An incident responder is writing a post-incident report for a ransomware attack. The report must be useful for both technical staff and executive leadership. Which approach BEST achieves this?

Provide a single summary paragraph for all audiences.

Include a technical timeline and a separate executive summary.

Focus only on the business impact and omit technical details.

Write the report in highly technical language for accuracy.

During an incident, a first-level analyst discovers that the incident involves a critical business system and requires legal review. Which action best demonstrates proper escalation?

The analyst waits for the incident to resolve itself before informing anyone.

The analyst escalates the incident to the incident response manager and legal counsel according to the escalation procedure.

The analyst continues handling the incident alone to avoid unnecessary attention.

The analyst immediately deletes all logs to prevent further exposure.

What is the primary goal of a root cause analysis (RCA) in incident response?

To assign blame to the individual who caused the incident.

To document the incident for insurance claims.

To identify the underlying reason an incident occurred so that effective preventive measures can be implemented.

To quickly restore services without considering the cause.

Which of the following best describes the purpose of an incident declaration in the incident response process?

To formally recognize that a security event meets the criteria to be treated as an incident requiring a response.

To assign a severity rating to an event after the incident has been fully contained and eradicated.

To document the final root cause analysis and lessons learned from an event.

To immediately notify law enforcement and regulatory bodies of any suspicious activity.

What is the primary purpose of the lessons learned process in incident response?

To assign performance ratings to incident response team members.

To create a public report of the incident for media distribution.

To delete all records of the incident to avoid legal liability.

To identify areas for improvement in the incident response process and update policies and procedures accordingly.

CompTIACySA+

Domain 4Objective 2

Incident Response Reporting CS0-003 Practice Questions (Page 1)

Part of the Reporting and communication domain, which accounts for 17% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

17%of the exam

Questions 1–5

1expert · hard
An incident responder is writing a post-incident report for a ransomware attack. The report must be useful for both technical staff and executive leadership. Which approach BEST achieves this?
Select an answer first
2foundation · easy
During an incident, a first-level analyst discovers that the incident involves a critical business system and requires legal review. Which action best demonstrates proper escalation?
Select an answer first
3foundation · easy
What is the primary goal of a root cause analysis (RCA) in incident response?
Select an answer first
4foundation · easy
Which of the following best describes the purpose of an incident declaration in the incident response process?
Select an answer first
5foundation · easy
What is the primary purpose of the lessons learned process in incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.