CS0-003 Reporting and Communication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Sharing the incident response plan

  Why it's wrong here

  Sharing the organization's internal incident response plan is unnecessary and potentially risky, as it contains sensitive operational details that do not aid law enforcement's immediate criminal investigation. Law enforcement officers are focused on identifying the threat actor and gathering admissible evidence, not on how the organization manages its internal business continuity or recovery workflows.

• ✗

  Requesting a warrant for internal investigation

  Why it's wrong here

  Requesting a warrant is legally unnecessary when an organization voluntarily cooperates and consents to law enforcement accessing its systems. Furthermore, warrants are issued by judicial authorities to law enforcement, not requested by the victim organization, making this an incorrect procedural step during initial incident collaboration.

• ✓

  Coordinating evidence collection and preservation

  Why this is correct

  Establishing a coordinated approach to evidence collection and preservation is the critical first step to ensure all digital forensics remain legally admissible. This collaboration prevents the organization from inadvertently altering or destroying volatile data, such as RAM or active network logs, which law enforcement needs to establish a proper chain of custody.

• ✗

  Providing a list of affected customers

  Why it's wrong here

  Handing over customer lists containing personally identifiable information (PII) early in an investigation violates privacy regulations like GDPR or HIPAA without a subpoena or clear legal mandate. Organizations must first establish the scope of the breach and preserve technical evidence before addressing external notifications or sharing sensitive customer data with authorities.

Go deeper

Related to this question