A security analyst is monitoring network traffic and notices a large amount of data being sent to an external IP address during non-business hours. The analyst suspects data exfiltration. Which detection technique is most effective to confirm the exfiltration?

Review the DNS logs for queries to the external IP

Block the external IP address at the firewall

Check the system logs for user logins during non-business hours

Analyze the network traffic for patterns of large data transfers

After a security incident, the incident response team has identified a backdoor account created by the attacker. The team has removed the account and is now in the eradication phase. Which additional action is most important?

Review all user accounts for unauthorized changes

Monitor the network for signs of re-infection

Restore the system from a clean backup

Notify the affected users of the incident

After containing a ransomware outbreak, the incident response team has identified the initial infection vector as a phishing email with a malicious attachment. The team has removed the malware from all affected systems. What is the next step in the eradication phase?

Notify law enforcement of the incident

Patch the vulnerability exploited by the phishing email

Monitor the network for signs of re-infection

Restore the affected systems from backups

A company has just eradicated a malware infection from its file servers. The servers were encrypted by ransomware, and the company has clean backups. What is the most important consideration when restoring the servers from backups?

Restore the servers to the same network segment as before

Restore the servers as quickly as possible to minimize downtime

Notify users that their files have been restored

Ensure the backups are free of malware before restoration

A security analyst is analyzing a suspicious file that was downloaded from the internet. The analyst runs the file in a sandbox and observes that it creates a scheduled task and attempts to communicate with an external IP address. What should the analyst conclude from this analysis?

The file is likely malware and should be contained

The file is benign and can be allowed

The file is a false positive and can be ignored

The file is a legitimate application that requires network access

CompTIACySA+

Domain 3Objective 2

Incident Response Activities CS0-003 Practice Questions (Page 1)

Part of the Incident response management domain, which accounts for 20% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

20%of the exam

Questions 1–5

1expert · hard
A security analyst is monitoring network traffic and notices a large amount of data being sent to an external IP address during non-business hours. The analyst suspects data exfiltration. Which detection technique is most effective to confirm the exfiltration?
Select an answer first
2application · medium
After a security incident, the incident response team has identified a backdoor account created by the attacker. The team has removed the account and is now in the eradication phase. Which additional action is most important?
Select an answer first
3application · medium
After containing a ransomware outbreak, the incident response team has identified the initial infection vector as a phishing email with a malicious attachment. The team has removed the malware from all affected systems. What is the next step in the eradication phase?
Select an answer first
4application · medium
A company has just eradicated a malware infection from its file servers. The servers were encrypted by ransomware, and the company has clean backups. What is the most important consideration when restoring the servers from backups?
Select an answer first
5application · medium
A security analyst is analyzing a suspicious file that was downloaded from the internet. The analyst runs the file in a sandbox and observes that it creates a scheduled task and attempts to communicate with an external IP address. What should the analyst conclude from this analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.