CS0-003 Reporting and Communication Practice Test 4 — 15 Questions

Question 1

During an incident response, the SOC team identifies a data breach involving customer PII. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a personal data breach.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 2

After a security incident, which component of the incident report provides a chronological sequence of events from detection to recovery?

Accepted Answer

Timeline. The timeline is a critical component that shows the order of events during an incident.

Answer

Lessons learned

Answer

Root cause

Answer

Impact assessment

Question 3

An analyst is creating a compliance dashboard for management. Which of the following is the most relevant metric to include regarding patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance percentage directly measures how well the organization meets patch deadlines, which is a key compliance metric.

Answer

Number of antivirus alerts

Answer

Phishing simulation click rate

Answer

Mean time to detect incidents

Question 4

Which of the following is the primary audience for a strategic threat intelligence report?

Accepted Answer

Executive leadership. Strategic intelligence is high-level and intended for executive leadership to inform business decisions.

Answer

System administrators

Answer

SOC analysts

Answer

Incident responders

Question 5

After a ransomware incident, the incident report includes lessons learned. Which of the following is the BEST example of a lesson learned?

Accepted Answer

Implement multi-factor authentication for remote access to reduce risk.. Lessons learned should be actionable recommendations to prevent recurrence.

Answer

The ransomware encrypted 500 files.

Answer

The incident started at 2:00 AM.

Answer

The root cause was a phishing email.

Question 6

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Accepted Answer

Explain the potential financial loss and reputational damage.. Boards care about business impact, not technical details. Quantifying financial exposure helps them understand urgency.

Answer

Show the CVSS score and exploit complexity.

Answer

Recommend immediate patching without details.

Answer

Describe the vulnerability in technical terms.

Question 7

A cybersecurity analyst is preparing an incident report after a data breach. Which TWO components are essential to include? (Select TWO.)

Accepted Answer

Root cause. Root cause and timeline are standard components of incident reports.

Answer

Budget forecast

Answer

Employee performance review

Answer

Marketing analysis

Question 8

After a security incident involving a ransomware attack, the organization needs to communicate with various stakeholders. Which THREE of the following are appropriate actions? (Select THREE.)

Accepted Answer

Place legal holds on relevant data. Customer notification, law enforcement coordination, and legal holds are key communication steps during incidents.

Answer

Delete all logs to prevent data leakage

Answer

Publish details on social media immediately

Question 9

A security analyst is selecting Key Performance Indicators (KPIs) for a security operations dashboard. Which THREE metrics are most relevant for measuring incident response effectiveness? (Select THREE.)

Accepted Answer

Mean time to detect (MTTD). MTTR measures response time, MTTD measures detection time, and MTTRem measures remediation time. These are key incident response metrics.

Answer

Number of employees

Answer

Revenue growth

Question 10

A security analyst needs to provide threat intelligence to different audiences. Which TWO of the following are appropriate dissemination approaches?

Accepted Answer

Sending tactical intelligence with IoCs to the SOC team. Strategic intelligence for executives helps them understand the threat landscape, while tactical intelligence for SOC teams provides IoCs for detection.

Answer

Publishing operational intelligence on the company intranet

Answer

Discussing classified threat data in public forums

Answer

Sharing raw intelligence feeds with all employees

Question 11

During a security incident, which THREE elements are critical to include in the incident report for a compliance review?

Accepted Answer

Impact assessment. Timeline, impact assessment, and root cause are essential for understanding the incident and meeting compliance requirements. Lessons learned are important for improvement but not always mandatory for compliance; remediation timeline may be separate.

Answer

Lessons learned

Answer

Remediation timeline

Question 12

An organization is preparing for a compliance audit. Which TWO of the following are essential pieces of evidence to demonstrate effective vulnerability management?

Accepted Answer

Vulnerability scan reports. Vulnerability scan reports show identified vulnerabilities, and patch management reports show remediation efforts, together demonstrating the vulnerability management lifecycle.

Answer

Network topology diagrams

Answer

Employee training logs

Answer

Incident response playbooks

Question 13

Which metric measures the average time it takes for an organization to identify a security incident from the moment it occurs?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the average time to detect an incident.

Answer

Mean Time to Resolve (MTTR)

Answer

Patch SLA compliance percentage

Answer

Mean Time to Remediate (MTTRem)

Question 14

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of awareness.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 15

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Accepted Answer

Strategic intelligence. Strategic intelligence reports provide high-level analysis of threats, trends, and risks for decision-makers.

Answer

Technical intelligence

Answer

Tactical intelligence

Answer

Operational intelligence