Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
CySA+ Domain 4
CompTIA CySA+ Domain 4: Reporting and Communication Q&As
| Question | Answer |
|---|---|
| What is the purpose of vulnerability management reporting? | To communicate identified vulnerabilities, affected assets, risk levels, mitigation steps, and trends to stakeholders for informed decision-making. |
| What should be included in a vulnerability report about vulnerabilities? | CVE IDs or identifiers, technical description, severity, exploitation potential, affected versions, and discovery method. |
| What information about affected hosts should be reported? | Asset identification, system criticality, business function, OS and application versions, and network location. |
| What is a risk score in vulnerability management? | A numerical or categorical value representing the risk posed by a vulnerability, often using CVSS or organizational frameworks. |
| What factors influence risk scoring? | Business impact, exploitability, exposure level, asset value, and compensating controls. |
| What is mitigation in vulnerability reporting? | Recommended actions to remediate or reduce the risk of vulnerabilities, such as patching or configuration changes. |
| How should recurrence be tracked in vulnerability management? | By monitoring for repeated vulnerabilities, failed remediations, and analyzing root causes of recurring issues. |
| What is prioritization in vulnerability management? | Ranking vulnerabilities for remediation based on severity, asset criticality, exploitation potential, and business impact. |
| What are compliance reports? | Reports that demonstrate adherence to regulatory frameworks like PCI DSS, HIPAA, GDPR, or SOX. |
| What are the main elements of an action plan in vulnerability management? | Configuration management, patching, compensating controls, awareness training, and adapting to changing business requirements. |
| What is configuration management in action plans? | Developing and maintaining secure baseline configurations, detecting drift, and validating changes. |
| What is patch management? | Identifying, testing, deploying, and verifying patches to address vulnerabilities. |
| When are compensating controls used? | When patches or direct fixes are not possible, especially for legacy or proprietary systems. |
| Why is awareness, education, and training important in vulnerability management? | To ensure staff understand security risks, policies, and their roles in maintaining security. |
| How do changing business requirements affect vulnerability management? | They require security to adapt controls, risk assessments, and documentation to new initiatives or technologies. |
| What are inhibitors to remediation? | Factors that delay or prevent vulnerability remediation, such as MOUs, SLAs, governance, business process interruption, degrading functionality, legacy, or proprietary systems. |
| What is a Memorandum of Understanding (MOU) in remediation? | A formal agreement outlining responsibilities, which can complicate or delay remediation if not clear. |
| How can Service-Level Agreements (SLAs) inhibit remediation? | By imposing vendor response time limits, maintenance windows, or requiring approval for changes. |
| How does organizational governance affect remediation? | Complex approval processes, competing priorities, and resource constraints can slow remediation. |
| Why is business process interruption a remediation inhibitor? | Because downtime or changes may impact operations, revenue, or customer experience. |
| What are the challenges of remediating legacy systems? | End-of-life status, lack of vendor support, and critical dependencies make remediation difficult. |
| What are proprietary systems and why are they challenging to remediate? | Systems with vendor-controlled updates or limited modification capabilities, making direct fixes difficult. |
| What are metrics and KPIs in vulnerability management? | Quantitative measures such as trends, top 10 lists, critical vulnerabilities, and SLOs to track and improve security posture. |
| What is the value of tracking trends in vulnerability management? | To identify improvement or deterioration over time and guide resource allocation. |
| What is a "Top 10" list in vulnerability reporting? | A prioritized list of the most critical vulnerabilities, assets, or recurring issues to focus remediation efforts. |
| Why is tracking critical vulnerabilities and zero-days important? | To ensure rapid detection, response, and risk reduction for the most severe threats. |
| What are Service Level Objectives (SLOs) in security? | Performance targets for remediation timeframes, scan frequency, and reporting, used to measure and improve service. |
| Why is stakeholder identification and communication important in reporting? | To ensure the right people receive the right information at the right time, tailored to their needs and responsibilities. |
| What is the importance of incident response reporting and communication? | To document, communicate, and coordinate response efforts, lessons learned, and compliance with legal and regulatory requirements. |
| Who are typical internal stakeholders in incident response? | Executive leadership, legal, IT/security teams, business units, and public relations. |
| Who are typical external stakeholders in incident response? | Customers, partners, regulators, law enforcement, media, and shareholders. |
| What is incident declaration and escalation? | The process of formally recognizing an incident and activating appropriate response levels and notifications. |
| What should an executive summary in an incident report include? | Incident overview, business impact, key findings, recommendations, and strategic implications. |
| What are the "who, what, when, where, and why" in incident reporting? | Who was involved, what happened, when it occurred, where it happened, and why (root cause or motivation). |
| What should recommendations in an incident report address? | Immediate actions, short- and long-term improvements, resource needs, and prioritization. |
| Why is a timeline important in incident reporting? | To document the sequence of events, response actions, and identify areas for improvement. |
| What is impact assessment in incident response? | Evaluating the technical, operational, financial, reputational, and regulatory consequences of an incident. |
| What is scope in incident response? | Defining the boundaries of affected systems, data, users, and business functions. |
| What is the role of evidence in incident response? | To support findings, enable legal action, and maintain integrity through chain of custody and documentation. |
| What are legal considerations in incident communications? | Attorney-client privilege, breach notification, regulatory obligations, and evidence preservation. |
| What are the key elements of customer communication after an incident? | Incident disclosure, impact explanation, remediation steps, protection guidance, and contact information. |
| What is the role of media communication in incident response? | To provide accurate, timely, and consistent information to the public and protect organizational reputation. |
| What is regulatory reporting in incident response? | Notifying authorities as required by law or regulation, documenting compliance, and following up as needed. |
| When should law enforcement be involved in incident response? | When criminal activity is suspected, or required by law or regulation. |
| What is root cause analysis in incident response? | A process to identify the underlying cause of an incident and develop corrective actions. |
| What is the purpose of lessons learned after an incident? | To review what worked, what didn’t, and update processes, tools, and training for future improvement. |
| What is Mean Time to Detect (MTTD)? | The average time between the occurrence of an incident and its detection. |
| What is Mean Time to Respond (MTTR)? | The average time between detection of an incident and the start of response actions. |
| What is Mean Time to Remediate? | The average time to fully resolve an incident or vulnerability from detection to closure. |
| What is alert volume and why is it important? | The number of security alerts generated, used to assess detection effectiveness and analyst workload. |
Created by:
anapaulaseidel
Popular Computers sets