CS0-003 Reporting and Communication Practice Test 3 — 15 Questions

Question 1

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are key performance indicators (KPIs) that directly measure the efficiency and effectiveness of an incident response program. These metrics provide quantitative data on how quickly threats are identified, contained, and remediated, and whether the root cause is fully addressed to prevent repeat incidents. For executive leadership, these high-level, trendable metrics are the most relevant for assessing improvement quarter over quarter, as they tie directly to risk reduction and operational maturity.

Answer

Number of unused dashboards

Answer

Number of desktop wallpapers changed

Answer

Total coffee consumed by analysts

Question 2

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. Option A is correct because an SLA compliance report by severity, asset owner, and business unit directly maps to the goal of showing whether critical findings are fixed within policy timelines. This report filters by severity (e.g., critical), includes remediation deadlines (SLA), and groups by asset owner and business unit, enabling technical remediation owners to track overdue items and prioritize fixes. It aligns with the NIST SP 800-55 framework for measuring security effectiveness through compliance metrics.

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Answer

A report sorted only by scanner plugin ID

Question 3

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option C is correct because when a business owner accepts delayed remediation for a production system, the report must formally document the risk acceptance. This includes the risk owner, the reason for accepting the risk, any compensating controls in place, a review date to reassess the risk, and an expiry date for the acceptance. For a legal/privacy stakeholder, this documentation provides an auditable trail that demonstrates due diligence and compliance with regulatory requirements, such as GDPR or HIPAA.

Answer

No mention of the accepted risk

Answer

Only the analyst's personal opinion

Answer

A permanent exception with no review

Question 4

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. Option A is correct because it aligns with the structured communication framework required for vendor management during an outage. The business service owner needs a clear timeline, quantified service impact (e.g., number of affected users, duration), evidence (e.g., logs, monitoring data), required corrective actions to prevent recurrence, and contractual follow-up (e.g., SLA breach, credits). This ensures accountability and supports informed decision-making without speculation or unnecessary data.

Answer

Internal blame speculation

Answer

Confidential unrelated customer data

Answer

A public press statement draft first

Question 5

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option A is correct because it directly addresses the board's question about whether cyber risk is decreasing by presenting trend data on exploitable critical exposures, remediation SLA performance, and residual risk by business service. This combination provides a clear, measurable view of risk reduction over time, which is exactly what a SOC manager needs to justify the vulnerability-management investment. The focus on residual risk by business service ties technical findings to business impact, making the data actionable for both technical and executive audiences.

Answer

A screenshot of every scanner page

Answer

A list of tool login names

Answer

A raw CSV of 20,000 findings

Question 6

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. Option C is correct because a failed alert integration indicates a gap in accountability and process validation. The corrective action must assign a named owner, set a due date, define acceptance criteria, and include a retest plan to ensure the integration is properly configured and monitored. This aligns with ITIL's change management and incident management practices, where ownership and verification are critical to closing the loop on failed controls.

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record

Answer

No action because the incident is closed

Question 7

A regulator asks for incident evidence after a data exposure. Which items should be coordinated before disclosure? (Choose two.)

Accepted Answer

Evidence package with timeline, scope, and affected data categories. Option A is correct because a coordinated evidence package ensures that the disclosure to the regulator includes a verified timeline, scope, and affected data categories, which is essential for demonstrating due diligence and compliance with breach notification laws. Without this coordination, the evidence may be incomplete or inconsistent, potentially leading to regulatory penalties or loss of trust.

Answer

Unreviewed analyst speculation

Answer

Passwords for all production systems

Question 8

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option A is correct because a technical remediation section for an OpenSSL vulnerability must include affected assets (specific Linux hosts and package versions), the exact patch commands or vendor guidance (e.g., 'yum update openssl' or 'apt-get upgrade openssl'), a validation method (e.g., 'openssl version -a' or running a vulnerability scanner), and rollback notes (e.g., 'yum history undo' or snapshot restoration). For a legal/privacy stakeholder audience, the most appropriate content choice is a red/yellow/green chart (Option C) that summarizes risk posture without overwhelming technical detail, but the question asks for the technical remediation section content, not the stakeholder-appropriate summary.

