CS0-003 Reporting and Communication Practice Test 2 — 15 Questions

Question 1

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. Option A is correct because executive leadership requires a concise, actionable summary that focuses on business impact and remediation steps, not technical details. The communication must include the timeline of the outage, service impact (e.g., affected systems, downtime duration), evidence (e.g., logs, monitoring data), required corrective actions from the vendor, and contractual follow-up (e.g., SLA breach, penalties). This aligns with the NIST Incident Response framework's post-incident activity phase, where clear accountability and remediation are critical for vendor management.

Answer

Internal blame speculation

Answer

A public press statement draft first

Answer

Confidential unrelated customer data

Question 2

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option D is correct because it directly answers the board's question about whether cyber risk is decreasing by showing a trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. This provides a clear, quantitative, and business-aligned view of risk reduction, which is essential for executive reporting. For a technical remediation owner, this content is most appropriate as it focuses on actionable metrics (e.g., SLA compliance, residual risk per service) that directly guide patching and mitigation priorities.

Answer

A raw CSV of 20,000 findings

Answer

A screenshot of every scanner page

Answer

A list of tool login names

Question 3

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. Option C is correct because a post-incident report identifying an unowned failed alert integration requires a corrective action that assigns clear accountability and a measurable remediation plan. Naming an owner, setting a due date, defining acceptance criteria, and scheduling a retest ensure the integration is properly configured and monitored, directly addressing the root cause of the alert failure. This aligns with the NIST Incident Response Lifecycle's post-incident activity phase, which mandates actionable follow-up items to prevent recurrence.

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record

Answer

No action because the incident is closed

Question 4

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Option B is correct because the executive summary for a business service owner must focus on business risk, customer impact, remediation status, and remaining exposure. Since no exploitation was found, the key message is the potential business impact and the current state of remediation, not technical details. This aligns with the Reporting and Communication domain, where the audience requires actionable business-level information.

Answer

A list of analyst shift times only

Answer

Every command the scanner executed

Answer

Raw packet captures from the scan

Question 5

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option B is correct because a technical remediation section for an OpenSSL vulnerability must include specific, actionable steps: affected assets and package versions to identify scope, patch commands or vendor guidance to apply the fix, a validation method (e.g., openssl version -a or a vulnerability scanner) to confirm remediation, and rollback notes for safety. This ensures the SOC manager can direct the server team with precise, auditable instructions, aligning with the Reporting and Communication domain's requirement for clear, technical content in incident response.

Answer

Only estimated financial loss

Answer

Only the CVE headline

Answer

Only a red/yellow/green chart

Question 6

An incident may involve regulated personal data. Who should be engaged early to determine notification obligations? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Legal, privacy, and compliance stakeholders. When an incident involves regulated personal data (e.g., PII, PHI, or GDPR-protected data), legal, privacy, and compliance stakeholders must be engaged early to determine statutory notification obligations. These stakeholders interpret applicable regulations (such as GDPR Article 33, HIPAA Breach Notification Rule, or state breach notification laws) to decide if, when, and how to notify affected parties and regulators. Executive leadership requires a concise summary of legal exposure and required actions, not operational details.

Answer

Only the facilities manager

Answer

Only the vulnerability scanner vendor

Answer

Only the graphic design team

Question 7

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are the standard metrics for measuring incident response effectiveness. These directly quantify how quickly threats are identified, contained, and whether they return, providing clear quarter-over-quarter trend data for the CISO. For a technical remediation owner, these same metrics are actionable, as they pinpoint where to improve detection rules, response playbooks, and patch cycles.

Answer

Total coffee consumed by analysts

Answer

Number of desktop wallpapers changed

Answer

Number of unused dashboards

Question 8

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. B is correct because SLA compliance by severity, asset owner, and business unit directly maps to the requirement of showing whether critical findings are fixed within policy timelines. This report filters by severity (e.g., critical), includes time-bound metrics (SLA compliance), and can be broken down by asset owner and business unit to demonstrate accountability and policy adherence. For legal/privacy stakeholders, this content provides auditable evidence of remediation timelines, which is essential for regulatory compliance and risk management.

