CySA+ v4 Incident Reporting Standards

1. What metric should be tracked in incident reporting?

Time to detect, contain, and resolve incidents

Only the cost to the company

Employee satisfaction during incidents

Weather conditions during the event

2. How should incident severity be communicated to non-technical stakeholders?

Use clear business impact language avoiding technical jargon

Use only highly technical terminology

Minimize severity regardless of actual impact

Exaggerate severity to increase urgency

3. What is the role of communication logs in incident response documentation?

Track notifications sent, recipients, and acknowledgments

Avoid recording any communications

Document only unsuccessful communications

Communication logs are irrelevant

4. How should recommendations for remediation be documented?

Specific, actionable steps with timelines and responsible parties

Vague suggestions without follow-up

Only criticisms of current systems

Recommendations are unnecessary

5. What regulatory compliance should be considered when reporting security incidents?

GDPR, HIPAA, PCI-DSS, and industry-specific requirements

No regulations apply to incident reporting

Only company internal policies

Regulations are optional considerations

6. How should timeline documentation be structured in incident reports?

Chronological order with precise timestamps for each event

Random order based on importance

Only start and end times

No timeline needed

7. What is the significance of incident report templates in organizations?

Ensure consistent documentation and compliance with standards

Limit creativity in reporting

Make reporting more time-consuming

Reduce the importance of accurate data

8. Which communication method is most appropriate for critical incident updates?

Combination of secure channels, calls, and documented updates

Personal text messages only

Public social media posts

No communication until incident ends

9. What should be included in a root cause analysis section of incident reports?

Technical and procedural factors contributing to the incident

Only blame for specific individuals

Speculation without investigation

Future unrelated predictions

10. How should communication escalation be structured during an incident?

Defined hierarchy based on incident severity and type

Random selection of people to notify

Only notify executives immediately

Escalation is never necessary

11. What is the primary purpose of incident documentation in cybersecurity response?

Create a legal record for compliance and post-incident analysis

Provide entertainment for the security team

Replace verbal communication during incidents

Reduce the need for incident investigation

12. Which stakeholders typically require incident notifications?

Management, legal, compliance, and affected customers

Only the IT department

No one; incidents are internal only

Competitors and industry rivals

13. What is the purpose of a post-incident report?

Document lessons learned and improve future response

Blame individuals for the incident

Avoid discussing what went wrong

Prove the incident never happened

14. How should sensitive information be handled in incident reports?

Redact or encrypt based on access controls and regulations

Include all details in plain text

Remove any identifying information entirely

Share freely with all employees

15. What should be documented regarding chain of custody for evidence?

Who collected, handled, and stored evidence with timestamps

Only the final location of evidence

The analyst's personal notes

Nothing; chain of custody is optional

16. Which element is essential in an incident severity classification?

Impact level, scope, and affected asset criticality

Only the number of affected users

The analyst's mood during response

Time of day the incident occurred

17. What is the correct approach for communicating with external stakeholders about an incident?

Use pre-approved messaging after internal assessment

Share all technical details immediately

Avoid any communication until fully resolved

Let individual employees communicate freely

18. Who should be notified first when a critical security incident is detected?

Immediate supervisor and incident response team

Social media followers

Competitors in the industry

The attacker, to negotiate

19. What framework guides incident reporting timelines in most regulated industries?

NIST Cybersecurity Framework and regulatory requirements

Personal preference of the incident commander

The longest possible delay allowed

Vendor product documentation

20. Which of the following should be included in an initial incident report?

Discovery time, affected systems, and initial assessment

Only financial impact estimates

Predicted outcome without investigation

Personal opinions of the analyst

CySA+ Incident Report Documentation Standards Quiz