CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Raw CVSS scores for all vulnerabilities

  Why it's wrong here

  Raw CVSS scores are quantitative metrics that require contextual interpretation; a list of scores without asset criticality, threat intel, or business impact is meaningless to executives. Aggregating and prioritizing scores is the analyst's job, and dumping raw numbers shifts that burden to a non-technical audience. An executive summary should instead present a risk-ranked view that accounts for compensating controls and organizational context.

• ✗

  Detailed technical description of each vulnerability

  Why it's wrong here

  Detailed technical descriptions expose attack paths, dependencies, and exploit mechanics, which are essential for remediation teams but not for executive decision-making. Executives need the technical severity translated into business terms—legal exposure, financial impact, or regulatory compliance—not the inner workings of a buffer overflow or misconfigured S3 bucket. Including such granularity consumes the reader's attention and obscures the strategic messages that require governance action.

• ✗

  Network topology diagrams

  Why it's wrong here

  Network topology diagrams illustrate where vulnerabilities reside and how attackers might propagate, but they are operational tools for IT staff to plan mitigations, not strategic decision aids for management. An executive summary should convey the risk level, resource allocation, and required approvals, not segment layout or firewall placement. Placing these diagrams in an appendix supports the technical appendix without diluting the executive-appropriate narrative.

• ✓

  Overall risk posture summary

  Why this is correct

  An overall risk posture summary aggregates findings into a concise, qualitative rating—such as high/medium/low—or a weighted risk score that reflects the organization's relative exposure. This gives management a rapid understanding of whether immediate attention is required and how the current risk compares to prior assessments or industry benchmarks. It directly enables informed, risk-based decisions about prioritizing remediation efforts and allocating resources.

• ✓

  Key findings that require management attention

  Why this is correct

  Key findings requiring management attention are those few, high-impact items that demand executive judgment—such as critical asset exposures, compliance violations, or risks that exceed the organizational risk appetite. These findings are framed in business context and often include recommended strategic responses, such as budget approvals, risk acceptance, or vendor actions. This ensures the executive summary drives governance and accountability rather than merely presenting status.

Go deeper

Related to this question