CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Number of failed login attempts in the last 24 hours

  Why it's wrong here

  While failed login attempts can signal brute-force attacks or credential misuse, they are an operational security telemetry metric rather than a compliance indicator. Access control compliance focuses on the state of user entitlements, such as whether permissions match job roles and whether accounts are properly authorized. A high failure count does not, by itself, prove that access controls are non-compliant, and it is not directly tied to regulatory requirements like periodic reviews or least privilege.

• ✗

  Number of critical vulnerabilities in network devices

  Why it's wrong here

  Critical vulnerabilities in network devices fall under vulnerability management and patch management, which are separate domains from access control. This metric measures the effectiveness of the organization's patching program and risk posture, not whether users have appropriate authorization or authentication policies are enforced. While vulnerabilities can lead to access compromise, they do not indicate whether access control mechanisms themselves are compliant with frameworks like PCI DSS or SOX.

• ✓

  Number of active user accounts with privileged access

  Why this is correct

  The number of active user accounts with privileged access is a direct measure of the privileged access attack surface and is explicitly required to be tracked by many compliance frameworks. For instance, PCI DSS Requirement 10.8 mandates logging and monitoring of access to privileged accounts, and knowing the exact count is essential for access recertification and segregation of duties. This metric enables auditors to verify that privileged access is controlled, monitored, and limited to authorized personnel.

• ✓

  Percentage of accounts that have been inactive for more than 90 days

  Why this is correct

  The percentage of accounts inactive for over 90 days is a compliance metric because dormant accounts are a common vector for unauthorized access and often violate account lifecycle policies. Regulations such as PCI DSS require that inactive user accounts be disabled or removed within a defined period, and this metric provides evidence that such reclamation is happening. Tracking this percentage helps demonstrate that the organization is actively managing its user base and minimizing standing privileges.

• ✓

  Percentage of accounts that have undergone access review in the last quarter

  Why this is correct

  The percentage of accounts that have undergone access review in the last quarter reflects compliance with periodic access recertification requirements, such as those in PCI DSS Requirement 7.2.2, which mandates quarterly reviews of access rights. This metric shows whether the access review process is being executed on schedule and whether any discrepancies are being addressed. Without this metric, an organization cannot prove to auditors that access rights are being validated against job responsibilities on a recurring basis.

Go deeper

Related to this question