CS0-003 Reporting and Communication Practice Test 4 — 15 Questions

Question 1

A security analyst discovers a critical vulnerability in a web application that stores customer payment data. The analyst needs to report this to the CISO. Which type of report is most appropriate for communicating the business impact of this vulnerability?

Accepted Answer

Executive dashboard highlighting financial risk and regulatory penalties. An executive dashboard provides high-level metrics and business impact summaries suitable for non-technical stakeholders like the CISO.

Answer

Compliance report showing PCI DSS control status

Answer

Technical vulnerability report with CVSS scores and proof of concept

Answer

Incident report detailing steps to exploit

Question 2

Which of the following metrics measures the average time it takes to identify a security incident after it occurs?

Accepted Answer

Mean time to detect (MTTD). MTTD is specifically defined as the average time to detect an incident.

Answer

Patch SLA compliance percentage

Answer

Mean time to remediate (MTTRem)

Answer

Mean time to respond (MTTR)

Question 3

An organization is preparing for an audit to demonstrate compliance with GDPR. The compliance officer needs to provide evidence of data protection controls. Which of the following would be the BEST evidence to include?

Accepted Answer

Copies of recent vulnerability scan reports and access review logs. Log exports, configuration reports, vulnerability scans, and access reviews are typical evidence for GDPR audits.

Answer

The organization's risk register

Answer

Email communications about security incidents

Answer

A summary of security policies and procedures

Question 4

During a security incident, a SOC analyst identifies that customer PII has been exfiltrated. The company operates in multiple states and processes EU residents' data. Which of the following is the MOST critical immediate communication requirement?

Accepted Answer

Notify the relevant data protection authority within 72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a breach involving personal data.

Answer

Notify law enforcement within 24 hours

Answer

Notify affected customers within 48 hours

Answer

Issue a press release within 24 hours

Question 5

Which of the following best describes the purpose of a threat intelligence report at the operational level?

Accepted Answer

Offer detailed analysis of threat actor TTPs for specific campaigns. Operational intelligence focuses on specific campaigns, tools, and techniques to inform defenders' actions.

Answer

Deliver technical indicators like IoCs to SOC analysts

Answer

Provide high-level trends to executive leadership

Answer

Summarize geopolitical risks affecting the organization

Question 6

A vulnerability report is presented to the IT manager. The report lists 15 critical, 40 high, 100 medium, and 200 low vulnerabilities. The IT manager asks which vulnerabilities should be prioritized for remediation. According to the vulnerability report structure, which section should the analyst reference?

Accepted Answer

Findings by severity. Findings by severity provides a breakdown of vulnerabilities by criticality, guiding prioritization.

Answer

Executive summary

Answer

Remediation timeline

Answer

Risk acceptance

Question 7

A security analyst is communicating a complex security risk about a new zero-day vulnerability to the board of directors. The board members have varying technical backgrounds. Which approach would be MOST effective?

Accepted Answer

Describe the potential financial loss, reputational damage, and regulatory fines. Translating technical risk to business impact (financial, reputational, regulatory) is key for non-technical stakeholders.

Answer

Provide a list of all current vulnerabilities

Answer

Present the CVSS score and affected systems

Answer

Explain the technical details of the exploit chain

Question 8

An incident report includes a section that details the sequence of events from initial compromise to containment. Which component of the incident report does this describe?

Accepted Answer

Timeline. The timeline component chronologically documents the incident's progression.

Answer

Impact assessment

Answer

Root cause

Answer

Lessons learned

Question 9

Which metric would best indicate the effectiveness of an organization's patch management program?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage directly measures how often patches are applied within required timeframes.

Answer

Phishing simulation click rates

Answer

Open vulnerability counts by severity

Answer

Mean time to detect (MTTD)

Question 10

A SOC manager needs to share threat intelligence with the SOC analysts to help them identify and block malicious activity. Which type of intelligence report is MOST appropriate?

Accepted Answer

Tactical intelligence report. Tactical intelligence provides technical indicators like IoCs, which SOC analysts use for detection and blocking.

Answer

Operational intelligence report

Answer

Technical intelligence report

Answer

Strategic intelligence report

Question 11

An organization has a risk acceptance process for vulnerabilities that cannot be remediated immediately. Which of the following should be documented in the risk acceptance paperwork?

Accepted Answer

Compensating controls, business justification, and expiration date. Risk acceptance documentation should include compensating controls, business justification, and an expiration date or review period.

Answer

The name of the person who discovered the vulnerability

Answer

The patch details and installation instructions

Answer

The CVSS score and exploitability

Question 12

During a security incident, which of the following should be the FIRST communication to internal stakeholders?

Accepted Answer

Internal escalation to the incident response team. Internal escalation procedures dictate notifying the incident response team and relevant management first.

Answer

Notification to law enforcement

Answer

Press release to customers

Answer

Update to the risk register

Question 13

A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)

Accepted Answer

Recent access review reports. Access review reports and user account audit logs directly demonstrate access control implementation.

Answer

A network topology diagram

Answer

A list of all employees

Answer

The company's password policy

Question 14

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Accepted Answer

Notify all affected data subjects without undue delay if high risk. GDPR requires notification to the supervisory authority within 72 hours, documentation of the breach, and notification to affected individuals if high risk.

Answer

Publish a public notice in the local newspaper

Answer

Notify law enforcement within 24 hours

Question 15

A security analyst is creating metrics for a security dashboard aimed at executive leadership. Which THREE metrics are most appropriate for this audience? (Select THREE.)

Accepted Answer

Phishing simulation click rates. Executives prefer high-level metrics that show overall security posture, trends, and business impact.

Answer

Vulnerability scan details for individual hosts

Answer

Firewall rule change request logs