CS0-003 Reporting and Communication Practice Test 3 — 15 Questions

Question 1

An organization's compliance dashboard shows a control effectiveness score of 85%. Which type of evidence best supports this score?

Accepted Answer

Penetration test results and audit reports. A control effectiveness score of 85% reflects how well implemented controls are actually performing against their intended objectives. Penetration test results and audit reports provide direct, independent evidence of whether controls are functioning as designed—pen tests actively attempt to bypass controls, while audits verify their operational status. These sources offer the most objective and comprehensive validation of control effectiveness, making them the best evidence to support such a score.

Answer

Incident response logs

Answer

Employee training records

Answer

Vendor documentation

Question 2

A security analyst needs to provide threat intelligence to different audiences. Which TWO of the following are appropriate dissemination approaches?

Accepted Answer

Sending tactical intelligence with IoCs to the SOC team. Option A is correct because tactical intelligence, which includes indicators of compromise (IoCs) such as IP addresses, hashes, and domains, is most actionable for the SOC team that monitors and responds to incidents in real time. Option E is correct because strategic intelligence reports are high-level, business-oriented summaries of threat trends and risks that help executives make informed decisions about security investments and risk posture. Option B is not appropriate because operational intelligence typically contains sensitive details about ongoing campaigns or adversary activity and should be shared only with authorized operational staff, not published broadly on the intranet. Option C is wrong because discussing classified threat data in public forums would cause unauthorized disclosure and violate classification and confidentiality requirements. Option D is wrong because sharing raw intelligence feeds with all employees exposes unvetted, potentially sensitive data to people without the need or training to interpret it, increasing risk of misuse or leakage.

Answer

Publishing operational intelligence on the company intranet

Answer

Discussing classified threat data in public forums

Answer

Sharing raw intelligence feeds with all employees

Question 3

An organization is preparing for a compliance audit. Which TWO of the following are essential pieces of evidence to demonstrate effective vulnerability management?

Accepted Answer

Vulnerability scan reports. Vulnerability scan reports (C) are essential evidence because they document the identification of vulnerabilities across the environment, showing when scans were performed, what hosts were assessed, and which CVEs or findings were detected, which is the core proof that a vulnerability management program is actively discovering weaknesses. Patch management reports (D) are equally essential because they demonstrate remediation—showing that identified vulnerabilities were addressed through applied updates, with dates, affected systems, and patch levels (e.g., KB numbers or package versions), closing the loop between detection and resolution. Together, C and D provide the audit trail of find-and-fix that auditors require to verify an effective vulnerability management process. Network topology diagrams (A) describe architecture but do not evidence scanning or remediation activity. Employee training logs (B) support security awareness compliance, not vulnerability management specifically. Incident response playbooks (E) are documentation for handling incidents and do not demonstrate ongoing vulnerability identification or patching.

Answer

Network topology diagrams

Answer

Employee training logs

Answer

Incident response playbooks

Question 4

A cybersecurity analyst needs to communicate the risk of a newly discovered vulnerability in a legacy system to the executive leadership. Which approach best translates the technical risk into business risk?

Accepted Answer

Explain the vulnerability's potential impact on revenue, customer trust, and compliance penalties. Executives care about business impact. Relating the vulnerability to potential financial loss, reputational damage, or regulatory penalties is the most effective way to communicate risk.

Answer

Provide the CVSS score and technical exploit details

Answer

Recommend immediate patching without further justification

Answer

Describe the attack vector and required privileges

Question 5

During a security incident, the SOC team identifies indicators of compromise (IoCs) related to a new malware strain. Which type of threat intelligence report should be produced for the SOC team to enhance detection?

Accepted Answer

Tactical intelligence report with IoCs and detection signatures. Tactical threat intelligence focuses on immediate, actionable indicators such as file hashes, IP addresses, domain names, and YARA rules that SOC analysts can directly load into SIEM, IDS/IPS, or endpoint detection tools to enhance detection. Since the SOC team needs to detect the new malware strain, a tactical report with IoCs and detection signatures provides the specific technical artifacts required for signature-based and anomaly-based detection. This type of intelligence is consumed at the analyst level and is designed for machine-readable consumption, enabling rapid deployment of detection logic.

