CS0-003 Reporting and Communication Practice Question
A security analyst is creating a risk register. Which of the following is the most important element to include for each risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Likelihood and impact rating
A risk register should include risk owner, likelihood, impact, and mitigation status. Likelihood and impact help prioritize risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Likelihood and impact rating
Why this is correct
A risk register must prioritize threats to allocate mitigation resources effectively. Calculating the likelihood of occurrence alongside the potential business impact allows analysts to derive a qualitative or quantitative risk rating, which is the foundational metric for risk-based decision-making.
- ✗
The exact date the risk was identified
Why it's wrong here
While tracking the discovery date helps monitor remediation timelines and service-level agreement compliance, it does not assist in evaluating the severity or priority of the risk itself. A risk register's primary function is to categorize and rank risks, making temporal metadata secondary to impact analysis.
- ✗
The name of the person who discovered the risk
Why it's wrong here
Documenting the individual who identified a risk provides administrative traceability but does not contribute to the technical or business evaluation of the threat. While risk ownership and remediation responsibility are critical, the initial discoverer's identity is merely administrative metadata that does not aid in prioritization.
- ✗
The CVSS score of related vulnerabilities
Why it's wrong here
Common Vulnerability Scoring System (CVSS) scores reflect the technical severity of a vulnerability in isolation, whereas a risk register must evaluate risk within the specific context of the organization's environment, controls, and business impact. A high CVSS score does not automatically translate to high organizational risk if compensating controls are active.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
Mitigation
Mitigation is the process of reducing the severity, impact, or likelihood of a security threat or vulnerability.
Key term
Impact
Impact is the measure of the potential damage or harm that a risk event could cause to an organization's assets, operations, or reputation.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.