CS0-003 Reporting and Communication Practice Question
A security analyst is preparing an incident report after a ransomware attack. Which two components must be included in the report? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Root cause analysis
An incident report should include a timeline of events, impact assessment, root cause, lessons learned, and recommendations. Timeline and root cause are essential.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Resume of the incident responder
Why it's wrong here
A resume documents an individual's professional history and qualifications; it is not part of the incident report, which should focus on facts, evidence, impact, and response activities. Including HR material would distract from the technical narrative and violate the report's intent as a record of the incident, not the credentials of the analyst.
- ✓
Root cause analysis
Why this is correct
Root cause analysis identifies the fundamental vulnerability or error that enabled the incident, forming the basis for remediation and preventive measures. An incident report is incomplete without it because understanding what went wrong is critical to preventing recurrence and fulfilling regulatory and organizational requirements.
- ✗
Marketing department's budget
Why it's wrong here
The marketing department's budget is a financial planning figure with no relevance to the security event. An incident report should contain only technical, operational, and business-impact information directly tied to the incident; unrelated budget data would only introduce noise and potentially confuse stakeholders.
- ✓
Timeline of the incident
Why this is correct
A detailed timeline maps all observed events, from initial compromise through detection, containment, eradication, and recovery, which is essential for understanding the sequence and speed of response. It also supports forensic correlation and helps analysts identify where security controls failed or where actions were delayed.
- ✗
Software license keys
Why it's wrong here
Software license keys are confidential credential material associated with product activation, not with documenting an incident. Including them in a report increases the risk of accidental exposure and violates data-minimization principles; the report should stay at the level of system names, versions, and affected assets, without leaking secrets.
Go deeper
Related to this question
Learn chapter
Incident Categories and Severity
Key term
Impact
Impact is the measure of the potential damage or harm that a risk event could cause to an organization's assets, operations, or reputation.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.