CS0-003 Reporting and Communication Practice Question
An incident report includes a section that details the sequence of events from initial compromise to containment. Which component of the incident report does this describe?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Timeline
The timeline component chronologically documents the incident's progression.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Impact assessment
Why it's wrong here
Impact assessment focuses on quantifying the extent of damage, data loss, operational downtime, and financial costs resulting from an incident. It does not narrate the chronological order of events; rather, it evaluates the aftermath and business impact. While important for prioritizing response, it lacks the event-by-event sequencing that characterizes a timeline.
- ✗
Root cause
Why it's wrong here
Root cause analysis seeks to determine the fundamental reason an incident occurred, such as a misconfiguration, unpatched vulnerability, or human error. It involves causal analysis and often uses tools like '5 Whys' or fault tree analysis, but it does not record the sequence of events as they unfolded. Even if a timeline supports the analysis, the root cause itself is a conclusion, not a chronological narrative.
- ✗
Lessons learned
Why it's wrong here
Lessons learned is a post-incident review process that captures insights, strengths, weaknesses, and recommended improvements for future response. It typically occurs after the incident is fully resolved and is forward-looking, whereas a timeline is a factual, time-ordered record that is often created during or immediately after the incident. The section that 'details the sequence' is not evaluative but descriptive, making lessons learned an incorrect classification.
- ✓
Timeline
Why this is correct
A timeline is a chronological, time-stamped listing of events, actions, observations, and findings that occurred during an incident. It is a foundational component of incident documentation because it establishes the order and timing of events, supporting correlation of security events and response actions. In an incident report, the section 'detailing the sequence' directly maps to the timeline's purpose of recording events in sequence.
Go deeper
Related to this question
Learn chapter
Incident Categories and Severity
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.