CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Remediation timeline

  Why it's wrong here

  This section defines the specific schedule, milestones, and deadlines for patching or mitigating identified vulnerabilities based on SLA requirements. While it is crucial for tracking operational progress, it does not synthesize or summarize the overall critical risk posture of the organization for high-level stakeholders.

• ✗

  Risk acceptance

  Why it's wrong here

  This section formally documents the organization's conscious decision to tolerate specific vulnerabilities without immediate mitigation, typically due to high remediation costs or low business impact. It serves as a compliance and governance record rather than a high-level synthesis of the most critical threats discovered during the assessment.

• ✗

  Findings by severity

  Why it's wrong here

  This technical section categorizes every discovered vulnerability into tiers like critical, high, medium, or low to help security teams prioritize their patching efforts. However, this granular breakdown is too detailed and operationally focused to serve as a concise, high-level overview tailored for non-technical decision-makers.

• ✓

  Executive summary

  Why this is correct

  This section is designed specifically for leadership and non-technical stakeholders, distilling complex technical findings into a high-level overview of critical risks, business impacts, and strategic recommendations. It provides the necessary context for resource allocation and risk management decisions without overwhelming the reader with granular vulnerability data.

Go deeper

Related to this question