CS0-003 Reporting and Communication Practice Test 5 — 15 Questions

Question 1

A security analyst is creating metrics for a security dashboard aimed at executive leadership. Which THREE metrics are most appropriate for this audience? (Select THREE.)

Accepted Answer

Phishing simulation click rates. Phishing simulation click rates (A) are appropriate because they express human-risk exposure as a simple percentage that executives can trend over time to judge the effectiveness of security awareness training. Number of security incidents by category (B) is right because it gives leadership a business-level view of what kinds of threats are materializing and where to direct risk-reduction investment. Mean time to detect (C) is right because it is a key operational KPI showing how quickly the security program identifies threats, which executives use to assess detection capability and response readiness. The unmarked options do not belong: vulnerability scan details for individual hosts (D) are too granular and technical for an executive dashboard, and firewall rule change request logs (E) are operational change-management records rather than strategic risk metrics.

Answer

Vulnerability scan details for individual hosts

Answer

Firewall rule change request logs

Question 2

Which metric is commonly used to measure the average time it takes to identify that a security incident has occurred?

Accepted Answer

MTTD (Mean Time to Detect). Mean Time to Detect (MTTD) measures the average time between the start of an incident and its detection. It is a key metric for evaluating the effectiveness of monitoring and detection capabilities.

Answer

MTTRem (Mean Time to Remediate)

Answer

MTTR (Mean Time to Respond)

Answer

Patch SLA Compliance %

Question 3

During a security incident involving a potential data breach, the CISO asks you to prepare a communication for the board of directors. What is the MOST important aspect to emphasize in this communication?

Accepted Answer

The financial impact, reputational risk, and potential regulatory penalties. When communicating with the board of directors during a data breach, the most important aspects are the business impact: financial loss, reputational damage, and potential regulatory fines. Board members are concerned with strategic and financial implications, not technical details. Emphasizing these areas helps them make informed decisions and allocate resources appropriately.

Answer

The specific malware used and its technical attributes

Answer

The names of the IT staff who first detected the incident

Answer

A step-by-step timeline of the incident response actions taken so far

Question 4

A vulnerability report is being prepared for an organization's management. Which of the following is the MOST appropriate structure for this report?

Accepted Answer

Executive summary, findings by severity, risk acceptance, remediation timeline. A standard vulnerability report includes an executive summary for high-level decision-makers, findings grouped by severity, risk acceptance decisions, and a remediation timeline.

Answer

Charts showing open vulnerability counts over time, without any narrative

Answer

List of all vulnerabilities sorted by CVSS score, followed by detailed technical descriptions

Answer

Network diagram with vulnerability locations, patch status, and compliance checklists

Question 5

A security analyst is preparing an after-action report for a phishing incident. Which component is MOST critical to include to prevent recurrence?

Accepted Answer

Lessons learned and recommendations. An after-action report exists to drive improvement, so the component that directly prevents recurrence is the lessons learned and recommendations section, which translates findings into concrete process, tooling, or training changes. While timeline, impact, and root cause feed into it, only lessons learned and recommendations prescribe the corrective actions that stop the same phishing incident from succeeding again.

Answer

Timeline of the incident

Answer

Impact assessment

Answer

Root cause analysis

Question 6

Which of the following is a key performance indicator (KPI) for measuring the efficiency of patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance % directly measures how efficiently the patch management process meets its defined service-level targets — the percentage of patches applied within the agreed remediation window. This is a process-efficiency KPI because it evaluates the speed and consistency of the patching workflow against a defined benchmark. MTTR measures incident response, not patch throughput, and open vulnerability count reflects exposure rather than process efficiency.

Answer

Mean time to respond (MTTR)

Answer

Number of open vulnerabilities

Answer

Phishing simulation click rate

Question 7

During a compliance audit, the auditor requests evidence of access reviews. Which of the following would be the MOST appropriate evidence to provide?

Accepted Answer

Completed access review sign-off sheets with manager approvals. Access review documentation, such as sign-off sheets or reports showing review and approval of user access rights, directly demonstrates that periodic access reviews are conducted.

