CySA+ Reporting Quiz: Can You Brief The Board?

1. A security analyst reports that 40% of endpoints lack current patches. To make this actionable for leadership, what should be added?

A list of all unpatched systems

Business risk (exposed functions, revenue impact) and remediation timeline

The names of IT staff responsible

Only the percentage; it is self-explanatory

Submit

5. A security report should include metrics on 'mean time to detect' (MTTD) because:

It shows how quickly threats are identified, reducing dwell time and damage

It is required by law

It has no business relevance

It measures employee productivity

6. When briefing the board on a ransomware attack, which decision point is most critical to communicate?

Whether to pay the ransom and timeline for negotiation

Backup status, recovery time, and business continuity impact

The attacker's country of origin

The cost of security tools purchased last year

7. What is the purpose of a 'lessons learned' report after a security incident?

To blame staff members for the breach

To document root causes, gaps in controls, and improvements to prevent recurrence

To justify hiring more security staff

To hide evidence from regulators

8. A penetration test identifies 150 vulnerabilities. How should this be reported to leadership?

List all 150 items with technical details

Categorize by severity, highlight critical/high-risk items, and provide remediation priority

Report only the number without details

Only mention vulnerabilities that affect revenue

9. When communicating a data breach timeline to customers, accuracy is critical because:

It reduces the number of legal claims

It demonstrates transparency, aids investigations, and supports regulatory compliance

It prevents media coverage

It eliminates the need for cyber insurance

10. Which element is essential in a compliance report to the board?

Gaps between current state and regulatory requirements, with remediation plans

A list of all employees who completed training

Technical specifications of firewalls

Names of all external auditors

11. When reporting a security incident to the board, which element should take priority?

Technical details of the attack vector

Business impact and remediation status

Complete forensic timeline

Detailed log file analysis

12. In incident response communication, what does 'containment status' mean?

Whether the breach has been publicly disclosed

Steps taken to stop spread and limit damage

The cost of the incident

How many people are investigating

13. What should a dashboard metric for board reporting emphasize?

Raw counts of vulnerabilities and alerts

Trends, risk prioritization, and progress toward security goals

Only vulnerabilities that cannot be fixed

Historical data from five years ago

14. Which communication method is most appropriate for reporting a critical zero-day vulnerability?

Email summary at end of week

Immediate phone call or urgent meeting

Monthly security newsletter

Annual board presentation

15. A security report should translate technical risks into business language by:

Using more acronyms and technical jargon

Linking risks to revenue impact, regulatory penalties, or operational disruption

Removing all quantitative data

Focusing only on compliance requirements

16. When presenting a breach notification to stakeholders, which information must be included first?

Attacker identity and motivation

Scope of exposure, affected parties, and immediate actions taken

Detailed technical remediation steps

Historical context of past security incidents

17. What is the key difference between a security incident report and a vulnerability report?

Incident reports are longer and more detailed

Vulnerability reports address potential threats; incidents report actual breaches or events

Only incidents require executive notification

Vulnerability reports are only for IT staff

18. A vulnerability with CVSS 9.8 should be reported to leadership as:

Low priority; handle in normal patching cycle

Medium priority; address within 30 days

Critical risk requiring immediate attention and mitigation

Informational only; document for compliance

19. Which metric is most relevant when communicating security ROI to C-level executives?

Number of patches applied monthly

Cost of breaches prevented vs. security investment

Total vulnerabilities discovered

Average time to patch systems

20. What is the primary purpose of a risk register in executive reporting?

To document all vulnerabilities found during scanning

To track identified risks, their likelihood, impact, and mitigation status

To list every security control in the organization

To store employee security training records

CySA+ Reporting Quiz: Can You Brief the Board?