Answer

Only the CVE headline

Answer

Only a red/yellow/green chart

Answer

Only estimated financial loss

Question 9

An incident may involve regulated personal data. Who should be engaged early to determine notification obligations? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Legal, privacy, and compliance stakeholders. When an incident involves regulated personal data, legal, privacy, and compliance stakeholders must be engaged early because they determine notification obligations under frameworks such as GDPR, HIPAA, or CCPA. These stakeholders interpret breach notification timelines (e.g., 72 hours under GDPR Article 33) and assess whether the data type triggers mandatory reporting. The business service owner needs this guidance to avoid regulatory penalties and ensure proper incident response coordination.

Answer

Only the graphic design team

Answer

Only the vulnerability scanner vendor

Answer

Only the facilities manager

Question 10

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are the core operational metrics that directly measure the effectiveness and efficiency of an incident response program. For a SOC manager assessing quarter-over-quarter improvement, these metrics provide actionable insight into detection speed, response agility, containment effectiveness, and whether incidents are being fully remediated to prevent repeats.

Answer

Number of desktop wallpapers changed

Answer

Number of unused dashboards

Answer

Total coffee consumed by analysts

Question 11

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. Option A is correct because it directly maps to the requirement of showing whether critical findings are fixed within policy timelines. SLA compliance by severity, asset owner, and business unit provides the necessary metrics to track remediation against defined service-level agreements, which is exactly what a vulnerability programme needs to demonstrate adherence to policy timelines. For executive leadership, this content choice is most appropriate as it offers a high-level, actionable view of compliance status across organizational units without technical noise.

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Answer

A report sorted only by scanner plugin ID

Question 12

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option A is correct because when a business owner accepts delayed remediation for a production system, the risk acceptance must be formally documented to maintain an accurate risk register and audit trail. The report must include the risk owner (who accepted the risk), the reason for the delay, any compensating controls in place to mitigate the risk during the delay, a review date to reassess the risk, and an expiry date to ensure the acceptance does not become permanent. This aligns with risk management frameworks like NIST SP 800-37 and ISO 27005, which require explicit documentation of risk acceptance decisions.

Answer

No mention of the accepted risk

Answer

A permanent exception with no review

Answer

Only the analyst's personal opinion

Question 13

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. Option D is correct because it provides a structured, factual communication that addresses the legal and privacy stakeholder's need for accountability, risk assessment, and contractual compliance. The timeline and evidence establish the sequence of events, service impact quantifies the breach of SLA, required corrective actions demonstrate remediation steps, and contractual follow-up triggers legal review of penalties or liabilities. This approach avoids speculation and focuses on verifiable data, which is critical for legal teams to assess regulatory obligations (e.g., GDPR breach notification timelines) and potential litigation.

Answer

Confidential unrelated customer data

Answer

Internal blame speculation

Answer

A public press statement draft first

Question 14

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option C is correct because it directly addresses the board's question about whether cyber risk is decreasing by presenting a trend in exploitable critical exposures (showing direction of risk), remediation SLA performance (showing operational effectiveness), and residual risk by business service (showing risk remaining after investment). This aligns with the primary audience of business service owners, who need aggregated, risk-focused metrics rather than raw technical data. The use of residual risk by business service ties vulnerability management outcomes to business impact, which is essential for executive decision-making.

Answer

A screenshot of every scanner page

Answer

A raw CSV of 20,000 findings

Answer

A list of tool login names

Question 15

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. Option B is correct because a failed alert integration represents a gap in detection capability that must be formally remediated. Assigning a named owner ensures accountability, a due date enforces timely resolution, acceptance criteria define what constitutes success, and a retest plan verifies that the fix works. Without these elements, the same failure could recur, leaving the SOC blind to future incidents.

Answer

No action because the incident is closed

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record