CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Network topology diagrams

  Why it's wrong here

  Network topology diagrams reveal the arrangement of subnets, firewalls, and hosts, which helps auditors understand the scope of the environment, but they do not capture vulnerability findings, severity ratings, or remediation timelines. Compliance audits for vulnerability management demand evidence of the ongoing detection and mitigation process, such as scan outputs or patch records, not just architectural blueprints. Without timestamps or vulnerability identifiers, these diagrams cannot substantiate that the organization has actively identified and addressed known weaknesses.

• ✗

  Employee training logs

  Why it's wrong here

  Employee training logs document security awareness sessions and phishing simulations, yet they fail to demonstrate the technical lifecycle of vulnerability management, including discovery, risk ranking, and patch deployment. Auditors seeking compliance with vulnerability management requirements need artifacts that show system-level scanning and remediation, not personnel attendance records. Training records might support a governance framework, but they are not a substitute for scan reports or change management evidence.

• ✓

  Vulnerability scan reports

  Why this is correct

  Vulnerability scan reports are the primary evidence that an organization is actively discovering weaknesses, as they contain the scan timestamp, authenticated or unauthenticated scan type, CVEs, and CVSS severity scores. They allow auditors to correlate the identified vulnerabilities against the organization's asset inventory and check that coverage includes critical systems. A series of scan reports demonstrates the continuous, recurring nature of the program, which is a core requirement of many compliance frameworks.

• ✓

  Patch management reports

  Why this is correct

  Patch management reports prove that vulnerabilities identified by scans have been remediated, citing the patch deployment dates, affected host groups, and any approved exceptions for deferred patches. These reports close the loop on the vulnerability management lifecycle, showing that the organization moved beyond detection to remediation in a controlled and documented manner. Auditors use them to verify that patches were applied within the required service-level agreements and that mitigating controls were implemented when patches were delayed.

• ✗

  Incident response playbooks

  Why it's wrong here

  Incident response playbooks provide step-by-step procedures for containing and eradicating threats during an active breach, but they are not records of audit-driven vulnerability management activities. These documents are static and only become relevant when something goes wrong, whereas vulnerability management requires periodic, evidence-based proof of scanning and patching. While they indicate a mature security operations capability, they cannot demonstrate that the organization has been consistently identifying and fixing vulnerabilities across its environment.

Go deeper

Related to this question