Which of the following is a key metric used in disaster recovery planning?

Annualized Rate of Occurrence (ARO)

A company experienced a service outage that was traced to a misconfigured change to a load balancer. The change was made by a junior administrator who followed a documented procedure. The incident response team has restored service. During the root cause analysis, the team finds that the documented procedure was outdated and did not include a required validation step. What is the most important corrective action?

Update the documented procedure to include the validation step

Conduct a tabletop exercise to test the load balancer change process

Retrain the junior administrator on the correct procedure

Disable the junior administrator's access to the load balancer

Which of the following is a key benefit of conducting tabletop exercises?

Guaranteeing that all security vulnerabilities are fixed

Eliminating the need for further security training

Replacing the need for a formal incident response plan

Identifying gaps in the incident response plan and improving coordination

What is the purpose of root cause analysis in incident response?

To document the incident for insurance claims

To restore systems to their pre-incident state

To assign blame to the employee who caused the incident

To identify the underlying reason an incident occurred so it can be prevented from recurring

Which of the following best describes the structure of a typical incident response playbook?

A list of incident response team members and their contact information

A sequence of actions, decision points, and responsible roles for a specific incident type

A high-level overview of the incident response process without specific steps

A collection of forensic tools and their installation guides

CompTIACySA+

Domain 3Objective 3

Incident Management Life Cycle CS0-003 Practice Questions (Page 6)

Part of the Incident response management domain, which accounts for 20% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

20%of the exam

Questions 26–30

26foundation · easy
Which of the following is a key metric used in disaster recovery planning?
Select an answer first
27expert · hard
A company experienced a service outage that was traced to a misconfigured change to a load balancer. The change was made by a junior administrator who followed a documented procedure. The incident response team has restored service. During the root cause analysis, the team finds that the documented procedure was outdated and did not include a required validation step. What is the most important corrective action?
Select an answer first
28foundation · easy
Which of the following is a key benefit of conducting tabletop exercises?
Select an answer first
29foundation · easy
What is the purpose of root cause analysis in incident response?
Select an answer first
30foundation · easy
Which of the following best describes the structure of a typical incident response playbook?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.