CS0-003 Reporting and Communication Practice Test 4 — 15 Questions

Question 1

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Option D is correct because executive leadership requires a high-level summary that translates technical findings into business impact. The executive summary should focus on business risk, customer impact assessment, remediation status, and remaining exposure, as these directly inform strategic decisions without overwhelming non-technical stakeholders with raw data.

Answer

Raw packet captures from the scan

Answer

A list of analyst shift times only

Answer

Every command the scanner executed

Question 2

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option C is correct because a technical remediation section must provide actionable steps for the remediation owner. This includes identifying affected assets and package versions, specifying patch commands or vendor guidance, outlining a validation method to confirm the fix, and including rollback notes in case the patch causes issues. Without these details, the remediation owner cannot execute the fix reliably or verify its success.

Answer

Only a red/yellow/green chart

Answer

Only the CVE headline

Answer

Only estimated financial loss

Question 3

An incident may involve regulated personal data. Who should be engaged early to determine notification obligations? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Legal, privacy, and compliance stakeholders. When an incident involves regulated personal data, legal, privacy, and compliance stakeholders must be engaged early because they determine notification obligations under laws such as GDPR, HIPAA, or CCPA. These stakeholders assess the data type, jurisdiction, and breach thresholds to decide if and when to notify regulators and affected individuals. In the context of CS0-003, this aligns with the Reporting and Communication domain, where timely stakeholder involvement is critical for legal compliance and risk mitigation.

Answer

Only the graphic design team

Answer

Only the facilities manager

Answer

Only the vulnerability scanner vendor

Question 4

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are the standard operational metrics for measuring incident response effectiveness. These directly quantify how quickly threats are identified, contained, and whether they return, which is exactly what the CISO needs to assess quarter-over-quarter improvement.

Answer

Number of desktop wallpapers changed

Answer

Total coffee consumed by analysts

Answer

Number of unused dashboards

Question 5

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. Option B is correct because the vulnerability program needs to demonstrate that critical findings are remediated within policy timelines, which requires a report showing SLA compliance. For a SOC manager, the most appropriate content includes severity, asset owner, and business unit breakdowns, enabling them to track accountability and prioritize remediation efforts across the organization.

Answer

A report sorted only by scanner plugin ID

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Question 6

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option B is correct because when a business owner accepts delayed remediation for a production system, the report must formally document the risk owner, the reason for the delay, any compensating controls in place, a scheduled review date, and an expiry date. This ensures accountability, traceability, and that the risk is not permanently ignored, aligning with risk management frameworks like NIST SP 800-37 or ISO 27001.

Answer

A permanent exception with no review

Answer

Only the analyst's personal opinion

Answer

No mention of the accepted risk

Question 7

A cybersecurity analyst is preparing a post-incident report for a data breach that affected multiple business units. Which three of the following elements should be included in the report to ensure effective communication and support future prevention? (Choose three.)

Accepted Answer

A detailed timeline of the incident, including detection and response actions. A detailed timeline of the incident, including detection and response actions, is correct because it provides a chronological record essential for understanding the sequence of events, assessing response effectiveness, and meeting regulatory reporting requirements. Root cause analysis and contributing factors are correct because they identify the underlying technical or procedural failures (e.g., unpatched vulnerability, misconfigured firewall rule) that must be addressed to prevent recurrence. Recommendations for remediation and process improvements are correct because they translate findings into actionable steps, such as implementing multi-factor authentication or updating incident response playbooks, which directly support future prevention.

Answer

The specific usernames and passwords of affected accounts

Answer

The raw packet capture data from the breach period

Answer

A list of all employees’ personal contact information for notification

Question 8

During a weekly security briefing, a junior analyst presents vulnerability scan results to a mixed audience of technical and non-technical stakeholders. Which three of the following communication practices should the analyst follow? (Choose three.)

Accepted Answer

Provide a high-level executive summary with business risk context. Providing a high-level executive summary with business risk context is correct because non-technical stakeholders need to understand the impact of vulnerabilities in terms of potential financial, operational, or reputational harm, not just technical severity scores. This aligns with the CompTIA CS0-003 objective of tailoring communication to the audience, ensuring that decision-makers can prioritize remediation based on business risk rather than raw CVSS numbers.

Answer

Use technical jargon to demonstrate expertise and build credibility

Answer

Focus only on critical and high-severity vulnerabilities

Answer

Present every low-severity finding in detail to be thorough

Question 9

A security analyst needs to communicate the findings of a penetration test to the IT operations team and the CISO. Which three of the following actions best support effective reporting and communication? (Choose three.)

Accepted Answer

Customize the level of detail in the report for each audience. Customizing the level of detail for each audience ensures that technical teams receive the operational depth they need (e.g., raw findings, exploit paths) while executives get a high-level summary focused on business risk and strategic impact. This aligns with the principle of audience-aware reporting in penetration testing, where the CISO requires risk context and the IT operations team needs actionable technical details.

Answer

Include raw command outputs and exploit code in the executive summary

Answer

Delay the report until all findings are fully verified with no uncertainty

Answer

Submit the report as a confidential document without any verbal briefing

Question 10

An organization is implementing a new security incident response plan and wants to establish clear communication protocols. Which three of the following are essential components of effective incident communication? (Choose three.)

Accepted Answer

Defining a single point of contact (POC) for each stakeholder group. Defining a single point of contact (POC) for each stakeholder group ensures clear, controlled communication and prevents conflicting information. Pre-approved templates for different incident types enable rapid, consistent, and accurate notifications without needing to craft messages from scratch during a crisis. An escalation matrix with authority levels ensures that decisions are made by the appropriate personnel based on incident severity, preventing delays and unauthorized actions.

Answer

Using only email for all incident updates to maintain a written record

Answer

Including all employees in every incident notification to ensure transparency

Answer

Automatically releasing incident details to the press within one hour

Question 11

A security analyst is preparing a post-incident report for a recent data breach. The report must be tailored for multiple audiences, including executive leadership, legal counsel, and the technical remediation team. Which four of the following best practices should the analyst follow to ensure effective communication and reporting? (Choose four.)

Accepted Answer

Including a high-level executive summary with business impact and risk exposure for the C-suite.. Including a high-level executive summary with business impact and risk exposure is correct because executive leadership requires a non-technical overview that focuses on financial, legal, and reputational consequences. This aligns with the NIST SP 800-61 Rev. 2 recommendation to tailor incident reports to the audience, ensuring the C-suite can make informed strategic decisions without being bogged down by technical details.

Answer

Omitting the root cause analysis to avoid liability concerns in the legal review.

Answer

Using a single, standardized report format for all stakeholders to ensure consistency.

Question 12

Order the steps for proper forensic acquisition of a hard drive.

Question 13

Order the steps for setting up a SIEM (Security Information and Event Management) system.

Question 14

Match each threat intelligence source to its description.

Question 15

Match each incident response phase to its activity.