CS0-003 Reporting and Communication — Timed 20 Questions

Question 1

A CISO wants a concise incident update during active containment. Which elements should be included? (Choose three.)

Accepted Answer

Containment actions completed and pending. During active containment, the CISO needs a concise update focused on actions taken and pending, not raw data. Option B is correct because containment actions completed and pending directly inform the CISO of the current response status, enabling rapid decision-making without sifting through logs.

Answer

Every raw log line collected so far

Question 2

A vulnerability dashboard for executives should avoid raw technical overload. Which views are useful? (Choose two.)

Accepted Answer

Critical exposure trend by business service. Option C is correct because executive dashboards must communicate risk in business terms, not technical raw data. A trend of critical exposures by business service translates vulnerability severity into operational impact, enabling prioritization of remediation resources without requiring technical expertise. This aligns with the Reporting and Communication domain's emphasis on tailoring information to the audience.

Answer

A list of scanner process IDs

Answer

Unfiltered plugin-output text

Question 3

When briefing legal and privacy teams after a suspected data exposure, which details matter? (Choose two.)

Accepted Answer

Data types and jurisdictions potentially affected. Data types (e.g., PII, PHI, PCI) and affected jurisdictions determine legal notification obligations under regulations like GDPR, HIPAA, or CCPA. Jurisdictions dictate breach notification timelines and penalties, making this information critical for legal and privacy teams to assess risk and compliance. Without this detail, the response cannot be properly scoped or legally defensible.

Answer

A complete list of unrelated server patches

Answer

Speculation about attacker identity without evidence

Question 4

A remediation report shows repeated SLA breaches by one business unit. Which recommendations are appropriate? (Choose two.)

Accepted Answer

Review ownership, resourcing, and change-window constraints. Option B is correct because reviewing ownership, resourcing, and change-window constraints directly addresses the root causes of repeated SLA breaches. SLA breaches often stem from inadequate staffing, misaligned change windows, or unclear ownership of remediation tasks, not from technical failures alone. This recommendation aligns with the reporting and communication domain's emphasis on actionable, root-cause analysis rather than superficial fixes.

Answer

Automatically accept all future risk permanently

Answer

Hide the business unit from future reports

Question 5

Which items help make a post-incident report useful for technical teams? (Choose two.)

Accepted Answer

Root cause and exploited control gaps. Option C is correct because a post-incident report must include the root cause and exploited control gaps to enable technical teams to implement targeted remediation. Without identifying the specific vulnerability (e.g., unpatched CVE, misconfigured firewall rule, weak authentication mechanism) and the control failure that allowed the exploit, the report lacks actionable intelligence for hardening defenses.

Answer

Generic motivational slogans

Answer

Unrelated financial forecasts

Question 6

A third-party supplier needs incident information to fix an integration. What should be shared? (Choose two.)

Accepted Answer

Required remediation outcome and deadline. Option C is correct because sharing the required remediation outcome and deadline ensures the third-party supplier understands the expected fix and urgency, aligning with incident response communication best practices. This enables the supplier to prioritize their work and deliver a solution that meets the organization's security and operational requirements, without exposing unnecessary internal details.

Answer

Internal blame discussions

Answer

Credentials for unrelated systems

Question 7

Which metrics best show SOC detection and response effectiveness? (Choose two.)

Accepted Answer

Mean time to detect. Mean time to detect (MTTD) directly measures how quickly the SOC identifies a security incident from the initial compromise, reflecting the efficiency of detection tools like SIEM and EDR. A lower MTTD indicates faster threat discovery, which is critical for minimizing dwell time and reducing potential damage.

Answer

Number of office printers

Answer

Total number of email signatures

Question 8

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option B is correct because it directly answers the board's question about whether cyber risk is decreasing by presenting a trend in exploitable critical exposures (showing if the number of high-risk vulnerabilities is going down), remediation SLA performance (proving the team is fixing issues within policy), and residual risk by business service (quantifying the remaining risk to critical assets). This combination provides a clear, measurable, and business-aligned view of risk reduction over time, which is exactly what executive leadership needs to make informed decisions.

Answer

A raw CSV of 20,000 findings

Answer

A list of tool login names

Answer

A screenshot of every scanner page

Question 9

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. Option D is correct because a post-incident finding of an unowned alert integration indicates a process gap that must be closed with a named owner, a due date, acceptance criteria, and a retest plan. This ensures accountability, a measurable fix, and verification that the integration is properly configured and monitored, preventing future failures.

Answer

No action because the incident is closed

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record

Question 10

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Option A is correct because an executive summary for a SOC manager must focus on business risk, customer impact, remediation status, and remaining exposure. Since no exploitation was found, the emphasis shifts to the potential impact and the steps taken to mitigate the vulnerability, aligning with the SOC manager's need to communicate risk to leadership and prioritize resources.

