CySA Plus V3 Security Reporting Quiz

1. A security analyst is preparing a monthly report for the board. Which format is most appropriate?

Highly technical packet captures and code analysis

Executive summary with KPIs, trends, and actionable recommendations

Raw log files from all security tools

Complete vulnerability scan results in CSV format

2. What is the main difference between a security incident report and a vulnerability assessment report?

Incident reports document actual breaches; vulnerability reports identify potential weaknesses

They are identical documents

Vulnerability reports are only for external auditors

Incident reports are optional; vulnerability reports are mandatory

3. A CySA analyst must explain why a critical vulnerability has not yet been patched. What justification would be most credible?

The patch was not yet released by the vendor

Patching would disrupt business-critical operations; mitigation controls are in place

The vulnerability is not important enough

No one has time to apply the patch

4. Which stakeholder group typically requires the most detailed technical information in security reports?

Chief Financial Officer (CFO)

Security Operations Center (SOC) team

Board of Directors

Marketing department

5. In a security report, what does the term 'risk appetite' refer to?

The organization's willingness to accept risk at a certain level

The total number of vulnerabilities found

The budget allocated for security tools

The number of security incidents resolved

6. What is the primary benefit of automating security report generation?

Reduces human error and ensures consistent, timely reporting

Eliminates the need for security analysts

Guarantees that all incidents will be prevented

Removes the requirement for management review

7. A security incident is discovered on Friday afternoon. According to best practices, when should initial notification begin?

Monday morning when the office reopens

Immediately, following your incident response plan

After a full forensic investigation is complete

Only if regulatory requirements explicitly mandate it

8. Which compliance framework most directly impacts security reporting requirements in healthcare organizations?

PCI-DSS

HIPAA

SOC 2

ISO 27001

9. When reporting false positives in security alerts, what action should a CySA analyst prioritize?

Ignore them and focus only on confirmed threats

Tune detection rules and document the adjustments

Disable the security tool generating false positives

Report all false positives to vendors without internal review

10. What does CVSS (Common Vulnerability Scoring System) help communicate in security reports?

The standardized severity rating of vulnerabilities

The cost of security incidents

The number of patches available

The employee training completion rate

11. Which metric best measures the effectiveness of your organization's ability to detect and respond to security incidents?

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

Total number of assets owned

Annual IT budget allocation

Number of employees trained

12. Which of the following best describes a security heat map in reporting?

A color-coded visualization showing risk levels across business units or systems

A detailed list of all CVEs discovered

A hardware temperature monitoring tool

A backup restoration timeline

13. When documenting a security incident, what is the primary purpose of establishing a chain of custody?

To ensure evidence integrity and legal admissibility

To speed up the incident response process

To reduce the number of people involved

To minimize communication overhead

14. A CySA analyst must report on phishing campaign effectiveness. Which metric is most relevant?

Click rate and credential submission rate

Number of emails sent

Total employees in the organization

Email server uptime percentage

15. Which metric is used to measure the percentage of known vulnerabilities that have been patched?

Vulnerability Remediation Rate

Mean Time to Patch (MTTP)

Patch Compliance Rate

All of the above

16. What framework should a CySA analyst use to structure risk reporting for C-suite executives?

ISO 27001 only

Business impact, probability, and recommended controls

Open Web Application Security Project (OWASP) top 10

Detailed vulnerability CVE listings

17. Which of the following is a leading indicator of security posture rather than a lagging indicator?

Number of successful breaches

Percentage of systems patched on schedule

Total cost of past incidents

Number of forensic investigations completed

18. A security analyst discovers that incident response time has increased by 40% over the past quarter. What should be the next step?

Immediately fire the incident response team

Investigate root causes and adjust processes or resources

Ignore the trend and continue operations

Purchase more expensive security tools

19. When reporting a data breach to stakeholders, which element is most critical?

Technical details of the attack vector

Scope of impact, timeline, and remediation steps

List of all security tools deployed

Vendor contract terms

20. What is the primary purpose of a security dashboard in executive reporting?

To provide real-time technical packet analysis

To visualize KPIs and risk trends for decision-making

To replace vulnerability scanning tools

To automate all incident response procedures