CS0-003 Reporting and Communication Practice Question
A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recent access review reports
Access review reports and user account audit logs directly demonstrate access control implementation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Recent access review reports
Why this is correct
Access review reports are a direct artifact of an identity governance process, showing that the organization periodically re-certifies user entitlements against current roles and business need. Because the reports are generated from actual access decisions and reviews, they demonstrate that the access-control control is operating as intended, which is exactly the type of evidence a compliance auditor expects to see.
- ✗
A network topology diagram
Why it's wrong here
A network topology diagram illustrates how network segments, hosts, and security devices are connected, but it cannot show whether any access-control policy is enforced or whether a user can actually reach a given resource. It is a design document, not an operational record, so it fails to provide proof that access controls are implemented, configured, or reviewed.
- ✓
User account audit logs showing privilege changes
Why this is correct
User account audit logs that capture privilege changes, such as the user, timestamp, and old/new permissions, provide concrete evidence that the account management control is functioning. These logs allow an auditor to verify that access changes were authorized, followed the approved change process, and were recorded in real time, making them a strong technical proof of control enforcement.
- ✗
A list of all employees
Why it's wrong here
A list of all employees merely enumerates individuals within the organization and does not associate any person with specific permissions, roles, or system entitlements. Without that mapping, the list cannot demonstrate that any access-control mechanism exists, is configured, or is being reviewed, so it is irrelevant to a compliance assessment of access controls.
- ✗
The company's password policy
Why it's wrong here
The password policy states the required complexity, length, rotation, and MFA rules, but it is only a written document describing intended behavior. Compliance auditors require evidence that those rules are actually enforced by the technical system—such as password-policy settings in Active Directory or MFA enforcement logs—so the policy alone is insufficient as proof of implementation.
Go deeper
Related to this question
Learn chapter
Digital Forensic Evidence Collection
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Access review
An access review is a periodic audit process where administrators check and confirm which users have permissions to what resources, ensuring only authorized people retain access.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.