Reporting and Communication

During a ransomware incident, your executive sponsor sends this email at 09:15: "Board call at 10:00. Give me the current business impact and what we are doing, in plain terms." You have technical findings but the eradication is still in progress. What should your update to the sponsor prioritise?

• AWhich services are down, the current containment status, and the expected next milestone in plain business languagecheck_circle Correct
• BA packet-level breakdown of the C2 beacon intervals and the malware's registry persistence keys
• CA request that the board approve purchasing a new EDR platform before the call begins
• DThe full indicator-of-compromise list so the board can forward it to peer organisations

Why A is correct: An executive update should translate technical status into business impact and next steps, matching the audience and the decision they must support.

Why B is wrong: This is accurate technical detail, but a board-facing sponsor needs business impact and status, not indicators they cannot act on.

Why C is wrong: Procurement decisions belong in the lessons-learned phase, not a mid-incident status update, and pre-empting them derails the sponsor's immediate need.

Why D is wrong: Sharing raw IOCs with a board is the wrong audience and risks premature disclosure; the sponsor asked for impact and actions in plain terms.

You are drafting the root-cause section of an incident report. Your notes read: "Attacker used valid credentials phished from a helpdesk agent; MFA was not enforced on the VPN; the account had domain-admin rights it did not need." Which entry belongs in the root-cause narrative rather than merely describing the attack?

• AThe attacker authenticated to the VPN and moved laterally to a file server
• BThe helpdesk agent opened the phishing email at 08:40 and entered credentials
• CThe security team contained the account within two hours of detection
• DAbsence of enforced MFA on the VPN allowed phished credentials alone to grant accesscheck_circle Correct

Why A is wrong: This describes attacker actions along the timeline, which is the incident narrative; a root cause names the condition that allowed those actions.

Why B is wrong: This is an event in the timeline; while relevant, it records what happened rather than the systemic weakness that made it effective.

Why C is wrong: This is a response metric that belongs in the effectiveness section, not an explanation of why the incident was possible.

Why D is correct: This names the underlying control gap that permitted the intrusion, which is precisely what a root-cause narrative must capture.

Your after-action review for a phishing-led compromise notes: "Mean time to detect 6 days; mean time to respond 2 hours once detected." The CISO asks which improvement area this pairing of metrics points to most clearly. Which conclusion is best supported?

• AResponse playbooks are the weak point and need to be rewritten before the next incident
• BDetection and monitoring coverage is the weak point, since detection took days while response was fastcheck_circle Correct
• CBoth metrics are acceptable and no improvement action is warranted from this incident
• DThe eradication phase overran and extended the overall incident duration

Why A is wrong: A 2-hour response time is strong, so the data points away from playbooks; the long detection window is where the gap actually sits.

Why B is correct: A six-day detect time against a two-hour response time isolates detection as the bottleneck, directing improvement to monitoring and alerting coverage.

Why C is wrong: A six-day dwell time is a serious exposure window, so concluding no action is needed misreads the metric that matters most here.

Why D is wrong: Neither metric measures eradication duration; inferring an eradication overrun goes beyond what mean time to detect and respond can establish.

Your remediation SLO states that critical vulnerabilities on production systems must be fixed within 15 days. This month's tracker shows: criticals_opened=40 criticals_closed=28 mean_time_to_remediate_days=22 sla_breached=12 The CISO asks for the single metric that most directly demonstrates whether the team is meeting its service-level obligation. Which do you report?

• AThe count of criticals closed this month, because 28 closures shows the team is actively reducing the open backlog.
• BThe SLA breach count of 12, because any breach total above zero proves the process has completely failed for the period.
• CThe mean time to remediate of 22 days, because comparing the average against 15 days summarises overall speed.
• DThe percentage of criticals remediated within the 15-day window, which directly measures adherence to the stated service-level objective.check_circle Correct

Why A is wrong: Tempting because closures look like progress, but a raw closure count says nothing about whether fixes landed inside the agreed window, so it cannot show SLO compliance.

Why B is wrong: Tempting because breaches are the failures, but a bare breach count without the total in scope hides the compliance rate, and the absolute framing overstates a partial shortfall.

Why C is wrong: Tempting because MTTR relates to the 15-day target, but an average can pass or fail while masking the tail; a single slow outlier or many just-in-time fixes both distort it, so it is a weaker compliance measure than the on-time rate.

Why D is correct: Correct because an SLO is a time-bound target, so the on-time remediation rate is the metric that maps one-to-one to whether the obligation was met.

You are the analyst on a confirmed breach of a payment-processing server. The forensic timeline reads: 03:12 unauthorised access, 03:40 cardholder data table queried, 04:05 outbound transfer to an external host. Your incident lead asks which stakeholder fact most directly drives the external notification clock you must start tracking. Which fact is it?

• AThe 53-minute gap between initial access and data exfiltration recorded in the forensic timeline
• BThe external host address that received the outbound transfer at 04:05
• CThat the affected system is a server rather than an end-user workstation
• DThat the queried table held cardholder data, bringing PCI DSS and breach-notification obligations into scopecheck_circle Correct

Why A is wrong: Dwell time is a useful metric for the after-action report, but it does not by itself trigger a regulatory notification deadline; the nature of the data does.

Why B is wrong: The destination is vital for containment and threat intelligence, but knowing the IP does not set a notification deadline; the data classification does.

Why C is wrong: Asset type informs impact scoring, yet a server versus workstation distinction does not create a legal notification duty on its own; the regulated data does.

Why D is correct: Regulated cardholder data being accessed is what starts contractual and statutory notification clocks, so it is the fact that governs the external notification timeline.