Answer

Vulnerability scan reports

Answer

A list of all user accounts and their creation dates

Answer

Logs of successful and failed login attempts

Question 8

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires that data breaches be reported to the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Answer

24 hours

Answer

7 days

Answer

48 hours

Question 9

A security analyst receives a threat intelligence report containing detailed Indicators of Compromise (IoCs) such as IP addresses, file hashes, and domain names. What is the MOST appropriate audience for distributing this type of report?

Accepted Answer

The Security Operations Center (SOC) team. Tactical intelligence, such as IoCs, is most useful for frontline technical teams like the SOC, who can use it to detect and block threats. Executives typically receive strategic intelligence.

Answer

External auditors

Answer

All employees in the organization

Answer

Senior executives and the board of directors

Question 10

Which of the following BEST describes the purpose of a risk register in the context of reporting and communication?

Accepted Answer

To provide a structured way to track identified risks, their likelihood, impact, and mitigation actions. A risk register is a central document that captures identified risks, their assessments, mitigation plans, and status. It supports ongoing risk management and communication to stakeholders.

Answer

To document vulnerabilities found during scans

Answer

To record all security incidents and their outcomes

Answer

To list compliance requirements and deadlines

Question 11

An organization is preparing evidence for a compliance audit. Which of the following pieces of evidence would BEST demonstrate that a security control is effective?

Accepted Answer

A control effectiveness report with test results and metrics. A control effectiveness report with test results and metrics provides objective, measurable evidence that the control actually works as intended, which is what auditors require. Configuration screenshots and policy documents only show intent or design, not operational effectiveness.

Answer

A screenshot of the control configuration

Answer

A policy document describing the control

Answer

An email from the system owner stating the control is working

Question 12

During an incident, which of the following should be the FIRST priority when communicating with law enforcement?

Accepted Answer

Coordinating evidence collection and preservation. Law enforcement may need to preserve evidence for legal proceedings. Coordination ensures that evidence is handled properly and that the organization does not inadvertently destroy or compromise evidence.

Answer

Sharing the incident response plan

Answer

Requesting a warrant for internal investigation

Answer

Providing a list of affected customers

Question 13

Which type of threat intelligence report is MOST appropriate for a Chief Information Security Officer (CISO) to understand the overall threat landscape and make strategic decisions?

Accepted Answer

Strategic intelligence. Strategic intelligence provides high-level analysis of threats, trends, and risks that impact business decisions. It is designed for senior management and executives.

Answer

Operational intelligence

Answer

Technical intelligence

Answer

Tactical intelligence

Question 14

A security analyst is preparing a vulnerability report for management. Which TWO elements should be included in the executive summary? (Select TWO.)

Accepted Answer

Overall risk posture summary. The executive summary is written for management, so it must translate technical findings into business-relevant information. Option D (Overall risk posture summary) is correct because it gives leadership a high-level view of the organization's aggregate exposure and whether risk is increasing or decreasing. Option E (Key findings that require management attention) is correct because it highlights the critical issues that need decisions, resources, or remediation prioritization from leadership. Options A and B are incorrect because raw CVSS scores and detailed technical descriptions belong in the technical body of the report, not the executive summary. Option C is also incorrect because network topology diagrams are supporting technical artifacts, not executive-level summary content.

Answer

Raw CVSS scores for all vulnerabilities

Answer

Detailed technical description of each vulnerability

Answer

Network topology diagrams

Question 15

An incident responder is documenting the root cause of a data breach. Which THREE components are essential to include in the root cause analysis section of the incident report? (Select THREE.)

Accepted Answer

The technical vulnerability exploited. Option A is correct because the root cause analysis must identify the specific technical vulnerability that was exploited, such as an unpatched CVE, misconfigured service, or weak authentication mechanism, since this is the direct technical weakness enabling the breach. Option D is correct because human factors like insufficient security awareness training or failure to follow procedures are legitimate root causes that explain why the initial compromise succeeded. Option E is correct because process failures, such as missing patch management, inadequate access reviews, or absent change control, describe the systemic conditions that allowed the vulnerability to persist and are central to root cause analysis. Option B is not part of root cause analysis; the number of records affected is an impact or scope metric reported elsewhere in the incident report. Option C is not essential to root cause analysis; naming the specific employee who clicked the phishing email assigns individual blame rather than identifying the underlying human-factor or process cause, and may raise privacy concerns.

Answer

The number of records affected

Answer

The name of the employee who clicked the phishing email