CSX Report Writing & Documentation 2 — Questions and Answers
Question 1: When documenting a security incident timeline, which format best supports chronological accuracy?
- Local server time without timezone
- UTC timestamps with millisecond precision (Correct answer)
- Approximate time ranges
- Relative time references like 'two hours after'
Correct answer: UTC timestamps with millisecond precision
UTC timestamps with millisecond precision eliminate timezone ambiguity and support precise correlation across distributed systems.
Question 2: Which section of an executive summary should describe the business impact of a security incident?
- Technical findings
- Scope and methodology
- Risk and impact assessment (Correct answer)
- Appendices
Correct answer: Risk and impact assessment
The risk and impact assessment section translates technical findings into business terms that executives can act upon.
Question 3: A penetration tester discovers a critical vulnerability but the client asks to omit it from the report. What is the appropriate response?
- Omit it as the client requested
- Include it and note the client's objection (Correct answer)
- Downgrade the severity to low
- Report only to the CEO verbally
Correct answer: Include it and note the client's objection
Professional integrity requires documenting all findings; the tester should include the finding while noting any client disagreement.
Question 4: What does CVSS base score measure in vulnerability reporting?
- The financial cost of remediation
- The intrinsic characteristics of a vulnerability independent of environment (Correct answer)
- The number of systems affected
- The time required to patch the vulnerability
Correct answer: The intrinsic characteristics of a vulnerability independent of environment
CVSS base score captures the intrinsic properties of a vulnerability such as attack vector, complexity, and impact, independent of any specific environment.
Question 5: Which chain-of-custody element is most critical when digital evidence may be used in legal proceedings?
- File size of the evidence
- Hash values taken before and after each transfer (Correct answer)
- The analyst's years of experience
- The brand of forensic hardware used
Correct answer: Hash values taken before and after each transfer
Cryptographic hash values verify that evidence has not been altered during collection, storage, or transfer, which is essential for admissibility.
Question 6: In a threat intelligence report, what distinguishes an Indicator of Compromise (IoC) from a Tactic, Technique, and Procedure (TTP)?
- IoCs describe attacker behavior patterns; TTPs are file hashes
- IoCs are specific artifacts like IPs or hashes; TTPs describe attacker behavior patterns (Correct answer)
- IoCs are only network-based; TTPs are only host-based
- There is no practical difference between IoCs and TTPs
Correct answer: IoCs are specific artifacts like IPs or hashes; TTPs describe attacker behavior patterns
IoCs are specific forensic artifacts (hashes, IPs, domains) used for detection, while TTPs describe the broader methods and behaviors of threat actors.
Question 7: When writing remediation recommendations in a security report, what is the recommended prioritization approach?
- Alphabetical order by vulnerability name
- Risk-based, addressing highest severity findings first (Correct answer)
- Cost-based, starting with cheapest fixes
- Chronological order of discovery
Correct answer: Risk-based, addressing highest severity findings first
Risk-based prioritization ensures that resources are applied first to the vulnerabilities that pose the greatest threat to the organization.
CSX Report Writing & Documentation 2
When documenting a security incident timeline, which format best supports chronological accuracy?