A security analyst is reviewing network traffic and notices a series of DNS queries for random subdomains of a legitimate domain. The analyst suspects a DNS tunneling attack. Which detection technique is most effective to confirm this suspicion?

Check the workstation's browser history for visits to the domain

Analyze the DNS query patterns for high frequency and random subdomains

Block all DNS queries to the legitimate domain

Review the firewall logs for outbound connections to the domain

Which activity is part of the recovery process?

Isolating the affected network segment

Restoring data from verified backups

Deleting malicious files from infected systems

What is the main goal of the recovery process in incident response?

To contain the spread of the incident

To identify the root cause of the incident

To restore systems and operations to normal

To collect evidence for legal proceedings

A company discovers that an attacker has gained access to a database server and is exfiltrating data. The incident response team needs to contain the incident while minimizing data loss. Which action is most effective?

Disconnect the database server from the network

Take a forensic image of the database server

Change the database server's credentials

Block the attacker's IP address at the firewall

Which action is an example of a containment strategy?

Conducting a lessons-learned review

Disconnecting an infected host from the network

Restoring user data from backups

Reimaging the infected host from a known-good image

CompTIACySA+

Domain 3Objective 2

Incident Response Activities CS0-003 Practice Questions (Page 2)

Part of the Incident response management domain, which accounts for 20% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

20%of the exam

Questions 6–10

6expert · hard
A security analyst is reviewing network traffic and notices a series of DNS queries for random subdomains of a legitimate domain. The analyst suspects a DNS tunneling attack. Which detection technique is most effective to confirm this suspicion?
Select an answer first
7foundation · easy
Which activity is part of the recovery process?
Select an answer first
8foundation · easy
What is the main goal of the recovery process in incident response?
Select an answer first
9application · medium
A company discovers that an attacker has gained access to a database server and is exfiltrating data. The incident response team needs to contain the incident while minimizing data loss. Which action is most effective?
Select an answer first
10foundation · easy
Which action is an example of a containment strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.