CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A security analyst is drafting an incident report for an unauthorized access event that resulted in a brief service disruption. The report needs to clearly communicate the impact to technical stakeholders, including network engineers and system administrators. Which of the following details would be MOST important to include to ensure effective technical communication?
- ADetailed network flow data and affected system configurations.
- BEstimated financial cost of the service disruption.
- CHigh-level business impact statement for executive leadership.
- DRecommendations for improving security awareness training.
Show answer & explanationAnswer & explanation
Correct answer: A. Detailed network flow data and affected system configurations.
Technical stakeholders like network engineers and system administrators require granular, actionable data to understand the incident's technical scope and implement effective remediation. Detailed network flow data and affected system configurations provide the necessary context for them to diagnose, fix, and prevent recurrence at a technical level.
Why the other options are wrong
- B. Financial cost is a business impact metric, not directly relevant for technical troubleshooting.
- C. This is suitable for executive communication, not technical stakeholders.
- D. Security awareness training is a human factor recommendation, not technical detail needed for system remediation.
Technical Incident Communication
Technical incident communication involves providing granular, actionable data specific to the affected systems, networks, and applications to enable technical teams to understand, diagnose, and remediate incidents effectively.
- Focuses on 'how' the incident occurred technically.
- Includes logs, configurations, network data, forensic findings.
- Aids in root cause analysis and technical remediation.
Memory trick: Technical details: logs, configurations, network traffic, for the tech crew.