CS0-003 Reporting and Communication Practice Test 6 — 15 Questions

Question 1

A security analyst has identified a critical vulnerability in a customer-facing web application. The analyst needs to communicate this to senior management. Which of the following is the best approach for this communication?

Accepted Answer

Summarize the vulnerability in terms of business risk, potential financial impact, and recommended mitigation timeline.. Option D is correct because communicating a critical vulnerability to senior management requires translating technical risk into business impact. Security analysts must present findings in terms of potential financial loss, regulatory consequences, and a clear mitigation timeline, enabling informed decision-making without requiring deep technical expertise.

Answer

Send a brief email stating that a critical vulnerability exists and ask management to schedule a meeting.

Answer

Notify the development team only and have them fix it before informing management.

Answer

Provide a detailed technical analysis of the vulnerability, including exploit code.

Question 2

During a security incident, the SOC analyst determines that the attack is originating from an internal IP address belonging to the finance department. The incident response plan requires escalation to the appropriate team. Which of the following should the analyst contact first?

Accepted Answer

The finance department manager to confirm if the activity is authorized.. Option C is correct because the incident response plan requires confirmation of authorization before taking containment actions. Since the activity originates from an internal IP in the finance department, the analyst must first contact the finance department manager to verify whether the traffic is legitimate business use (e.g., a scheduled audit or approved data transfer). This step prevents unnecessary disruption and aligns with the 'verify before act' principle in NIST SP 800-61 incident handling.

Answer

The legal department to handle potential compliance issues.

Answer

The system administrator for the finance department to isolate the host.

Answer

The human resources department for disciplinary action.

Question 3

A company policy requires that all security incidents be reported to management within one hour of detection. An analyst discovers a low-severity incident (a single malware download attempt blocked by antivirus) at 4:55 PM on a Friday. The analyst is about to leave for the weekend. What should the analyst do?

Accepted Answer

Report the incident immediately according to policy, even if it means staying late.. Option B is correct because the company policy explicitly requires reporting all security incidents within one hour of detection, regardless of severity. The analyst must report the incident immediately, even if it means staying late, as policy compliance is mandatory and low-severity incidents still represent a security event that could indicate broader compromise or be part of a larger attack chain. Delaying reporting violates the policy and could lead to disciplinary action or missed escalation windows.

Answer

Document the incident in the ticketing system and report it the next business day.

Answer

Report the incident via email and ignore it until Monday.

Answer

Wait until Monday morning to report, as it is low severity.

Question 4

A security analyst is preparing a monthly dashboard for the board of directors. Which metric would best demonstrate the effectiveness of the security program in reducing risk?

Accepted Answer

Mean time to detect (MTTD) and mean time to respond (MTTR).. Mean time to detect (MTTD) and mean time to respond (MTTR) directly quantify the security program's operational efficiency in identifying and containing threats, which reduces the window of exposure and potential damage. A lower MTTD/MTTR indicates faster detection and response, directly correlating with reduced risk from incidents. This makes it the best metric for demonstrating risk reduction effectiveness to the board.

Answer

Number of security incidents detected.

Answer

Percentage of employees who completed security awareness training.

Answer

Number of firewall rules configured.

Question 5

After a major security incident, a post-incident review reveals that communication between the SOC and the network operations center (NOC) was slow and unclear. Which document should be updated to improve future incident response?

Accepted Answer

Communication management plan. The communication management plan defines roles, responsibilities, escalation paths, and communication channels (e.g., secure chat, phone bridges, ticketing systems) between teams like the SOC and NOC during an incident. Since the review specifically identified slow and unclear inter-team communication, updating this plan directly addresses the root cause by clarifying protocols, contact lists, and expected response times, ensuring faster and clearer coordination in future incidents.

Answer

Disaster recovery plan (DRP)

Answer

Business continuity plan (BCP)

Answer

Incident response plan (IRP)

Question 6

A security analyst needs to share threat intelligence data with a partner organization as part of an information sharing agreement. Which of the following is the most critical consideration before sharing the data?

Accepted Answer

The classification level and handling restrictions. The classification level and handling restrictions are the most critical consideration because threat intelligence often contains sensitive information such as indicators of compromise (IOCs) that may be classified or subject to legal handling requirements (e.g., TLP markings). Sharing data without verifying classification could violate security policies, breach confidentiality agreements, or expose critical vulnerabilities to unauthorized parties, undermining the trust and legality of the information-sharing agreement.

