CS0-003 Reporting and Communication Practice Question
A vulnerability report includes a risk acceptance section. Which of the following scenarios is most appropriate to include in this section?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A medium-severity vulnerability with a compensating control that reduces risk to acceptable levels
Risk acceptance is documented when the organization decides not to remediate a vulnerability due to compensating controls or low risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A vulnerability that has been exploited in the wild
Why it's wrong here
A vulnerability already being exploited in the wild represents active, ongoing risk realization, not a candidate for risk acceptance. This scenario demands immediate remediation or compensating controls, since accepting the risk would mean knowingly tolerating an active attack vector.
- ✗
A critical vulnerability that has been patched
Why it's wrong here
A critical vulnerability that has already been patched is a remediated, closed finding, not an open risk requiring a decision. Risk acceptance only applies to unresolved exposure, so a resolved vulnerability has nothing left to accept and should not appear in this section at all.
- ✗
All open vulnerabilities regardless of severity
Why it's wrong here
Blanket acceptance of every open vulnerability regardless of severity undermines the entire purpose of risk-based prioritization and would almost certainly violate an organization's risk management policy or compliance obligations. Acceptance decisions must be made individually, with documented justification tied to specific risk factors for each finding.
- ✓
A medium-severity vulnerability with a compensating control that reduces risk to acceptable levels
Why this is correct
This is the textbook risk acceptance scenario because the medium severity keeps residual exposure within a tolerable range, and the compensating control, such as network segmentation or restricted access, provides documented, measurable risk reduction that justifies formally accepting rather than remediating the underlying vulnerability.
Go deeper
Related to this question
Learn chapter
Cloud Vulnerability Management
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Risk acceptance
Risk acceptance is a risk management strategy where an organization acknowledges a potential risk but decides to tolerate it without taking active measures to reduce or eliminate it.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.