hardMultiple Select
CS0-003 Practice Question: Which THREE elements are essential components of…
Which THREE elements are essential components of a comprehensive post-incident report?
⚠ Common exam trap
CompTIA often tests the distinction between operational necessities (like budgets or credential lists) and the mandatory technical/analytical components of a post-incident report, trapping candidates who confuse administrative tasks with incident documentation requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Root cause analysis
Root cause analysis (RCA) is essential because it identifies the underlying technical failure—such as a misconfigured firewall rule, an unpatched CVE, or a phishing campaign—that allowed the incident to occur. Without RCA, the report would only describe symptoms, not the fundamental vulnerability that must be addressed to prevent recurrence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Root cause analysis
Why this is correct
A comprehensive incident report must identify the fundamental vulnerability or failure vector that allowed the security incident to occur. Conducting a root cause analysis ensures that remediation efforts target the source of the compromise rather than just treating superficial symptoms, preventing future exploitation of the same vector.
- ✓
Timeline of events leading up to and during the incident
Why this is correct
Establishing a chronological sequence of events is vital for reconstructing the attacker's path, understanding the dwell time, and evaluating the speed of the detection and response phases. This detailed timeline allows analysts to correlate disparate log entries and identify gaps in monitoring coverage.
- ✗
List of all employee usernames and passwords
Why it's wrong here
Including active credentials in an incident report violates the principle of least privilege and introduces severe security risks by creating a high-value target for secondary compromise. Incident documentation should only reference affected accounts using non-sensitive identifiers or anonymized logs to maintain confidentiality.
- ✗
Budget report for the incident response team
Why it's wrong here
While tracking the financial impact of a breach is important for high-level business risk management, detailed operational budgets of the incident response team do not contribute to understanding the technical mechanics of the attack. This administrative data belongs in corporate financial audits rather than technical post-incident reports.
- ✓
Lessons learned and recommendations for improvement
Why this is correct
The primary goal of the post-incident phase is to strengthen the organization's security posture against future threats. Documenting lessons learned and actionable recommendations translates technical findings into strategic improvements, such as policy updates, architectural changes, or additional staff training.
Go deeper
Related to this question
Learn chapter
Email Header Analysis for Phishing
Key term
Phishing
Phishing is a type of cyber attack where criminals impersonate legitimate organizations or individuals to trick victims into revealing sensitive information such as passwords, credit card numbers, or personal data.
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.