Reporting and Communication explanation →

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the supervisory authority?

Question 68mediummultiple choice

Read the full Reporting and Communication explanation →

A security analyst receives a threat intelligence report containing detailed Indicators of Compromise (IoCs) such as IP addresses, file hashes, and domain names. What is the MOST appropriate audience for distributing this type of report?

Question 69mediummultiple choice

Read the full Reporting and Communication explanation →

Which of the following BEST describes the purpose of a risk register in the context of reporting and communication?

Question 70hardmultiple choice

Read the full Reporting and Communication explanation →

An organization is preparing evidence for a compliance audit. Which of the following pieces of evidence would BEST demonstrate that a security control is effective?

Question 71mediummultiple choice

Read the full Reporting and Communication explanation →

During an incident, which of the following should be the FIRST priority when communicating with law enforcement?

Question 72easymultiple choice

Read the full Reporting and Communication explanation →

Which type of threat intelligence report is MOST appropriate for a Chief Information Security Officer (CISO) to understand the overall threat landscape and make strategic decisions?

Question 73mediummulti select

Read the full Reporting and Communication explanation →

A security analyst is preparing a vulnerability report for management. Which TWO elements should be included in the executive summary? (Select TWO.)

Question 74mediummulti select

Read the full Reporting and Communication explanation →

An incident responder is documenting the root cause of a data breach. Which THREE components are essential to include in the root cause analysis section of the incident report? (Select THREE.)

Question 75hardmulti select

Read the full Reporting and Communication explanation →

A security analyst is creating a compliance dashboard for a PCI DSS audit. Which THREE metrics should be included to demonstrate compliance with access control requirements? (Select THREE.)

Question 76easymultiple choice

Read the full Reporting and Communication explanation →

A cybersecurity analyst is preparing a report for the executive leadership team. Which type of report is most appropriate for communicating high-level security posture and risk to non-technical stakeholders?

Question 77mediummultiple choice

Read the full Reporting and Communication explanation →

During a security incident, the incident response team has identified that a phishing email led to credential theft and lateral movement. Which component of the incident report should detail the sequence of events from initial compromise to containment?

Question 78hardmultiple choice

Read the full Reporting and Communication explanation →

An organization needs to report a data breach involving personal data of EU residents. Under GDPR, what is the maximum time allowed for notifying the supervisory authority after becoming aware of the breach?

Question 79easymulti select

Read the full Reporting and Communication explanation →

A cybersecurity analyst is building a compliance dashboard for an upcoming audit. Which TWO metrics are most relevant for demonstrating effective patch management? (Select TWO.)

Question 80mediummulti select

Read the full Reporting and Communication explanation →

An analyst is preparing a vulnerability report for management. Which THREE sections should be included to effectively communicate findings and remediation? (Select THREE.)

Question 81mediummulti select

Read the full Reporting and Communication explanation →

During a security incident, a cybersecurity analyst must communicate with various stakeholders. Which TWO are appropriate internal escalation paths? (Select TWO.)

Question 82hardmulti select

Read the full Reporting and Communication explanation →

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Question 83mediummulti select

Read the full Reporting and Communication explanation →

An organization is preparing evidence for an audit of access controls. Which THREE types of evidence should be collected? (Select THREE.)

Question 84hardmulti select

Read the full Reporting and Communication explanation →

A threat intelligence analyst has produced a report containing specific Indicators of Compromise (IoCs) such as IP addresses, domain names, and file hashes. Which TWO audiences are most appropriate for this type of intelligence? (Select TWO.)