CS0-003 Reporting and Communication Practice Test 3 — 15 Questions

Question 1

A vulnerability report is presented to the IT manager. The report lists 15 critical, 40 high, 100 medium, and 200 low vulnerabilities. The IT manager asks which vulnerabilities should be prioritized for remediation. According to the vulnerability report structure, which section should the analyst reference?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Findings by severity. Findings by severity provides a breakdown of vulnerabilities by criticality, guiding prioritization.

Answer

Executive summary

Answer

Remediation timeline

Answer

Risk acceptance

Question 2

A SOC manager needs to share threat intelligence with the SOC analysts to help them identify and block malicious activity. Which type of intelligence report is MOST appropriate?

Accepted Answer

Tactical intelligence report. Tactical intelligence provides technical indicators like IoCs, which SOC analysts use for detection and blocking.

Answer

Operational intelligence report

Answer

Technical intelligence report

Answer

Strategic intelligence report

Question 3

An organization has a risk acceptance process for vulnerabilities that cannot be remediated immediately. Which of the following should be documented in the risk acceptance paperwork?

Accepted Answer

Compensating controls, business justification, and expiration date. Risk acceptance documentation should include compensating controls, business justification, and an expiration date or review period.

Answer

The name of the person who discovered the vulnerability

Answer

The patch details and installation instructions

Answer

The CVSS score and exploitability

Question 4

Which metric is commonly used to measure the average time it takes to identify that a security incident has occurred?

Accepted Answer

MTTD (Mean Time to Detect). Mean Time to Detect (MTTD) measures the average time between the start of an incident and its detection. It is a key metric for evaluating the effectiveness of monitoring and detection capabilities.

Answer

MTTRem (Mean Time to Remediate)

Answer

MTTR (Mean Time to Respond)

Answer

Patch SLA Compliance %

Question 5

A vulnerability report is being prepared for an organization's management. Which of the following is the MOST appropriate structure for this report?

Accepted Answer

Executive summary, findings by severity, risk acceptance, remediation timeline. A standard vulnerability report includes an executive summary for high-level decision-makers, findings grouped by severity, risk acceptance decisions, and a remediation timeline.

Answer

Charts showing open vulnerability counts over time, without any narrative

Answer

List of all vulnerabilities sorted by CVSS score, followed by detailed technical descriptions

Answer

Network diagram with vulnerability locations, patch status, and compliance checklists

Question 6

A security analyst is preparing an after-action report for a phishing incident. Which component is MOST critical to include to prevent recurrence?

Accepted Answer

Lessons learned and recommendations. Lessons learned identify what went well and what did not, and provide actionable recommendations to improve processes and prevent similar incidents.

Answer

Timeline of the incident

Answer

Impact assessment

Answer

Root cause analysis

Question 7

Which of the following is a key performance indicator (KPI) for measuring the efficiency of patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance percentage measures how often patches are applied within the defined service level agreement, indicating the effectiveness of patch management processes.

Answer

Mean time to respond (MTTR)

Answer

Number of open vulnerabilities

Answer

Phishing simulation click rate

Question 8

During a compliance audit, the auditor requests evidence of access reviews. Which of the following would be the MOST appropriate evidence to provide?

Accepted Answer

Completed access review sign-off sheets with manager approvals. Access review documentation, such as sign-off sheets or reports showing review and approval of user access rights, directly demonstrates that periodic access reviews are conducted.

Answer

Vulnerability scan reports

Answer

A list of all user accounts and their creation dates

Answer

Logs of successful and failed login attempts

Question 9

A security analyst receives a threat intelligence report containing detailed Indicators of Compromise (IoCs) such as IP addresses, file hashes, and domain names. What is the MOST appropriate audience for distributing this type of report?

Accepted Answer

The Security Operations Center (SOC) team. Tactical intelligence, such as IoCs, is most useful for frontline technical teams like the SOC, who can use it to detect and block threats. Executives typically receive strategic intelligence.

Answer

External auditors

Answer

All employees in the organization

Answer

Senior executives and the board of directors

Question 10

Which of the following BEST describes the purpose of a risk register in the context of reporting and communication?

Accepted Answer

To provide a structured way to track identified risks, their likelihood, impact, and mitigation actions. A risk register is a central document that captures identified risks, their assessments, mitigation plans, and status. It supports ongoing risk management and communication to stakeholders.

Answer

To document vulnerabilities found during scans

Answer

To record all security incidents and their outcomes

Answer

To list compliance requirements and deadlines

Question 11

An organization is preparing evidence for a compliance audit. Which of the following pieces of evidence would BEST demonstrate that a security control is effective?

Accepted Answer

A control effectiveness report with test results and metrics. To demonstrate control effectiveness, evidence should show that the control is operating as intended. A control effectiveness report that includes testing results and metrics directly demonstrates effectiveness.

Answer

A screenshot of the control configuration

Answer

A policy document describing the control

Answer

An email from the system owner stating the control is working

Question 12

During an incident, which of the following should be the FIRST priority when communicating with law enforcement?

Accepted Answer

Coordinating evidence collection and preservation. Law enforcement may need to preserve evidence for legal proceedings. Coordination ensures that evidence is handled properly and that the organization does not inadvertently destroy or compromise evidence.

Answer

Sharing the incident response plan

Answer

Requesting a warrant for internal investigation

Answer

Providing a list of affected customers

Question 13

Which type of threat intelligence report is MOST appropriate for a Chief Information Security Officer (CISO) to understand the overall threat landscape and make strategic decisions?

Accepted Answer

Strategic intelligence. Strategic intelligence provides high-level analysis of threats, trends, and risks that impact business decisions. It is designed for senior management and executives.

Answer

Operational intelligence

Answer

Technical intelligence

Answer

Tactical intelligence

Question 14

A cybersecurity analyst is preparing a report for the executive leadership team. Which type of report is most appropriate for communicating high-level security posture and risk to non-technical stakeholders?

Accepted Answer

Executive dashboard. Executive dashboards provide a high-level overview of security posture, using metrics and visualizations that are easily understood by non-technical stakeholders. Technical reports are too detailed.

Answer

Threat intelligence feed

Answer

Technical vulnerability report

Answer

Incident response playbook

Question 15

During a security incident, the incident response team has identified that a phishing email led to credential theft and lateral movement. Which component of the incident report should detail the sequence of events from initial compromise to containment?

Accepted Answer

Timeline. The timeline component of an incident report provides a chronological sequence of events, which is essential for understanding how the incident unfolded.

Answer

Root cause analysis

Answer

Impact assessment

Answer

Lessons learned