Answer

Technical intelligence report on malware code analysis

Answer

Strategic intelligence report on global threat trends

Answer

Operational intelligence report on threat actor campaigns

Question 6

Which metric measures the average time it takes for an organization to identify a security incident from the moment it occurs?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the average time to detect an incident.

Answer

Mean Time to Resolve (MTTR)

Answer

Patch SLA compliance percentage

Answer

Mean Time to Remediate (MTTRem)

Question 7

A vulnerability report for a critical application shows that a high-risk vulnerability has been accepted by the business owner. What should the analyst include in the report to document this decision?

Accepted Answer

A formal risk acceptance form signed by the business owner with a justification. Proper risk acceptance documentation requires a formal sign-off by the risk owner, typically including a justification and acceptance date.

Answer

The technical details of the vulnerability only

Answer

An automatic closure of the vulnerability ticket

Answer

A note that the vulnerability is low priority

Question 8

During an incident, the security team needs to preserve evidence for potential litigation. Which of the following actions is most critical to ensure the admissibility of digital evidence?

Accepted Answer

Establishing and maintaining a chain of custody for all evidence. Preserving the chain of custody is essential for evidence admissibility, as it documents who handled the evidence and when.

Answer

Creating a bit-for-bit forensic image of affected systems

Answer

Immediately notifying law enforcement

Answer

Encrypting all evidence files

Question 9

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Accepted Answer

72 hours. Under GDPR Article 33, organizations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is a core GDPR compliance requirement. The other timeframes do not match the regulation.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 10

After a phishing simulation, the security team wants to report the results to management. Which metric is most appropriate to include in the report?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate measures the percentage of users who clicked a simulated phishing link, a key metric for security awareness.

Answer

Total number of employees

Answer

Number of phishing emails blocked at the gateway

Answer

Mean time to detect phishing emails

Question 11

A security analyst is preparing a vulnerability report for the IT operations team. Which section should provide a high-level overview of the organization's risk posture?

Accepted Answer

Executive summary. The executive summary provides a concise overview of key findings and risk posture for management.

Answer

Risk acceptance

Answer

Remediation timeline

Answer

Findings by severity

Question 12

During an incident, the security team discovers that customer personally identifiable information (PII) was exfiltrated. Which of the following notifications must be made according to GDPR?

Accepted Answer

Notify the supervisory authority within 72 hours and affected individuals without undue delay if high risk. Under GDPR, if a breach is likely to result in a high risk to individuals, the organization must notify the affected data subjects without undue delay.

Answer

Notify law enforcement within 48 hours

Answer

Notify all customers within 24 hours

Answer

Notify the data protection officer only

Question 13

Which of the following is the best example of a Key Performance Indicator (KPI) for patch management?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage measures how often patches are applied within the agreed timeline, a key performance indicator.

Answer

Mean time to detect vulnerabilities

Answer

Number of security incidents

Answer

Number of vulnerabilities discovered

Question 14

A security analyst needs to present a risk register to a non-technical board. Which of the following formats is most appropriate?

Accepted Answer

A heat map with risk ratings and business impact descriptions. A heat map with risk ratings and business impact descriptions is most appropriate for a non-technical board because it visually communicates risk severity and business consequences without requiring technical expertise. It translates technical risks into business terms, facilitating informed decision-making.

Answer

A timeline of past incidents

Answer

A list of CVEs with CVSS scores

Answer

A detailed network diagram with vulnerability locations

Question 15

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Accepted Answer

Strategic intelligence. Strategic threat intelligence focuses on high-level, long-term trends, adversary motivations, and geopolitical or business risks — exactly what senior executives need for decision-making and risk budgeting. It is typically delivered as reports or briefings rather than raw indicators, and it informs strategic planning over quarters or years. Technical, tactical, and operational intelligence are all more granular and operational in nature.

Answer

Technical intelligence

Answer

Tactical intelligence

Answer

Operational intelligence