CS0-003 Reporting and Communication Practice Question
After a ransomware incident, the incident report includes lessons learned. Which of the following is the BEST example of a lesson learned?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement multi-factor authentication for remote access to reduce risk.
Lessons learned should be actionable recommendations to prevent recurrence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ransomware encrypted 500 files.
Why it's wrong here
This is a quantitative impact metric that belongs in the impact assessment section of an incident report. It describes the damage caused but does not offer any forward-looking security improvement. Lessons learned should drive changes to policies, processes, or controls, not merely restate the scale of the incident. As a static data point, it fails to guide future prevention or detection.
- ✗
The incident started at 2:00 AM.
Why it's wrong here
This is a chronological fact recorded in the timeline section, used to reconstruct the sequence of events and establish detection and response times. The specific time itself has no prescriptive value unless it reveals a pattern, such as off-hours targeting, but standalone it does not constitute a recommendation. A lesson learned would interpret the timeline to identify a process gap, not just list a timestamp.
- ✗
The root cause was a phishing email.
Why it's wrong here
While identifying the initial infection vector is a crucial finding from root cause analysis, stating the cause alone does not address the control failure that allowed the phishing email to succeed. A recommendation must pair the cause with a remediation action, such as improving email filtering or security awareness training. The root cause section explains how the breach occurred, but the lessons learned section must translate that into risk-reducing measures.
- ✓
Implement multi-factor authentication for remote access to reduce risk.
Why this is correct
This is a concrete, actionable recommendation that directly addresses a common attack vector used in ransomware incidents, such as compromised VPN credentials. It specifies the control (MFA), the scope (remote access), and the goal (risk reduction), making it a proper lesson learned. Unlike observations or causes, it provides a clear implementation step that stakeholders can act on to harden their environment.
Go deeper
Related to this question
Learn chapter
Incident Categories and Severity
Key term
Lessons learned
Lessons learned is the process of capturing, analyzing, and documenting knowledge gained from past incidents or projects to improve future security operations and prevent recurrence of problems.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.