CS0-003 Reporting and Communication Practice Question
During a security incident, which of the following should be the FIRST communication to internal stakeholders?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Internal escalation to the incident response team
Internal escalation procedures dictate notifying the incident response team and relevant management first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notification to law enforcement
Why it's wrong here
Contacting law enforcement is not the first action because the incident's scope, impact, and legal requirements have not yet been assessed. Premature notification can trigger formal legal processes and potentially compromise internal investigation flexibility, while the immediate priority is to verify the incident and initiate containment through the IR team. Law enforcement is brought in only when criminal activity or regulatory obligations are confirmed.
- ✗
Press release to customers
Why it's wrong here
Issuing a press release is premature because the organization has not yet confirmed the nature and scope of the incident or fulfilled internal communication protocols. Public statements made without verified technical details can mislead customers, create regulatory exposure, and damage trust, especially if the incident turns out to be benign or limited. External notifications should follow a coordinated plan after internal escalation and initial containment.
- ✗
Update to the risk register
Why it's wrong here
Updating the risk register is a post-incident or continuous-improvement activity, not an initial response action. In the middle of an active security incident, the response team must focus on triage, containment, and eradication; documenting risk register changes can wait until after stabilization, when lessons learned can inform future risk assessments.
- ✓
Internal escalation to the incident response team
Why this is correct
This is the correct first step because incident response plans conventionally begin with detection and internal escalation, notifying personnel with the authority and expertise to manage the event. The IR team will lead subsequent actions such as containment, eradication, and recovery, and will serve as the central coordinator for all internal and external communications. Any other action—whether external notification, public statements, or documentation—must be authorized through this escalation path to maintain control and legal defensibility.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.