CS0-003 Reporting and Communication Practice Test 2 — 15 Questions

Question 1

Which of the following is a key component of a vulnerability report that provides a high-level overview for management?

Accepted Answer

Executive summary. The executive summary condenses findings for management to quickly understand the state of vulnerabilities.

Answer

Remediation timeline

Answer

Findings by severity

Answer

Risk acceptance

Question 2

A cybersecurity analyst is preparing an incident report after a data breach. Which TWO components are essential to include? (Select TWO.)

Accepted Answer

Root cause. Option A (Root cause) is correct because an incident report must document the underlying vulnerability or failure that enabled the breach, such as an unpatched CVE, misconfigured firewall rule, or successful phishing vector, so remediation can prevent recurrence. Option B (Timeline) is correct because a chronological sequence of events—initial compromise, detection, containment, and eradication timestamps—establishes scope, supports forensic reconstruction, and satisfies regulatory/audit requirements. The unmarked options do not belong: budget forecast (C) is a financial planning artifact, employee performance review (D) is an HR matter, and marketing analysis (E) is unrelated to security incident documentation.

Answer

Budget forecast

Answer

Employee performance review

Answer

Marketing analysis

Question 3

After a security incident involving a ransomware attack, the organization needs to communicate with various stakeholders. Which THREE of the following are appropriate actions? (Select THREE.)

Accepted Answer

Place legal holds on relevant data. Option A is correct because placing legal holds on relevant data preserves logs, backups, and affected systems as potential evidence for forensic investigation, regulatory inquiries, and possible litigation, preventing routine deletion or overwriting. Option D is correct because coordinating with law enforcement (e.g., FBI, Secret Service, or local cybercrime units) is a standard incident-response step that supports evidence handling, threat attribution, and may be legally required or beneficial for the organization. Option E is correct because notifying affected customers as required by law satisfies breach-notification obligations under regulations such as GDPR, HIPAA, or state data-breach statutes, which mandate timely disclosure when personal or protected data is compromised. Option B is not appropriate because deleting logs destroys forensic evidence, violates legal-hold and retention requirements, and impedes incident investigation. Option C is not appropriate because publishing details on social media immediately can compromise the investigation, leak sensitive information, and should instead be handled through a coordinated, approved communications plan.

Answer

Delete all logs to prevent data leakage

Answer

Publish details on social media immediately

Question 4

A security analyst is selecting Key Performance Indicators (KPIs) for a security operations dashboard. Which THREE metrics are most relevant for measuring incident response effectiveness? (Select THREE.)

Accepted Answer

Mean time to detect (MTTD). Option B, Mean time to detect (MTTD), is correct because it directly measures how quickly the security operations team identifies a potential incident from the moment it occurs, which is a core indicator of detection capability and monitoring effectiveness. Option C, Mean time to remediate (MTTRem), is correct because it quantifies the time required to fully resolve or contain an incident after detection, reflecting the team's ability to restore normal operations and limit business impact. Option E, Mean time to respond (MTTR), is correct because it measures the elapsed time from detection to the start of active response actions, showing how promptly analysts engage with and begin handling a confirmed incident. Option A, Number of employees, is not a security operations performance metric and does not reflect incident response effectiveness. Option D, Revenue growth, is a business financial metric unrelated to the speed or quality of incident detection, response, or remediation.

Answer

Number of employees

Answer

Revenue growth

Question 5

A cybersecurity analyst is preparing a vulnerability report for the IT manager. Which section should summarize the most critical risks for the organization?

Accepted Answer

Executive summary. The executive summary provides a high-level overview of the most critical risks and recommended actions for management.

Answer

Remediation timeline

Answer

Risk acceptance

Answer

Findings by severity

Question 6

During a security incident, a CySA+ analyst needs to communicate the status to the CISO. Which type of report is most appropriate for this purpose?

Accepted Answer

Executive dashboard. An executive dashboard provides a high-level, real-time view of key metrics and incident status suitable for executive communication.

Answer

Technical report with packet captures

Answer

Vulnerability scan report

Answer

Threat intelligence feed

Question 7

An analyst is evaluating the performance of the security operations center (SOC). Which metric best indicates the team's ability to contain an active threat?

Accepted Answer

Mean time to respond (MTTR). Mean Time to Respond (MTTR) measures the average time taken to contain and remediate an incident, directly reflecting containment speed.

Answer

Mean time to detect (MTTD)

Answer

Patch SLA compliance %

Answer

Open vulnerability counts by severity

Question 8

A security analyst must present a risk assessment to the board of directors. Which approach is most effective for communicating technical risks?

Accepted Answer

Translate technical risk into business impact. Translating technical risks into business impact (e.g., financial, reputational) helps non-technical stakeholders understand and prioritize risks.

Answer

Focus solely on CVSS scores

Answer

Provide raw log data

Answer

Use technical jargon to demonstrate expertise

Question 9

A company experiences a data breach involving personal data of EU citizens. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a breach.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 10

Which component of an incident report describes the sequence of events from detection to resolution?

Accepted Answer

Timeline. The timeline (also called the chronology or sequence of events) is the section of an incident report that documents the chronological order of activities from initial detection through containment, eradication, recovery, and closure. It provides a factual, time-stamped record that allows responders and reviewers to reconstruct exactly what happened and when. This is distinct from root cause analysis, which explains why the incident occurred, and from impact assessment, which quantifies the damage or business effect.

Answer

Root cause

Answer

Impact assessment

Answer

Lessons learned

Question 11

An analyst needs to collect evidence for a compliance audit. Which type of evidence is most appropriate to demonstrate that access reviews are performed regularly?

Accepted Answer

Access review reports. Access review reports serve as direct evidence that reviews are conducted, showing dates and outcomes.

Answer

Vulnerability scan reports

Answer

Configuration backups

Answer

Log exports of user activity

Question 12

During an incident, the SOC team identifies indicators of compromise (IoCs) that may affect partners. According to best practices, what should the analyst do first?

Accepted Answer

Follow the incident response communication plan. An incident response plan should define communication procedures; typically, the team should escalate internally to leadership who can authorize external notifications.

Answer

Wait until the incident is fully resolved

Answer

Post the IoCs on a public threat sharing platform

Answer

Directly notify all affected partners

Question 13

Which metric measures the average time taken to fix a vulnerability after it is identified?

Accepted Answer

Mean time to remediate (MTTRem). Mean time to remediate (MTTRem) is defined as the average elapsed time between when a vulnerability is identified and when it is fully remediated (patched, mitigated, or accepted with compensating controls). This matches the question's wording exactly — identification to fix.

Answer

Mean time to detect (MTTD)

Answer

Mean time to respond (MTTR)

Answer

Patch SLA compliance %

Question 14

A security analyst is creating a risk register. Which of the following is the most important element to include for each risk?

Accepted Answer

Likelihood and impact rating. A risk register should include risk owner, likelihood, impact, and mitigation status. Likelihood and impact help prioritize risks.

Answer

The exact date the risk was identified

Answer

The name of the person who discovered the risk

Answer

The CVSS score of related vulnerabilities

Question 15

A phishing simulation is conducted, and the click rate is reported to management. What does a high click rate indicate?

Accepted Answer

There is a need for more security awareness training. A high click rate suggests that employees are susceptible to phishing, indicating a need for security awareness training.

Answer

Employees are well-trained in security

Answer

The phishing simulation was not realistic

Answer

The organization has strong technical controls