CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Network flow data

  Why it's wrong here

  This data captures metadata about network communications, such as source/destination IPs, ports, protocols, and traffic volumes, but it does not directly show user identity, permissions, or whether access controls were properly enforced. It can indirectly suggest anomalous access patterns (e.g., unusual data exfiltration) but lacks the granularity of user-level access logs or authorization decisions. Therefore, it is not considered primary evidence for an access control audit.

• ✓

  Access review documentation

  Why this is correct

  This is the strongest evidence because it demonstrates a formal, recurring process where managers or data owners explicitly certify which users have access to which systems and data, and whether that access remains appropriate. It shows that the organization systematically validates least privilege, detects orphaned accounts, and documents corrective actions after each review cycle. Auditors expect to see these review records to prove that access rights are not just assigned but continuously governed.

• ✓

  Vulnerability scan reports

  Why this is correct

  These reports can highlight technical weaknesses in access controls, such as misconfigured permissions, default credentials, or missing patches on systems that enforce authentication/authorization. However, they are point-in-time technical assessments and do not by themselves prove that access policies were followed or that user access was reviewed by the business. They serve as supporting evidence, helping to show that the organization actively looks for and remediates access control gaps, but they do not replace user certification evidence.

• ✓

  Log exports of user access events

  Why this is correct

  These logs provide a historical record of actual access attempts, including successful and failed authentications, source IPs, and resource accesses, which can be correlated with access decisions. They are critical for verifying that permissions were used in practice and for detecting unauthorized activity, but they are raw data and require analysis and context to be meaningful. Auditors value them as proof of monitoring and detective controls, but they do not inherently demonstrate that the access rights themselves were properly reviewed and justified.

• ✗

  Incident response reports

  Why it's wrong here

  These documents describe how security incidents were detected, contained, and remediated, and they may reference access control failures, but they are event-driven and only cover specific anomalies. They do not provide a systematic view of user access permissions or evidence of regular access reviews. Therefore, they are not suitable as primary evidence for an access control audit, though they might supplement a narrative about improvements made after an incident.

Go deeper

Related to this question