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Answer

A report sorted only by scanner plugin ID

Question 9

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option B is correct because when a business owner accepts delayed remediation for a production system, the report must formally document the risk acceptance decision. This includes the risk owner (who accepted the risk), the reason for acceptance, any compensating controls in place, a review date to reassess the risk, and an expiry date for the acceptance. This aligns with risk management frameworks like NIST SP 800-37 and ISO 27005, which require traceability and accountability for accepted risks.

Answer

Only the analyst's personal opinion

Answer

No mention of the accepted risk

Answer

A permanent exception with no review

Question 10

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. Option C is correct because when a third-party vendor causes an outage during remediation, the communication must focus on operational and contractual details: the exact timeline of the outage, the scope of service impact (e.g., number of users affected, systems down), evidence (e.g., logs, monitoring alerts), required corrective actions to prevent recurrence, and contractual follow-up (e.g., SLA breach, penalties). This aligns with the SOC manager's need for actionable, factual data to manage incident response and vendor accountability, not public relations or unrelated data.

Answer

A public press statement draft first

Answer

Confidential unrelated customer data

Answer

Internal blame speculation

Question 11

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option B is correct because it directly addresses the board's question by showing a trend in exploitable critical exposures (measuring vulnerability reduction), remediation SLA performance (tracking timeliness of fixes), and residual risk by business service (quantifying remaining risk). This provides executive leadership with a clear, high-level view of risk reduction over time, aligning with the CS0-003 domain of Reporting and Communication for a non-technical audience.

Answer

A list of tool login names

Answer

A raw CSV of 20,000 findings

Answer

A screenshot of every scanner page

Question 12

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. A is correct because a failed alert integration indicates a gap in operational ownership, which must be resolved by assigning a named owner, setting a due date, defining acceptance criteria, and planning a retest. This ensures accountability and verifies that the integration is properly restored and monitored, preventing recurrence. Without these elements, the corrective action lacks closure and measurable success criteria.

Answer

No action because the incident is closed

Answer

Deletion of the integration record

Answer

A vague recommendation to improve security

Question 13

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Option C is correct because the executive summary for legal/privacy stakeholders must focus on business risk, customer impact, remediation status, and remaining exposure. Since no exploitation was found, the summary should communicate the potential regulatory and privacy implications (e.g., GDPR, CCPA) and the steps taken to close the vulnerability, not technical details. This aligns with the CS0-003 objective of tailoring communication to the audience's need for risk-based, non-technical summaries.

Answer

A list of analyst shift times only

Answer

Every command the scanner executed

Answer

Raw packet captures from the scan

Question 14

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option C is correct because a technical remediation section must provide actionable steps for the server team to fix the OpenSSL vulnerability. It includes affected assets (specific Linux hosts), package versions (e.g., openssl-1.1.1k), patch commands (e.g., 'yum update openssl' or 'apt-get upgrade openssl'), vendor guidance (e.g., Red Hat or Ubuntu advisories), validation method (e.g., 'openssl version' or 'openssl version -a'), and rollback notes (e.g., 'yum history undo' or snapshot restore). For a business service owner, this content is most appropriate because it translates technical actions into clear, auditable steps that demonstrate risk mitigation and operational planning.

Answer

Only estimated financial loss

Answer

Only a red/yellow/green chart

Answer

Only the CVE headline

Question 15

An incident may involve regulated personal data. Who should be engaged early to determine notification obligations? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Legal, privacy, and compliance stakeholders. When an incident involves regulated personal data (e.g., PII, PHI, or GDPR-protected data), legal, privacy, and compliance stakeholders must be engaged early to determine notification obligations. These stakeholders interpret breach notification laws (such as HIPAA, GDPR, or CCPA) and advise on required timelines, affected parties, and regulatory reporting. The SOC manager needs this input to ensure the incident response plan aligns with legal mandates, not just technical containment.

Answer

Only the facilities manager

Answer

Only the vulnerability scanner vendor

Answer

Only the graphic design team