CS0-003 Reporting and Communication Practice Test 5 — 15 Questions

Question 1

A security analyst needs to report a critical vulnerability to the executive team. The report should balance technical details with business impact. Which of the following is the BEST approach?

Accepted Answer

Explain the vulnerability in terms of potential business impact and recommended risk treatment. Option C is correct because it directly addresses the core requirement of balancing technical details with business impact. For a critical vulnerability, the executive team needs to understand the potential financial, operational, and reputational risks, not just the technical flaw. This approach aligns with the NIST risk management framework, which emphasizes communicating risk in terms of business context to enable informed decision-making on risk treatment (e.g., accept, mitigate, transfer, avoid).

Answer

Simply state the vulnerability exists and a patch is available

Answer

Write a 50-page report covering every technical detail and mitigation option

Answer

Provide a full technical analysis of the vulnerability and remediation steps

Question 2

During a post-incident review, the security team needs to communicate findings to the IT operations team. Which communication method is MOST effective for this audience?

Accepted Answer

A detailed technical report including indicators of compromise and remediation procedures. The IT operations team needs actionable technical details to implement remediation and prevent recurrence. A detailed technical report with indicators of compromise (IoCs) and remediation procedures provides the precise commands, log entries, and configuration changes required for their work, making it the most effective method for this audience.

Answer

A presentation with graphs and trends

Answer

An informal email with bullet points and no specific actions

Answer

A one-page executive summary with risk ratings

Question 3

An analyst is preparing a report that includes Personally Identifiable Information (PII) from a data breach. The report will be shared with external auditors. Which of the following is the BEST practice for handling PII in the report?

Accepted Answer

Use tokenization or pseudonymization to mask PII while preserving analytical value. Option C is correct because tokenization or pseudonymization replaces PII with non-sensitive placeholders that retain referential integrity and analytical utility, allowing auditors to perform their review without exposing actual personal data. This approach balances transparency requirements with data minimization principles mandated by regulations like GDPR and PCI DSS, unlike full disclosure or simple encryption which still exposes the original data to the recipient.

Answer

Include full PII in the report for complete transparency

Answer

Encrypt the report and send it via email to auditors

Answer

Remove all PII entirely, leaving only anonymized records

Question 4

After a risk assessment, a security analyst recommends accepting a low-risk finding. The system owner disagrees. Which communication strategy should the analyst use?

Accepted Answer

Present the risk assessment data and cost-benefit analysis to justify acceptance. Option C is correct because the security analyst should use data-driven communication to resolve disagreements over risk acceptance. By presenting the risk assessment data and a cost-benefit analysis, the analyst provides objective evidence that the low-risk finding does not warrant mitigation, aligning with the NIST risk management framework's emphasis on informed decision-making. This approach respects the system owner's concerns while justifying the acceptance based on technical and business rationale.

Answer

Escalate the disagreement to the CISO immediately

Answer

Agree with the system owner and change the recommendation

Answer

Insist that the finding must be mitigated due to policy

Question 5

A security dashboard is being designed for the executive team. Which metric is MOST appropriate to display?

Accepted Answer

Overall risk posture score with trend over time. The executive team requires a high-level, strategic view of security effectiveness, not granular operational data. The overall risk posture score with trend over time directly communicates the organization's security health and whether it is improving or deteriorating, enabling informed decision-making. This aligns with the Reporting and Communication domain's emphasis on translating technical metrics into business-relevant insights.

Answer

Current CPU utilization on firewalls

Answer

Patch installation status of all endpoints

Answer

Number of IDS alerts per hour

Question 6

During an active incident, a security analyst discovers that the attacker has exfiltrated data. The analyst must communicate this to the incident response team. Which method of communication is MOST appropriate?

Accepted Answer

Use a predefined secure messaging channel or phone call to escalate. During an active incident, speed and security are critical. A predefined secure messaging channel or phone call ensures immediate, confidential communication without the delays or exposure risks of email or ticketing systems. This aligns with NIST SP 800-61 incident response guidelines, which prioritize real-time, out-of-band communication for sensitive updates.

Answer

Update the incident ticket and wait for the team to review

Answer

Send a detailed email to the incident response team

Answer

Post the information on a public forum for awareness

Question 7

An analyst identifies a security policy violation during a routine audit. The violation does not pose immediate risk. Which of the following is the BEST way to report this finding?

Accepted Answer

Create a formal report with the finding, policy references, and recommended remediation. A formal report is the best method for documenting a security policy violation because it provides a permanent, auditable record that includes specific policy references and recommended remediation steps. This aligns with the reporting and communication domain's emphasis on structured, traceable documentation for non-urgent findings, ensuring proper tracking and accountability without causing unnecessary alarm.

