CS0-003 Reporting and Communication Practice Question
A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)
⚠ Common exam trap
CS0-004 often tests the difference between policy/design documents (which describe intent) and operational evidence (which proves controls actually ran) — candidates pick the password policy because it sounds security-relevant but it is not audit evidence of access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recent access review reports
Option A (Recent access review reports) is correct because access reviews document the periodic recertification of user permissions, directly demonstrating that access controls are being enforced and validated, which is exactly the type of evidence an auditor seeks for access control compliance. Option C (User account audit logs showing privilege changes) is correct because audit logs provide a verifiable, timestamped record of when privileges were granted, modified, or revoked, serving as concrete technical evidence that access control mechanisms are functioning. Option B (A network topology diagram) is not correct because it illustrates infrastructure layout and data flows, not access control enforcement or user permissions. Option D (A list of all employees) is not correct because it merely enumerates personnel and does not show how access is granted, restricted, or reviewed. Option E (The company's password policy) is not correct because a policy is a documented intent or requirement, not evidence that access controls are actually implemented or operating effectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Recent access review reports
Why this is correct
Access review reports are a direct artifact of an identity governance process, showing that the organization periodically re-certifies user entitlements against current roles and business need. Because the reports are generated from actual access decisions and reviews, they demonstrate that the access-control control is operating as intended, which is exactly the type of evidence a compliance auditor expects to see.
- ✗
A network topology diagram
Why it's wrong here
A network topology diagram illustrates how network segments, hosts, and security devices are connected, but it cannot show whether any access-control policy is enforced or whether a user can actually reach a given resource. It is a design document, not an operational record, so it fails to provide proof that access controls are implemented, configured, or reviewed.
- ✓
User account audit logs showing privilege changes
Why this is correct
User account audit logs that capture privilege changes, such as the user, timestamp, and old/new permissions, provide concrete evidence that the account management control is functioning. These logs allow an auditor to verify that access changes were authorized, followed the approved change process, and were recorded in real time, making them a strong technical proof of control enforcement.
- ✗
A list of all employees
Why it's wrong here
A list of all employees merely enumerates individuals within the organization and does not associate any person with specific permissions, roles, or system entitlements. Without that mapping, the list cannot demonstrate that any access-control mechanism exists, is configured, or is being reviewed, so it is irrelevant to a compliance assessment of access controls.
- ✗
The company's password policy
Why it's wrong here
The password policy states the required complexity, length, rotation, and MFA rules, but it is only a written document describing intended behavior. Compliance auditors require evidence that those rules are actually enforced by the technical system—such as password-policy settings in Active Directory or MFA enforcement logs—so the policy alone is insufficient as proof of implementation.
Go deeper
Related to this question
Learn chapter
Security Architecture Review for Analysts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.