A help desk technician receives a report of a phishing email that was delivered to multiple users. The technician confirms the email contains a malicious link. What is the MOST appropriate escalation step for the technician to take?

Escalate to the legal department.

Escalate to the IT help desk manager for a ticket update.

Escalate to the CEO for a company-wide announcement.

Escalate to the security operations center (SOC) for further analysis.

An analyst detects unusual outbound network traffic from a server that may indicate data exfiltration. According to the organization's incident response policy, which action is most appropriate for declaring an incident?

Compare the activity against the organization's incident declaration criteria and declare an incident if the criteria are met.

Wait until the activity is confirmed as malicious by law enforcement before declaring an incident.

Declare an incident only after the root cause has been identified.

Immediately declare an incident for any unusual activity to ensure a rapid response.

A security analyst detects a single workstation beaconing to a known command-and-control domain. The workstation is isolated, and the analyst confirms the beaconing is the only suspicious activity. The organization's incident response plan defines an incident as 'any confirmed malicious activity that requires coordinated response.' Which action best aligns with the incident declaration criteria?

Wait for additional evidence of lateral movement before declaring an incident.

Treat it as a security event and handle it through normal ticketing without escalation.

Declare an incident and activate the full incident response team.

Declare an incident but keep the response limited to the analyst's team to avoid unnecessary escalation.

A security manager wants to measure the effectiveness of the incident response team's detection and response capabilities. Which metric is MOST appropriate for this purpose?

Mean time to detect (MTTD) and mean time to respond (MTTR).

Number of employees who completed security awareness training.

Total cost of the incident response team's tools.

Number of security alerts generated per day.

After a significant incident, the incident response team is conducting a lessons learned review. The team identifies that the response was delayed because the on-call analyst was not notified promptly. Which action is MOST appropriate to address this issue?

Increase the number of security tools to improve detection.

Update the incident notification procedure to include a secondary notification method.

Document the incident and close the review without changes.

Replace the on-call analyst with a more experienced team member.

CompTIACySA+

Domain 4Objective 2

Incident Response Reporting CS0-003 Practice Questions (Page 6)

Part of the Reporting and communication domain, which accounts for 17% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~11–19 in this domain), expect 6–10 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

17%of the exam

Questions 26–30

26application · medium
A help desk technician receives a report of a phishing email that was delivered to multiple users. The technician confirms the email contains a malicious link. What is the MOST appropriate escalation step for the technician to take?
Select an answer first
27foundation · easy
An analyst detects unusual outbound network traffic from a server that may indicate data exfiltration. According to the organization's incident response policy, which action is most appropriate for declaring an incident?
Select an answer first
28application · medium
A security analyst detects a single workstation beaconing to a known command-and-control domain. The workstation is isolated, and the analyst confirms the beaconing is the only suspicious activity. The organization's incident response plan defines an incident as 'any confirmed malicious activity that requires coordinated response.' Which action best aligns with the incident declaration criteria?
Select an answer first
29application · medium
A security manager wants to measure the effectiveness of the incident response team's detection and response capabilities. Which metric is MOST appropriate for this purpose?
Select an answer first
30expert · hard
After a significant incident, the incident response team is conducting a lessons learned review. The team identifies that the response was delayed because the on-call analyst was not notified promptly. Which action is MOST appropriate to address this issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.