Answer

Mention it casually in a team meeting

Answer

Send an instant message to the system owner

Answer

Immediately report it to the Chief Information Security Officer

Question 8

A security analyst needs to present vulnerability scan results to a non-technical manager. Which of the following is MOST important to include?

Accepted Answer

Summary of critical vulnerabilities with associated business risk and recommended actions. Option D is correct because risk prioritization helps managers allocate resources. Options A, B, C are too technical or lack context.

Answer

Raw scan output with IP addresses and ports

Answer

Detailed exploit code for critical vulnerabilities

Answer

List of all CVSS scores with no further explanation

Question 9

During a post-incident review, the team identifies that the incident response plan was not followed correctly due to unclear communication channels. Which recommendation BEST addresses this issue?

Accepted Answer

Update the incident response plan to define specific communication channels and escalation paths. Option A is correct because the root cause identified in the post-incident review is unclear communication channels, which directly violates the communication and escalation procedures defined in the incident response plan. Updating the plan to specify exact communication channels (e.g., dedicated Slack channel, email distribution list, or phone tree) and escalation paths (e.g., tier-1 analyst → SOC manager → CISO) ensures that all team members know how and when to communicate during an incident, preventing delays and miscoordination.

Answer

Implement multi-factor authentication for all accounts

Answer

Replace the current SIEM tool with a faster one

Answer

Conduct more frequent vulnerability scans

Question 10

Which TWO of the following are best practices for distributing security reports to stakeholders?

Accepted Answer

Use encrypted email for sensitive reports. Option B is correct because encrypted email (e.g., using S/MIME or PGP) ensures that sensitive security reports are protected from unauthorized interception during transit, maintaining confidentiality and integrity as required by security best practices.

Answer

Post reports on a public website for easy access

Answer

Send reports via instant messaging without encryption

Answer

Print and leave reports in common areas

Question 11

Which THREE elements are essential components of a comprehensive post-incident report?

Accepted Answer

Root cause analysis. Root cause analysis (RCA) is essential because it identifies the underlying technical failure—such as a misconfigured firewall rule, an unpatched CVE, or a phishing campaign—that allowed the incident to occur. Without RCA, the report would only describe symptoms, not the fundamental vulnerability that must be addressed to prevent recurrence.

Answer

List of all employee usernames and passwords

Answer

Budget report for the incident response team

Question 12

Which TWO methods help ensure the accuracy of security metrics reported to management?

Accepted Answer

Periodic validation of data against original logs. Option B is correct because periodic validation of security metrics against original logs (e.g., firewall logs, IDS/IPS alerts, or authentication logs) ensures data integrity by detecting discrepancies introduced during aggregation or transformation. This practice aligns with the principle of 'trust but verify,' where raw log sources serve as the authoritative baseline for metric accuracy, preventing reporting of corrupted or incomplete data.

Answer

Using colorful charts to impress stakeholders

Answer

Reporting only positive metrics to maintain confidence

Answer

Manual entry of data from multiple spreadsheets

Question 13

An analyst runs the above command on a server. Based on the exhibit, which of the following is the MOST likely scenario?

Accepted Answer

The server may be compromised with a remote access trojan listening on port 4444. The command output shows a listening service on port 4444, which is not a standard port for any common service. Port 4444 is commonly associated with remote access trojans (RATs) such as Metasploit's Meterpreter or other malware, making a compromise the most likely scenario. The analyst should investigate further to confirm malicious activity.

Answer

The server is running a legitimate SSH service on port 4444

Answer

The server is hosting a web service on a non-standard port

Answer

The server is being used as a proxy for internal clients

Question 14

A security analyst reviews the above bucket policy. Which of the following BEST describes the risk associated with this policy?

Accepted Answer

The bucket is publicly readable, potentially exposing sensitive data. Option A is correct because the policy allows any anonymous user to read objects. Option B is wrong because it's a GET, not PUT. C is wrong because the policy does not require authentication. D is wrong because encryption is not addressed.

Answer

The bucket allows anyone to upload malicious files

Answer

The bucket enforces encryption in transit

Answer

The bucket requires authentication for access

Question 15

An analyst views the above SIEM logs from a Linux server. Which of the following attacks is MOST likely occurring?

Accepted Answer

Brute force attack leading to credential compromise and malware installation. The SIEM logs show repeated failed SSH login attempts from multiple IP addresses, followed by a successful login and then a wget command to download a suspicious file, indicating a brute force attack that succeeded, leading to credential compromise and subsequent malware installation. This pattern matches the typical lifecycle of a brute force attack against SSH services, where an attacker gains access and then stages malware.

Answer

Man-in-the-middle attack intercepting credentials

Answer

SQL injection through the web application

Answer

Denial of service attack against the SSH service