Answer

The volume of data being shared

Answer

The data format (e.g., STIX, TAXII)

Answer

The geographic location of the partner

Question 7

Refer to the exhibit. An analyst sees this alert in the SIEM console. What is the best immediate action?

Accepted Answer

Escalate the alert to the incident response team.. Option D is correct because the alert indicates a potential security incident that requires formal escalation to the incident response team for proper triage, analysis, and containment. The SIEM alert likely contains indicators of compromise (IoCs) that need expert investigation before any automated or manual remediation steps are taken, as premature actions could destroy forensic evidence or disrupt legitimate services.

Answer

Update the Suricata signature to block the traffic.

Answer

Run a full antivirus scan on destination host 10.0.0.1.

Answer

Isolate the source host 10.0.0.5 from the network.

Question 8

Which TWO of the following are key components of an incident communication plan?

Accepted Answer

Escalation contact list. An incident communication plan must include an escalation contact list (A) to ensure that the right stakeholders—such as the incident response team, legal counsel, and executive management—are notified promptly based on the severity of the incident. Pre-approved public statements or scripts (B) are critical to maintain consistent, accurate, and legally vetted messaging to external parties (e.g., customers, media, regulators) during a crisis, preventing unauthorized disclosures that could worsen the situation.

Answer

Network topology diagrams

Answer

Encryption keys for secure communications

Answer

System event logs

Question 9

A security analyst must prepare a report on a recent intrusion for a technical audience (IT staff and security engineers). Which TWO elements should be included?

Accepted Answer

Indicators of compromise (IoCs). Indicators of Compromise (IoCs) are essential for a technical audience because they provide the forensic artifacts—such as IP addresses, file hashes, registry keys, and domain names—that security engineers need to detect, contain, and eradicate the intrusion. Including IoCs enables the IT staff to update detection signatures, block malicious infrastructure, and perform host-based threat hunting, directly supporting incident response and future prevention.

Answer

Estimated financial cost of the incident

Answer

Full exploit code used in the attack

Answer

Executive summary explaining business impact

Question 10

After a data breach incident, a post-incident review team is collecting lessons learned. Which THREE items should be included in the lessons learned documentation?

Accepted Answer

Timeline of events during the incident. Option B is correct because the timeline of events is a critical component of lessons learned documentation. It provides a chronological sequence of actions, detections, and responses during the incident, which is essential for identifying gaps in detection, delays in response, and opportunities for improvement. Without a precise timeline, the team cannot accurately assess the effectiveness of their incident response procedures or the speed of containment.

Answer

Individual performance evaluations of team members

Answer

Legal liability of the organization

Question 11

A small business with 50 employees has been hit by ransomware. All files on the file server and local workstations are encrypted, and the ransom note demands $5,000 in Bitcoin for the decryption key. The CEO is panicking and wants to know the impact on operations and how to proceed. The security analyst has been tasked with preparing a report for the CEO. The company does not have cyber insurance, has minimal IT staff, and relies heavily on email and shared drives for daily operations. The analyst has identified that there is a one-week-old backup but is unsure of its integrity. The analyst must consider that the CEO has limited technical knowledge and that the report will form the basis for critical business decisions. The company's reputation and customer trust are at stake. The analyst must balance transparency with clear, actionable guidance. Which of the following is the BEST approach for the analyst to take in communicating with the CEO?

Accepted Answer

Summarize the situation in non-technical terms, explain the business impact (e.g., inability to access customer data, potential revenue loss), outline recovery options (e.g., restore from backups or pay ransom with risks), and recommend immediate steps.. Summarizing business impact and recovery options in non-technical terms is best for the CEO to make informed decisions.

Answer

Provide a detailed technical timeline of the ransomware infection, including the malware variant and encryption algorithm used.

Answer

Tell the CEO that the incident is being handled and not to worry, then proceed with recovery without further updates.

Answer

Immediately contact law enforcement and advise the CEO to wait for their instructions without providing additional information.

