CS0-003 Reporting and Communication Practice Test 2 — 15 Questions

Question 1

A security analyst is creating a risk register. Which of the following is the most important element to include for each risk?

Accepted Answer

Likelihood and impact rating. A risk register should include risk owner, likelihood, impact, and mitigation status. Likelihood and impact help prioritize risks.

Answer

The exact date the risk was identified

Answer

The name of the person who discovered the risk

Answer

The CVSS score of related vulnerabilities

Question 2

A phishing simulation is conducted, and the click rate is reported to management. What does a high click rate indicate?

Accepted Answer

There is a need for more security awareness training. A high click rate suggests that employees are susceptible to phishing, indicating a need for security awareness training.

Answer

Employees are well-trained in security

Answer

The phishing simulation was not realistic

Answer

The organization has strong technical controls

Question 3

An organization's compliance dashboard shows a control effectiveness score of 85%. Which type of evidence best supports this score?

Accepted Answer

Penetration test results and audit reports. Control effectiveness evidence, such as penetration test results and audit reports, directly demonstrates how well controls are working.

Answer

Incident response logs

Answer

Employee training records

Answer

Vendor documentation

Question 4

A cybersecurity analyst needs to communicate the risk of a newly discovered vulnerability in a legacy system to the executive leadership. Which approach best translates the technical risk into business risk?

Accepted Answer

Explain the vulnerability's potential impact on revenue, customer trust, and compliance penalties. Executives care about business impact. Relating the vulnerability to potential financial loss, reputational damage, or regulatory penalties is the most effective way to communicate risk.

Answer

Provide the CVSS score and technical exploit details

Answer

Recommend immediate patching without further justification

Answer

Describe the attack vector and required privileges

Question 5

During a security incident, the SOC team identifies indicators of compromise (IoCs) related to a new malware strain. Which type of threat intelligence report should be produced for the SOC team to enhance detection?

Accepted Answer

Tactical intelligence report with IoCs and detection signatures. Tactical intelligence provides IoCs, TTPs, and actionable details for defenders to detect and mitigate threats.

Answer

Technical intelligence report on malware code analysis

Answer

Strategic intelligence report on global threat trends

Answer

Operational intelligence report on threat actor campaigns

Question 6

A vulnerability report for a critical application shows that a high-risk vulnerability has been accepted by the business owner. What should the analyst include in the report to document this decision?

Accepted Answer

A formal risk acceptance form signed by the business owner with a justification. Proper risk acceptance documentation requires a formal sign-off by the risk owner, typically including a justification and acceptance date.

Answer

The technical details of the vulnerability only

Answer

An automatic closure of the vulnerability ticket

Answer

A note that the vulnerability is low priority

Question 7

During an incident, the security team needs to preserve evidence for potential litigation. Which of the following actions is most critical to ensure the admissibility of digital evidence?

Accepted Answer

Establishing and maintaining a chain of custody for all evidence. Preserving the chain of custody is essential for evidence admissibility, as it documents who handled the evidence and when.

Answer

Creating a bit-for-bit forensic image of affected systems

Answer

Immediately notifying law enforcement

Answer

Encrypting all evidence files

Question 8

After a phishing simulation, the security team wants to report the results to management. Which metric is most appropriate to include in the report?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate measures the percentage of users who clicked a simulated phishing link, a key metric for security awareness.

Answer

Total number of employees

Answer

Number of phishing emails blocked at the gateway

Answer

Mean time to detect phishing emails

Question 9

A security analyst is preparing a vulnerability report for the IT operations team. Which section should provide a high-level overview of the organization's risk posture?

Accepted Answer

Executive summary. The executive summary provides a concise overview of key findings and risk posture for management.

Answer

Risk acceptance

Answer

Remediation timeline

Answer

Findings by severity

Question 10

During an incident, the security team discovers that customer personally identifiable information (PII) was exfiltrated. Which of the following notifications must be made according to GDPR?

Accepted Answer

Notify the supervisory authority within 72 hours and affected individuals without undue delay if high risk. Under GDPR, if a breach is likely to result in a high risk to individuals, the organization must notify the affected data subjects without undue delay.

Answer

Notify law enforcement within 48 hours

Answer

Notify all customers within 24 hours

Answer

Notify the data protection officer only

Question 11

Which of the following is the best example of a Key Performance Indicator (KPI) for patch management?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage measures how often patches are applied within the agreed timeline, a key performance indicator.

Answer

Mean time to detect vulnerabilities

Answer

Number of security incidents

Answer

Number of vulnerabilities discovered

Question 12

A security analyst needs to present a risk register to a non-technical board. Which of the following formats is most appropriate?

Accepted Answer

A heat map with risk ratings and business impact descriptions. A risk register with business impact, likelihood, and mitigation status is understandable for non-technical stakeholders.

Answer

A timeline of past incidents

Answer

A list of CVEs with CVSS scores

Answer

A detailed network diagram with vulnerability locations

Question 13

A security analyst discovers a critical vulnerability in a web application that stores customer payment data. The analyst needs to report this to the CISO. Which type of report is most appropriate for communicating the business impact of this vulnerability?

Accepted Answer

Executive dashboard highlighting financial risk and regulatory penalties. An executive dashboard provides high-level metrics and business impact summaries suitable for non-technical stakeholders like the CISO.

Answer

Compliance report showing PCI DSS control status

Answer

Technical vulnerability report with CVSS scores and proof of concept

Answer

Incident report detailing steps to exploit

Question 14

An organization is preparing for an audit to demonstrate compliance with GDPR. The compliance officer needs to provide evidence of data protection controls. Which of the following would be the BEST evidence to include?

Accepted Answer

Copies of recent vulnerability scan reports and access review logs. Log exports, configuration reports, vulnerability scans, and access reviews are typical evidence for GDPR audits.

Answer

The organization's risk register

Answer

Email communications about security incidents

Answer

A summary of security policies and procedures

Question 15

During a security incident, a SOC analyst identifies that customer PII has been exfiltrated. The company operates in multiple states and processes EU residents' data. Which of the following is the MOST critical immediate communication requirement?

Accepted Answer

Notify the relevant data protection authority within 72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a breach involving personal data.

Answer

Notify law enforcement within 24 hours

Answer

Notify affected customers within 48 hours

Answer

Issue a press release within 24 hours