CS0-003 Reporting and Communication Practice Test 5 — 15 Questions

Question 1

A security analyst is preparing an incident report after a ransomware attack. Which two components must be included in the report? (Select TWO.)

Accepted Answer

Root cause analysis. An incident report should include a timeline of events, impact assessment, root cause, lessons learned, and recommendations. Timeline and root cause are essential.

Answer

Resume of the incident responder

Answer

Marketing department's budget

Answer

Software license keys

Question 2

Which three metrics are commonly used to measure the effectiveness of a security operations center (SOC)? (Select THREE.)

Accepted Answer

Mean Time to Respond (MTTR). MTTD, MTTR, and MTTRem are standard SOC metrics to measure detection and response effectiveness.

Answer

Number of firewall rules

Answer

Number of employees in the SOC

Question 3

A security analyst is collecting evidence for an upcoming compliance audit. Which three types of evidence are typically required? (Select THREE.)

Accepted Answer

Access review documentation. Auditors typically require log exports, vulnerability scan reports, and access reviews to verify controls.

Answer

Employee training attendance records

Answer

Marketing brochures

Question 4

Which of the following metrics measures the average time it takes to identify a security incident after it occurs?

Accepted Answer

Mean time to detect (MTTD). MTTD is specifically defined as the average time to detect an incident.

Answer

Patch SLA compliance percentage

Answer

Mean time to remediate (MTTRem)

Answer

Mean time to respond (MTTR)

Question 5

Which of the following best describes the purpose of a threat intelligence report at the operational level?

Accepted Answer

Offer detailed analysis of threat actor TTPs for specific campaigns. Operational intelligence focuses on specific campaigns, tools, and techniques to inform defenders' actions.

Answer

Deliver technical indicators like IoCs to SOC analysts

Answer

Provide high-level trends to executive leadership

Answer

Summarize geopolitical risks affecting the organization

Question 6

A security analyst is communicating a complex security risk about a new zero-day vulnerability to the board of directors. The board members have varying technical backgrounds. Which approach would be MOST effective?

Accepted Answer

Describe the potential financial loss, reputational damage, and regulatory fines. Translating technical risk to business impact (financial, reputational, regulatory) is key for non-technical stakeholders.

Answer

Provide a list of all current vulnerabilities

Answer

Present the CVSS score and affected systems

Answer

Explain the technical details of the exploit chain

Question 7

An incident report includes a section that details the sequence of events from initial compromise to containment. Which component of the incident report does this describe?

Accepted Answer

Timeline. The timeline component chronologically documents the incident's progression.

Answer

Impact assessment

Answer

Root cause

Answer

Lessons learned

Question 8

Which metric would best indicate the effectiveness of an organization's patch management program?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage directly measures how often patches are applied within required timeframes.

Answer

Phishing simulation click rates

Answer

Open vulnerability counts by severity

Answer

Mean time to detect (MTTD)

Question 9

During a security incident, which of the following should be the FIRST communication to internal stakeholders?

Accepted Answer

Internal escalation to the incident response team. Internal escalation procedures dictate notifying the incident response team and relevant management first.

Answer

Notification to law enforcement

Answer

Press release to customers

Answer

Update to the risk register

Question 10

A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)

Accepted Answer

Recent access review reports. Access review reports and user account audit logs directly demonstrate access control implementation.

Answer

A network topology diagram

Answer

A list of all employees

Answer

The company's password policy

Question 11

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Accepted Answer

Notify all affected data subjects without undue delay if high risk. GDPR requires notification to the supervisory authority within 72 hours, documentation of the breach, and notification to affected individuals if high risk.

Answer

Publish a public notice in the local newspaper

Answer

Notify law enforcement within 24 hours

Question 12

A security analyst is creating metrics for a security dashboard aimed at executive leadership. Which THREE metrics are most appropriate for this audience? (Select THREE.)

Accepted Answer

Phishing simulation click rates. Executives prefer high-level metrics that show overall security posture, trends, and business impact.

Answer

Vulnerability scan details for individual hosts

Answer

Firewall rule change request logs

Question 13

During a security incident involving a potential data breach, the CISO asks you to prepare a communication for the board of directors. What is the MOST important aspect to emphasize in this communication?

Accepted Answer

The financial impact, reputational risk, and potential regulatory penalties. Board members are non-technical stakeholders who need to understand the business impact. The communication should translate technical details into financial, reputational, and regulatory consequences.

Answer

The specific malware used and its technical attributes

Answer

The names of the IT staff who first detected the incident

Answer

A step-by-step timeline of the incident response actions taken so far

Question 14

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires that data breaches be reported to the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Answer

24 hours

Answer

7 days

Answer

48 hours

Question 15

A security analyst is preparing a vulnerability report for management. Which TWO elements should be included in the executive summary? (Select TWO.)

Accepted Answer

Overall risk posture summary. The executive summary should provide a high-level overview, including the overall risk posture and key findings that require management attention. Detailed technical descriptions are better left for the main body.

Answer

Raw CVSS scores for all vulnerabilities

Answer

Detailed technical description of each vulnerability

Answer

Network topology diagrams