CS0-003 Reporting and Communication Practice Test 3 — 15 Questions

Question 1

A cybersecurity analyst needs to communicate the risk of a newly discovered vulnerability in a legacy system to the executive leadership. Which approach best translates the technical risk into business risk?

Accepted Answer

Explain the vulnerability's potential impact on revenue, customer trust, and compliance penalties. Executives care about business impact. Relating the vulnerability to potential financial loss, reputational damage, or regulatory penalties is the most effective way to communicate risk.

Answer

Provide the CVSS score and technical exploit details

Answer

Recommend immediate patching without further justification

Answer

Describe the attack vector and required privileges

Question 2

During a security incident, the SOC team identifies indicators of compromise (IoCs) related to a new malware strain. Which type of threat intelligence report should be produced for the SOC team to enhance detection?

Accepted Answer

Tactical intelligence report with IoCs and detection signatures. Tactical intelligence provides IoCs, TTPs, and actionable details for defenders to detect and mitigate threats.

Answer

Technical intelligence report on malware code analysis

Answer

Strategic intelligence report on global threat trends

Answer

Operational intelligence report on threat actor campaigns

Question 3

Which metric measures the average time it takes for an organization to identify a security incident from the moment it occurs?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the average time to detect an incident.

Answer

Mean Time to Resolve (MTTR)

Answer

Patch SLA compliance percentage

Answer

Mean Time to Remediate (MTTRem)

Question 4

A vulnerability report for a critical application shows that a high-risk vulnerability has been accepted by the business owner. What should the analyst include in the report to document this decision?

Accepted Answer

A formal risk acceptance form signed by the business owner with a justification. Proper risk acceptance documentation requires a formal sign-off by the risk owner, typically including a justification and acceptance date.

Answer

The technical details of the vulnerability only

Answer

An automatic closure of the vulnerability ticket

Answer

A note that the vulnerability is low priority

Question 5

During an incident, the security team needs to preserve evidence for potential litigation. Which of the following actions is most critical to ensure the admissibility of digital evidence?

Accepted Answer

Establishing and maintaining a chain of custody for all evidence. Preserving the chain of custody is essential for evidence admissibility, as it documents who handled the evidence and when.

Answer

Creating a bit-for-bit forensic image of affected systems

Answer

Immediately notifying law enforcement

Answer

Encrypting all evidence files

Question 6

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of awareness.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 7

After a phishing simulation, the security team wants to report the results to management. Which metric is most appropriate to include in the report?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate measures the percentage of users who clicked a simulated phishing link, a key metric for security awareness.

Answer

Total number of employees

Answer

Number of phishing emails blocked at the gateway

Answer

Mean time to detect phishing emails

Question 8

A security analyst is preparing a vulnerability report for the IT operations team. Which section should provide a high-level overview of the organization's risk posture?

Accepted Answer

Executive summary. The executive summary provides a concise overview of key findings and risk posture for management.

Answer

Risk acceptance

Answer

Remediation timeline

Answer

Findings by severity

Question 9

During an incident, the security team discovers that customer personally identifiable information (PII) was exfiltrated. Which of the following notifications must be made according to GDPR?

Accepted Answer

Notify the supervisory authority within 72 hours and affected individuals without undue delay if high risk. Under GDPR, if a breach is likely to result in a high risk to individuals, the organization must notify the affected data subjects without undue delay.

Answer

Notify law enforcement within 48 hours

Answer

Notify all customers within 24 hours

Answer

Notify the data protection officer only

Question 10

Which of the following is the best example of a Key Performance Indicator (KPI) for patch management?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage measures how often patches are applied within the agreed timeline, a key performance indicator.

Answer

Mean time to detect vulnerabilities

Answer

Number of security incidents

Answer

Number of vulnerabilities discovered

Question 11

A security analyst needs to present a risk register to a non-technical board. Which of the following formats is most appropriate?

Accepted Answer

A heat map with risk ratings and business impact descriptions. A risk register with business impact, likelihood, and mitigation status is understandable for non-technical stakeholders.

Answer

A timeline of past incidents

Answer

A list of CVEs with CVSS scores

Answer

A detailed network diagram with vulnerability locations

Question 12

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Accepted Answer

Strategic intelligence. Strategic intelligence reports provide high-level analysis of threats, trends, and risks for decision-makers.

Answer

Technical intelligence

Answer

Tactical intelligence

Answer

Operational intelligence

Question 13

A security analyst is preparing an incident report after a ransomware attack. Which two components must be included in the report? (Select TWO.)

Accepted Answer

Root cause analysis. An incident report should include a timeline of events, impact assessment, root cause, lessons learned, and recommendations. Timeline and root cause are essential.

Answer

Resume of the incident responder

Answer

Marketing department's budget

Answer

Software license keys

Question 14

Which three metrics are commonly used to measure the effectiveness of a security operations center (SOC)? (Select THREE.)

Accepted Answer

Mean Time to Respond (MTTR). MTTD, MTTR, and MTTRem are standard SOC metrics to measure detection and response effectiveness.

Answer

Number of firewall rules

Answer

Number of employees in the SOC

Question 15

A security analyst is collecting evidence for an upcoming compliance audit. Which three types of evidence are typically required? (Select THREE.)

Accepted Answer

Access review documentation. Auditors typically require log exports, vulnerability scan reports, and access reviews to verify controls.

Answer

Employee training attendance records

Answer

Marketing brochures