Question 12

A large enterprise with a centralized SOC is responding to a suspected data exfiltration incident. The incident response plan designates the SOC manager as the primary point of contact for all communication. However, during the incident, the marketing department independently publishes a social media post acknowledging the incident, stating that customer data was not compromised, and that the company has everything under control. The SOC analyst discovers this post. The actual investigation is still ongoing, and it is unclear whether customer data was exfiltrated. The company has a strict communication policy that all external statements regarding security incidents must be approved by the incident commander. The marketing department was not aware of the ongoing investigation and acted based on incomplete information. The analyst must consider the potential legal and regulatory implications of the inaccurate statement. The incident commander is currently in a meeting with the CISO and is unavailable. What should the analyst do FIRST?

Accepted Answer

Report the unauthorized communication to the SOC manager and recommend updating the incident communication plan to require approval from the incident commander before any external communication.. Option A is correct because the SOC manager is designated as the primary point of contact for all communication per the incident response plan, and the analyst must first report the unauthorized communication to the SOC manager to ensure proper escalation and documentation. This aligns with the strict communication policy requiring incident commander approval for external statements, and it preserves the chain of command while the incident commander is unavailable. Reporting the breach of protocol allows the SOC manager to initiate corrective actions, such as updating the communication plan, without the analyst exceeding their authority or making unauthorized statements.

Answer

Inform the marketing department that their post was premature and potentially inaccurate, and ask them to remove it immediately.

Answer

Post a correction on the company's social media account to clarify that the investigation is ongoing.

Answer

Ignore the post because it helps maintain customer confidence.

Question 13

A security analyst discovers that a data breach involving personally identifiable information (PII) of European Union citizens occurred two weeks ago but was not detected until now due to a monitoring gap. The company is subject to GDPR, which requires notification to the relevant supervisory authority within 72 hours of becoming aware of the breach. The analyst reports this to the CISO, who decides to delay notification for another week to prepare a more comprehensive response. The analyst believes this violates regulatory requirements. The analyst has documented the breach details and is concerned about the legal and financial penalties for non-compliance. The company's legal department has a strong compliance focus. The analyst has a duty to escalate within the organization. The organization has a whistleblower policy and an ethics hotline. What should the analyst do?

Accepted Answer

Escalate the matter to the company's legal department and explain the regulatory requirement for timely notification.. Option B is correct because the analyst has a duty to escalate within the organization, and the legal department is the appropriate internal authority to address compliance with GDPR's 72-hour notification requirement. By escalating to legal, the analyst ensures the regulatory obligation is formally raised without bypassing internal hierarchy, which aligns with the company's compliance focus and whistleblower policy. This approach balances the CISO's decision with the legal imperative to notify the supervisory authority within the mandated timeframe.

Answer

Document the decision and the delay, then proceed with the notification after one week as instructed.

Answer

Report the incident to the data protection authority (DPA) immediately, bypassing the CISO, as required by GDPR.

Answer

Follow the CISO's orders and delay the notification.

Question 14

A security analyst needs to communicate the results of a vulnerability scan to different stakeholders. Which TWO of the following are appropriate reporting formats for executive-level stakeholders?

Accepted Answer

A one-page executive summary with risk ratings and business impact. Executive-level stakeholders require high-level, business-focused information to make strategic decisions. A one-page executive summary with risk ratings and business impact (Option A) provides a concise overview of the most critical vulnerabilities, their potential effect on operations, and recommended actions without technical jargon. A dashboard showing trend analysis and high-level metrics (Option B) allows executives to quickly assess the organization's security posture over time, track remediation progress, and identify emerging risks through visual data.

Answer

A detailed remediation checklist for system administrators

Answer

A raw output from the vulnerability scanner

Answer

A technical report listing CVSS scores and exploit details

Question 15

Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?

Accepted Answer

Check the baseline behavior of the source IP. Option B is correct because the first step in incident response is to validate whether the activity is malicious by comparing it against a known baseline. Repeated entries from the same source IP could indicate a benign automated process (e.g., a legitimate monitoring tool or scheduled scan) rather than an attack. Checking the baseline behavior prevents unnecessary disruption and aligns with the NIST SP 800-61 incident response framework's emphasis on identification and analysis before containment.

Answer

Immediately block the source IP at the firewall

Answer

Update the signature database

Answer

Isolate the affected system for forensic analysis