After a ransomware incident, the incident response team has identified that the attacker used a vulnerability in a web application to gain initial access. The team has removed the ransomware and restored the systems. What is the most important eradication step to prevent a recurrence?

Patch the web application vulnerability

Monitor the network for signs of re-infection

Which activity is part of incident analysis?

Determining the data that was accessed or exfiltrated

Isolating the affected systems from the network

Restoring systems from verified backups

Deleting malicious files from infected hosts

Which action is part of eradication procedures?

Blocking the attacker's IP address at the firewall

Monitoring the network for signs of re-infection

Patching the vulnerability that was exploited

A company has completed the eradication of a malware infection. The incident response team is now in the recovery phase. Which activity is most important to ensure the systems are safe to return to production?

Monitor the systems for any signs of re-infection

Document the incident for future reference

Validate that the systems are clean and patched

Restore the systems from the latest backups

A security analyst notices repeated failed login attempts from a single external IP against the company's VPN gateway. The attempts are increasing in frequency and appear to be targeting a specific account. The analyst wants to prevent the attacker from continuing while preserving forensic evidence. Which action should the analyst take first?

Isolate the VPN gateway from the network

Disable the targeted user account

Enable verbose logging on the VPN gateway and capture network traffic

Block the external IP at the perimeter firewall

CompTIACySA+

Domain 3Objective 2

Incident Response Activities CS0-003 Practice Questions (Page 3)

Part of the Incident response management domain, which accounts for 20% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

5concepts

20%of the exam

Questions 11–15

11expert · hard
After a ransomware incident, the incident response team has identified that the attacker used a vulnerability in a web application to gain initial access. The team has removed the ransomware and restored the systems. What is the most important eradication step to prevent a recurrence?
Select an answer first
12foundation · easy
Which activity is part of incident analysis?
Select an answer first
13foundation · easy
Which action is part of eradication procedures?
Select an answer first
14application · medium
A company has completed the eradication of a malware infection. The incident response team is now in the recovery phase. Which activity is most important to ensure the systems are safe to return to production?
Select an answer first
15application · medium
A security analyst notices repeated failed login attempts from a single external IP against the company's VPN gateway. The attempts are increasing in frequency and appear to be targeting a specific account. The analyst wants to prevent the attacker from continuing while preserving forensic evidence. Which action should the analyst take first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.