Report Writing & Documentation Flashcards

Which practice best ensures report confidentiality during transmission to a client?

Answer: Encrypting the report and transmitting via a secure channel

Encrypting the document and using a secure transmission channel (e.g., encrypted email, SFTP) protects report contents from interception.

A security analyst writes: 'The server is vulnerable.' What is the key documentation deficiency in this statement?

Answer: It lacks specificity about which server, which vulnerability, and evidence

Effective documentation requires specificity: which system is affected, what the vulnerability is, and evidence supporting the finding.

In incident response documentation, what is the purpose of a 'lessons learned' report?

Answer: To improve future detection, response, and prevention capabilities

Lessons learned reports drive continuous improvement by identifying what worked, what failed, and what process or technical changes should be made.

Which MITRE ATT&CK component is most useful for mapping adversary behavior in a threat intelligence report?

Answer: Tactics and techniques

MITRE ATT&CK tactics and techniques provide a structured, standardized vocabulary for describing how adversaries operate, improving report clarity and defensive mapping.

When documenting network traffic evidence in a forensic report, which file format is the industry standard for packet captures?

Answer: .pcap / .pcapng

PCAP and PCAPng are the standard formats for packet capture files, supported by tools like Wireshark and accepted in forensic proceedings.

What is the key difference between a 'finding' and a 'recommendation' in a security report?

Answer: A finding describes what was observed; a recommendation prescribes what to do about it

Findings document observed evidence of a problem, while recommendations provide actionable guidance for remediation or risk reduction.

Which element makes a security metric 'actionable' in an operational security report?

Answer: Being tied to a specific decision or remediation activity

Actionable metrics are directly linked to decisions or actions that can reduce risk, rather than being informational statistics without follow-through.