After a fire destroyed a company's primary data center, the IT team is working to restore services from backups at an alternate site. The company's recovery time objective (RTO) for the customer relationship management (CRM) system is four hours. Which metric is most important to track to ensure the restoration meets the RTO?

The number of employees affected by the outage

The amount of data lost since the last backup

The time taken to restore the CRM system from backups

A manufacturing company relies on a critical ERP system for order processing. During a recent ransomware incident, the ERP system was down for two days, causing significant revenue loss. Management wants to reduce the impact of such incidents in the future. Which strategy is most directly aimed at maintaining business operations during a disruption?

Increasing the incident response team's budget for forensic tools

Developing a disaster recovery plan that focuses on restoring the ERP system

Implementing a redundant ERP system in a secondary data center

Purchasing cyber insurance to cover revenue losses

An organization has a mature incident response plan and conducts tabletop exercises annually. After a recent exercise, the team identified that the communication plan was unclear, and some members did not know when to escalate. What is the most effective way to address these findings?

Conduct another tabletop exercise immediately to test the team again

Replace the incident response team members

Update the incident response plan to clarify communication and escalation procedures

Provide additional training on communication skills

During an incident investigation, a forensic analyst needs to preserve evidence from a compromised server. The analyst wants to ensure the evidence is admissible in court. Which action is most important to take?

Create a cryptographic hash of the evidence and document the chain of custody

Use the server's built-in tools to collect evidence

Copy the evidence to a network share for easy access

Reboot the server to ensure it is in a stable state

CompTIACySA+

Domain 3Objective 3

Incident Management Life Cycle CS0-003 Practice Questions (Page 4)

Part of the Incident response management domain, which accounts for 20% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

20%of the exam

Questions 16–20

16foundation · easy
Which technique is commonly used in root cause analysis to identify the underlying cause of an incident?
Select an answer first
17application · medium
After a fire destroyed a company's primary data center, the IT team is working to restore services from backups at an alternate site. The company's recovery time objective (RTO) for the customer relationship management (CRM) system is four hours. Which metric is most important to track to ensure the restoration meets the RTO?
Select an answer first
18application · medium
A manufacturing company relies on a critical ERP system for order processing. During a recent ransomware incident, the ERP system was down for two days, causing significant revenue loss. Management wants to reduce the impact of such incidents in the future. Which strategy is most directly aimed at maintaining business operations during a disruption?
Select an answer first
19application · medium
An organization has a mature incident response plan and conducts tabletop exercises annually. After a recent exercise, the team identified that the communication plan was unclear, and some members did not know when to escalate. What is the most effective way to address these findings?
Select an answer first
20application · medium
During an incident investigation, a forensic analyst needs to preserve evidence from a compromised server. The analyst wants to ensure the evidence is admissible in court. Which action is most important to take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.

Incident Management Life Cycle CS0-003 Practice Questions (Page 4)

Questions 16–20

Which technique is commonly used in root cause analysis to identify the underlying cause of an incident?

An organization has a mature incident response plan and conducts tabletop exercises annually. After a recent exercise, the team identified that the communication plan was unclear, and some members did not know when to escalate. What is the most effective way to address these findings?

During an incident investigation, a forensic analyst needs to preserve evidence from a compromised server. The analyst wants to ensure the evidence is admissible in court. Which action is most important to take?

Keep studying — Incident response management