CS0-003 Reporting and Communication Practice Question
During a security incident, which of the following should be the FIRST communication to internal stakeholders?
⚠ Common exam trap
CS0-004 often tests the misconception that external notifications (law enforcement, customers) or documentation tasks (risk register) should occur first, confusing the order of incident response steps with communication priorities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Internal escalation to the incident response team
The first communication during a security incident must be the internal escalation to the incident response team, as this triggers the formal incident response process. The IR team is responsible for assessing the scope, containing the threat, and coordinating all subsequent actions, including any external notifications. Without this initial escalation, no coordinated response can occur, and other communications (legal, PR, risk) would lack the necessary technical context. This aligns with the preparation and identification phases of the incident response lifecycle (e.g., NIST SP 800-61).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notification to law enforcement
Why it's wrong here
Contacting law enforcement is not the first action because the incident's scope, impact, and legal requirements have not yet been assessed. Premature notification can trigger formal legal processes and potentially compromise internal investigation flexibility, while the immediate priority is to verify the incident and initiate containment through the IR team. Law enforcement is brought in only when criminal activity or regulatory obligations are confirmed.
- ✗
Press release to customers
Why it's wrong here
Issuing a press release is premature because the organization has not yet confirmed the nature and scope of the incident or fulfilled internal communication protocols. Public statements made without verified technical details can mislead customers, create regulatory exposure, and damage trust, especially if the incident turns out to be benign or limited. External notifications should follow a coordinated plan after internal escalation and initial containment.
- ✗
Update to the risk register
Why it's wrong here
Updating the risk register is a post-incident or continuous-improvement activity, not an initial response action. In the middle of an active security incident, the response team must focus on triage, containment, and eradication; documenting risk register changes can wait until after stabilization, when lessons learned can inform future risk assessments.
- ✓
Internal escalation to the incident response team
Why this is correct
This is the correct first step because incident response plans conventionally begin with detection and internal escalation, notifying personnel with the authority and expertise to manage the event. The IR team will lead subsequent actions such as containment, eradication, and recovery, and will serve as the central coordinator for all internal and external communications. Any other action—whether external notification, public statements, or documentation—must be authorized through this escalation path to maintain control and legal defensibility.
Go deeper
Related to this question
Learn chapter
Threat Emulation and Purple Team Exercises
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Incident response lifecycle
The Incident response lifecycle is the structured process organizations follow to detect, contain, eradicate, and recover from cybersecurity incidents while learning from each event to improve future defenses.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.