CS0-003 Reporting and Communication — Timed 10 Questions

Question 1

During a security incident, which THREE elements are critical to include in the incident report for a compliance review?

Accepted Answer

Impact assessment. The incident report must include B, the impact assessment, because a compliance review needs to know the scope, affected systems/data, and business or regulatory consequences of the breach. It must include D, the timeline of events, since auditors require a chronological record of detection, escalation, containment, and recovery to verify the response followed policy. It must include E, the root cause analysis, because compliance frameworks require evidence that the underlying weakness was identified and addressed to prevent recurrence. Options A and C are useful operational artifacts but are not among the three critical elements marked for this compliance-focused report.

Answer

Lessons learned

Answer

Remediation timeline

Question 2

Which of the following best describes the purpose of a threat intelligence report at the operational level?

Accepted Answer

Offer detailed analysis of threat actor TTPs for specific campaigns. Operational-level threat intelligence is consumed by security operations teams (SOC analysts, threat hunters, IR responders) and focuses on the specific TTPs, tools, and infrastructure of threat actors actively targeting the organization. It bridges the strategic (executive) and tactical (IoCs) layers by explaining how adversaries operate in concrete campaigns, enabling defenders to build detections and hunting hypotheses. Option A captures this TTP-focused campaign analysis, which is the defining characteristic of operational CTI.

Answer

Deliver technical indicators like IoCs to SOC analysts

Answer

Provide high-level trends to executive leadership

Answer

Summarize geopolitical risks affecting the organization

Question 3

A SOC manager needs to share threat intelligence with the SOC analysts to help them identify and block malicious activity. Which type of intelligence report is MOST appropriate?

Accepted Answer

Tactical intelligence report. Tactical threat intelligence focuses on TTPs (tactics, techniques, and procedures) of adversaries and is designed for defenders — SOC analysts use it to build detections, tune SIEM rules, and block known adversary behaviors. Because the SOC manager wants analysts to identify and block malicious activity, tactical intelligence is the right fit.

Answer

Operational intelligence report

Answer

Technical intelligence report

Answer

Strategic intelligence report

Question 4

A security analyst is creating a compliance dashboard for a PCI DSS audit. Which THREE metrics should be included to demonstrate compliance with access control requirements? (Select THREE.)

Accepted Answer

Number of active user accounts with privileged access. Option C is correct because PCI DSS Requirement 7 mandates restricting access to system components and cardholder data by business need-to-know, so tracking the number of active user accounts with privileged access directly demonstrates that access is limited and monitored. Option D is correct because PCI DSS requires timely removal or disabling of inactive accounts (Requirement 8.1.4), so the percentage of accounts inactive for more than 90 days evidences that dormant accounts are being identified and deprovisioned. Option E is correct because periodic access reviews (at least every six months per PCI DSS Requirement 7.2.4) verify that user access rights remain appropriate, and the quarterly review percentage proves this control is operating. Option A is not correct because failed login attempts relate to authentication monitoring and logging (Requirement 10), not access control metrics. Option B is not correct because critical vulnerabilities in network devices fall under vulnerability management (Requirement 6/11), not access control requirements.

Answer

Number of failed login attempts in the last 24 hours

Answer

Number of critical vulnerabilities in network devices

Question 5

A security analyst needs to communicate the business impact of a newly discovered critical vulnerability to the executive team. Which of the following is the BEST approach?

Accepted Answer

Explain the vulnerability in layman's terms and estimate potential financial loss.. Translating technical risk into business terms (financial, reputational, regulatory) helps executives understand the impact and make informed decisions.

Answer

Send the raw vulnerability scan report.

Answer

Recommend immediate patching without further context.

Answer

Provide a detailed CVSS score and exploit code.

Question 6

During an incident response, the SOC team identifies a data breach involving customer PII. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification of the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is a hard regulatory deadline and applies to breaches involving customer PII. Failure to notify can trigger fines under Article 83.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 7

A cybersecurity analyst is preparing a threat intelligence report for the SOC team. Which type of intelligence should be included to provide actionable indicators of compromise (IoCs)?

Accepted Answer

Tactical intelligence. Tactical intelligence includes IoCs such as IP addresses, domain names, and hashes that can be used for detection and blocking.

Answer

Strategic intelligence

Answer

Technical intelligence

Answer

Operational intelligence

Question 8

After a security incident, which component of the incident report provides a chronological sequence of events from detection to recovery?

Accepted Answer

Timeline. The Timeline section of an incident report presents a chronological sequence of events — detection, containment, eradication, recovery — with timestamps. It is specifically designed to reconstruct what happened and when, which is exactly what the question asks for.

Answer

Lessons learned

Answer

Root cause

Answer

Impact assessment

Question 9

Which metric measures the average time it takes to identify a security incident from the moment it occurs?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) measures the average time to detect an incident.

Answer

MTTRem

Answer

MTTR

Answer

SLA compliance

Question 10

A vulnerability report includes a risk acceptance section. Which of the following scenarios is most appropriate to include in this section?

Accepted Answer

A medium-severity vulnerability with a compensating control that reduces risk to acceptable levels. Risk acceptance is documented when the organization decides not to remediate a vulnerability due to compensating controls or low risk.

Answer

A vulnerability that has been exploited in the wild

Answer

A critical vulnerability that has been patched

Answer

All open vulnerabilities regardless of severity