mediumMultiple Select
CS0-003 Practice Question: When briefing legal and privacy teams after a…
When briefing legal and privacy teams after a suspected data exposure, which details matter? (Choose two.)
⚠ Common exam trap
The CS0-004 exam often tests the distinction between operational details (like patch lists) and legally relevant information (data types and jurisdictions), trapping candidates who think all technical details are equally important for legal teams.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data types and jurisdictions potentially affected
Data types (e.g., PII, PHI, PCI) and affected jurisdictions determine legal notification obligations under regulations like GDPR, HIPAA, or CCPA. Jurisdictions dictate breach notification timelines and penalties, making this information critical for legal and privacy teams to assess risk and compliance. Without this detail, the response cannot be properly scoped or legally defensible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data types and jurisdictions potentially affected
Why this is correct
Legal and privacy teams must determine regulatory notification obligations, which are strictly dictated by the specific categories of data compromised (such as PII, PHI, or PCI) and the geographic locations of the affected data subjects. Providing this information allows counsel to accurately assess compliance with frameworks like GDPR, CCPA, or HIPAA.
- ✗
A complete list of unrelated server patches
Why it's wrong here
Presenting a comprehensive list of unrelated system patches introduces unnecessary noise and distracts legal teams from assessing actual liability and exposure. Legal counsel requires actionable intelligence regarding the incident's scope rather than irrelevant infrastructure maintenance logs that do not pertain to the compromised vector.
- ✗
Speculation about attacker identity without evidence
Why it's wrong here
Attributing an attack to a specific threat actor without concrete forensic evidence can lead to flawed legal strategies, incorrect regulatory disclosures, and potential liability. Legal decisions must be grounded in verifiable forensic facts rather than unsubstantiated theories that could complicate litigation or public relations.
- ✓
Timeline of discovery, containment, and known access
Why this is correct
Establishing a precise timeline of discovery, containment, and unauthorized access is critical because many data protection regulations mandate strict reporting windows, such as the GDPR's 72-hour notification rule. This chronological data helps legal counsel verify compliance with statutory deadlines and assess the effectiveness of the incident response.
Go deeper
Related to this question
Learn chapter
Ransomware Incident Response
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.