CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Open vulnerability counts by severity

  Why this is correct

  Tracks the number of unresolved vulnerabilities broken down by CVSS severity level (e.g., critical, high, medium, low). This is a core patch-management metric because it directly reflects the current attack-surface exposure and backlog of unpatched systems, which compliance frameworks typically require to be monitored and reduced over time.

• ✗

  Security incidents by category

  Why it's wrong here

  Security incidents by category (e.g., malware, unauthorized access, DDoS) provide a high-level view of what has successfully compromised the environment. However, incident counts are outcome-based and can be affected by many controls beyond patching, so they do not specifically measure patch coverage, timeliness, or completeness. For a compliance dashboard focused on patch management, this metric would be too broad and indirect.

• ✓

  Patch SLA compliance %

  Why this is correct

  Patch SLA compliance % calculates the proportion of patches that were applied within a defined service-level agreement window (e.g., critical patches within 72 hours, high within 7 days). It is a direct measure of operational discipline and regulatory adherence, since many standards mandate maximum allowable time frames for remediation. High compliance indicates both good process and low exposure to known vulnerabilities.

• ✗

  Mean time to detect (MTTD)

  Why it's wrong here

  Mean time to detect (MTTD) measures the average duration between when a threat first compromises a system and when it is noticed by security monitoring. It is fundamentally a detection metric tied to visibility and analytics, not a metric for patch management or vulnerability remediation. Including it would evaluate the SOC's alerting efficiency rather than the patching pipeline's speed or completeness.

• ✗

  Phishing simulation click rates

  Why it's wrong here

  Phishing simulation click rates measure how often employees fall for simulated malicious emails, reflecting the effectiveness of security awareness training. This metric belongs to a human-centric security program, not to patch management, which is about applying vendor-supplied fixes to systems. On a compliance dashboard for patching, it would provide no information about vulnerability backlog, patch SLA adherence, or unpatched hosts.

Go deeper

Related to this question