CS0-004 - Reporting and Communication (16% of the exam) - Section 4.1
Explain the importance of vulnerability management reporting and communication.
Explain how vulnerability findings are reported to the right audience with the right metrics: risk scores, trends over time, service-level objectives, and remediation status, tailored for technical owners versus executives. Recognise the role of compliance reporting, stakeholder communication, and action plans in turning findings into remediation that actually happens.
vulnerability metrics and KPIsrisk-score and trend reportingaudience-appropriate reportingcompliance reportingremediation status and SLOs
Practice question for this objective
lock_openFree sampleReporting and Communicationmedium
What is the primary purpose of trend reporting on vulnerability risk scores over successive reporting periods?
ATo show whether the organisation's overall exposure is improving or worsening so leaders can judge programme effectivenesscheck_circle Correct
BTo confirm that a single scanner plugin is correctly licensed for each subnet it touches
CTo replace per-finding remediation records so individual tickets no longer need to be retained
DTo calculate the exact CVSS base score for each newly published vulnerability before triage
Explain that risk-score trend reporting shows whether exposure is improving over time to gauge programme effectiveness. Plotting aggregate risk scores across reporting periods turns point-in-time data into a direction, so leaders can tell whether the programme is closing findings faster than new ones arrive and can justify or redirect effort accordingly.
Why A is correct: Comparing risk scores across periods reveals direction of travel, letting leaders see if remediation is outpacing new findings and whether investment is working.
Why B is wrong: Licensing checks are an operational housekeeping task unrelated to trends; the mention of subnets adds plausibility but does not describe why trends are reported.
Why C is wrong: Trend reporting summarises alongside detailed records; it never removes the need for them, so this is a tempting but incorrect efficiency claim.
Why D is wrong: CVSS base scoring is a per-finding scoring activity done at intake, not the aim of period-over-period trend reporting, though both involve scores.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CS0-004 bank for this domain.
The executive report lists every plugin identifier and raw CVSS vector so leaders can validate each finding themselves
errorWhy it is wrong: This is the technical detail administrators need to act; handing raw plugin data to executives buries the risk story they actually need.
Add the full CVSS temporal and environmental sub-scores beside each vector so the board can see the precise severity maths.
errorWhy it is wrong: Tempting because environmental scoring adds rigour, but exposing more vector detail deepens the technical burden the board already found unusable.
The exact remediation command required to patch each individual host in the current estate
errorWhy it is wrong: Per-host fix detail belongs in an operational report and can appear in a single snapshot; it is not the added value of tracking data over time.