Answer

Every command the scanner executed

Answer

Raw packet captures from the scan

Answer

A list of analyst shift times only

Question 11

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option C is correct because a technical remediation section must provide actionable steps to resolve the vulnerability. This includes identifying affected assets and package versions, specifying patch commands or vendor guidance, outlining a validation method (e.g., checking the OpenSSL version with `openssl version`), and including rollback notes to revert changes if the patch fails. Without these details, the remediation cannot be executed reliably by the server team.

Answer

Only estimated financial loss

Answer

Only the CVE headline

Answer

Only a red/yellow/green chart

Question 12

A vulnerability report is going to system owners. Which elements make it actionable? (Choose three.)

Accepted Answer

Affected assets and owners. Option B is correct because identifying affected assets and their owners is essential for accountability and remediation. Without this information, system owners cannot determine which systems require patching or configuration changes, making the report non-actionable. This aligns with the NIST SP 800-40 Rev. 4 guidance on vulnerability management, which emphasizes asset ownership as a prerequisite for response.

Answer

Only a generic statement that risk exists

Question 13

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Option D is correct because Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), containment time, and recurrence rate are standard, quantifiable metrics that directly measure the efficiency and effectiveness of an incident response program. These metrics allow the CISO to track improvements quarter over quarter by showing whether the team is detecting and containing incidents faster and with fewer repeat events. For a legal/privacy audience, these metrics are also critical because they demonstrate due diligence, regulatory compliance, and risk reduction in measurable terms.

Answer

Number of unused dashboards

Answer

Total coffee consumed by analysts

Answer

Number of desktop wallpapers changed

Question 14

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. Option A is correct because an SLA compliance report by severity, asset owner, and business unit directly maps to the requirement of showing whether critical findings are fixed within policy timelines. This report allows the vulnerability program to track remediation against defined service-level agreements (SLAs), and the breakdown by business unit and asset owner provides the business service owner with actionable, ownership-specific data to drive accountability and resource allocation.

Answer

A report sorted only by scanner plugin ID

Answer

A vendor price comparison

Answer

A list of all closed tickets with no dates

Question 15

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option D is correct because when a business owner accepts delayed remediation for a production system, the report must formally document the risk acceptance. This includes the risk owner, the reason for acceptance, any compensating controls in place, a scheduled review date, and an expiry date for the exception. This ensures traceability, accountability, and that the risk is not forgotten, aligning with governance frameworks like NIST SP 800-37 or ISO 27001.

Answer

Only the analyst's personal opinion

Answer

A permanent exception with no review

Answer

No mention of the accepted risk

Question 16

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. Option A is correct because executive leadership requires a concise, actionable summary that focuses on business impact and remediation steps, not technical details. The communication must include the timeline of the outage, service impact (e.g., affected systems, downtime duration), evidence (e.g., logs, monitoring data), required corrective actions from the vendor, and contractual follow-up (e.g., SLA breach, penalties). This aligns with the NIST Incident Response framework's post-incident activity phase, where clear accountability and remediation are critical for vendor management.

Answer

Internal blame speculation

Answer

A public press statement draft first

Answer

Confidential unrelated customer data

Question 17

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option D is correct because it directly answers the board's question about whether cyber risk is decreasing by showing a trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. This provides a clear, quantitative, and business-aligned view of risk reduction, which is essential for executive reporting. For a technical remediation owner, this content is most appropriate as it focuses on actionable metrics (e.g., SLA compliance, residual risk per service) that directly guide patching and mitigation priorities.

Answer

A raw CSV of 20,000 findings

Answer

A screenshot of every scanner page

Answer

A list of tool login names

Question 18

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. Option C is correct because a post-incident report identifying an unowned failed alert integration requires a corrective action that assigns clear accountability and a measurable remediation plan. Naming an owner, setting a due date, defining acceptance criteria, and scheduling a retest ensure the integration is properly configured and monitored, directly addressing the root cause of the alert failure. This aligns with the NIST Incident Response Lifecycle's post-incident activity phase, which mandates actionable follow-up items to prevent recurrence.

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record

Answer

No action because the incident is closed

Question 19

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Option B is correct because the executive summary for a business service owner must focus on business risk, customer impact, remediation status, and remaining exposure. Since no exploitation was found, the key message is the potential business impact and the current state of remediation, not technical details. This aligns with the Reporting and Communication domain, where the audience requires actionable business-level information.

Answer

A list of analyst shift times only

Answer

Every command the scanner executed

Answer

Raw packet captures from the scan

Question 20

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option B is correct because a technical remediation section for an OpenSSL vulnerability must include specific, actionable steps: affected assets and package versions to identify scope, patch commands or vendor guidance to apply the fix, a validation method (e.g., openssl version -a or a vulnerability scanner) to confirm remediation, and rollback notes for safety. This ensures the SOC manager can direct the server team with precise, auditable instructions, aligning with the Reporting and Communication domain's requirement for clear, technical content in incident response.

Answer

Only estimated financial loss

Answer

Only the CVE headline

Answer

Only a red/yellow/green chart