CS0-003 Reporting and Communication Practice Question
During a security incident, a cybersecurity analyst must communicate with various stakeholders. Which TWO are appropriate internal escalation paths? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Legal and compliance department
Internal escalation typically goes to the incident response team for technical handling and to legal/compliance for regulatory and liability issues. Law enforcement is external, and customers are external as well.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Legal and compliance department
Why this is correct
The legal and compliance department is the correct first point of contact because it ensures the organization satisfies statutory and regulatory breach notification obligations (e.g., GDPR, HIPAA, SEC rules) before any public or external disclosure. They also provide legal counsel on preservation of evidence and attorney-client privilege, which directly influences containment and eradication actions. Engaging this internal team early prevents costly penalties and legal exposure from mishandled incident response.
- ✗
Law enforcement
Why it's wrong here
Law enforcement is an external entity, not an internal stakeholder, and contacting them directly during an active incident without legal guidance can create jurisdictional conflicts, compromise the integrity of digital evidence, or waive legal protections. In most response frameworks, law enforcement is contacted only after the incident has been assessed, containment is underway, and legal counsel approves the disclosure. Therefore, a cybersecurity analyst should first involve internal stakeholders, not outside agencies, to avoid premature or unauthorized information sharing.
- ✗
Customers
Why it's wrong here
Customers are external stakeholders who should not be notified by a cybersecurity analyst during the immediate incident response. Premature notification can cause panic, violate confidentiality agreements, or breach regulatory notification rules that require specific timelines and methods managed by legal and compliance. Proper practice is to first contain and assess the incident, then prepare customer notifications through approved channels after legal and executive review, ensuring accurate and lawful messaging.
- ✓
Incident response team
Why this is correct
The incident response team is the primary internal group responsible for the technical execution of the incident response plan, including detection, containment, eradication, and recovery. They are correct to involve because their swift action limits damage and preserves forensic evidence, and they serve as the operational core that coordinates with legal and other departments. Their role is distinct from legal and compliance, as they focus on technical mitigation rather than regulatory reporting or legal liability.
- ✗
Media
Why it's wrong here
Media is an external entity that must be handled exclusively by the public relations (PR) department with legal review, never by a cybersecurity analyst. Involving media during an active incident can lead to uncoordinated disclosures, inaccurate information, and legal consequences such as SEC violations or reputational damage. The media communication channel must be activated only after the incident is understood and a formal statement is approved, making any direct contact by the analyst inappropriate.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.