CompTIA CySA+ — Incident Response and Reporting flashcards
10 of 73 cards free to study here · 2 topics · the whole deck is built into Willys
CS0-003 domains 3 and 4: IR preparation and playbooks, detection and scoping, forensic acquisition and volatility, containment, eradication and recovery, root cause analysis and lessons learned, vulnerability and incident reporting, remediation inhibitors and metrics such as MTTD and MTTR.
Learn deck · part of CompTIA CySA+ · written against: Exam CS0-003 objectives. Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
What belongs in an incident response plan, as opposed to a playbook?The IR plan is the governing document: mission, scope, authority, roles, severity definitions, and communication and escalation paths. A playbook is the step-by-step procedure for one incident type, such as phishing or ransomware, and is what a responder follows at 2 a.m.Incident Response and Management › Preparation
-
Why should legal, communications and executives take part in incident response tabletop exercises, not just the SOC?Major incidents force business decisions — hiring outside forensics, notifying regulators, taking revenue systems offline, making public statements. A tabletop lets those people rehearse their roles and exposes gaps in authority and contact lists before a real crisis.Incident Response and Management › Preparation
-
Why should an IR plan state in advance who may take a production system offline?Containment can mean shutting down revenue-producing systems. If that authority is not pre-assigned, responders lose hours waiting for a decision while the attacker keeps spreading.Incident Response and Management › Preparation
-
What goes in an incident responder's jump kit, and why is it prepared in advance?A forensic laptop, write blockers, sterile storage media, cables, imaging and memory-capture tools, evidence bags, custody forms and the contact list. Preparing it beforehand avoids hunting for tools while volatile evidence decays.Incident Response and Management › Preparation
-
Responders suspect the attacker can read corporate email and chat. How should the IR team communicate?Out of band — over a separate channel such as phones or a pre-arranged platform outside the compromised environment, so the attacker cannot watch the response unfold.Incident Response and Management › Preparation
-
What should a vulnerability report for system owners contain?The vulnerabilities, the affected hosts, a risk score and priority, the recommended mitigation, and whether each finding is recurring — so owners know what to fix first and why.Reporting and Communication › Vulnerability Reporting
-
The same finding keeps reappearing on servers that were patched last quarter. What does that recurrence usually indicate?A process failure — servers rebuilt from an outdated image, configuration drift, or a rolled-back patch. Fix the build image and configuration management, not just the individual hosts.Reporting and Communication › Vulnerability Reporting
-
How should a vulnerability report for executives differ from one for system administrators?Executives need risk trends, business impact, compliance status and resourcing decisions in plain language; administrators need the detail — hosts, CVEs and fix steps. One report rarely serves both.Reporting and Communication › Vulnerability Reporting
-
What is a compliance report in vulnerability management, and who relies on it?A report of status against a specific requirement — PCI DSS scanning, a CIS benchmark — with evidence of remediation. Auditors, regulators and compliance officers rely on it.Reporting and Communication › Vulnerability Reporting
-
Hundreds of hosts are missing the same configuration fix. Besides patching, which action-plan items address it?Configuration management (correct the baseline and enforce it automatically), awareness and training if staff keep reintroducing the setting, and compensating controls where the fix must wait.Reporting and Communication › Vulnerability Reporting
Unlock the whole deck
You are studying a free 10-card sample. All 73 cards of CompTIA CySA+ — Incident Response and Reporting, the other 2 CompTIA CySA+ decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More CompTIA CySA+ decks
← All CompTIA CySA+ decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- CompTIA CySA+ CS0-003 exam objectives — topic outline only; no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CompTIA® and CySA+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.
Use of these pages is covered by our Terms of Use.