Given a scenario, perform incident response activities
10 practice questions under this official exam objective (CS0-003), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
10 total · page 1 of 1Ransomware Incident Response: Forensic Imaging vs. Containment
This question tests the correct sequence of incident response activities during an ongoing ransomware attack, specifically prioritizing forensic evide
Preserving Evidence for Suspected Misuse Investigation
This question addresses the critical step of preserving digital evidence during an internal HR investigation. It establishes that creating a forensic
Which Data Sources Survive Malware Cleanup to Reveal Root Cause?
This CySA+ CS0-003 scenario asks which forensic data sources remain useful after malware deletes its dropper, prefetch files, and event log entries. T
Next Step After Server Recovery in Incident Response
This CySA+ CS0-003 question tests knowledge of the incident response lifecycle. After a server is recovered, the correct next step is reporting (post-
External Requirements for Incident Management Communication
Identify the two external requirements that impose constraints on incident management communication: regulatory compliance and contractual SLAs. This
What Should Be Done First After PII Is Emailed to a Personal Account?
This CySA+ scenario tests incident-response ordering when an employee has sent PII to a personal webmail account. It establishes that the analyst shou
Protecting High-Value Assets via EDR When Perimeter Blocking is Restricted
This question explores incident response strategies when perimeter blocking is operationally restricted. The correct approach is to add the malicious
How Do You Identify the Source IP and IoC in a Website Defacement?
This CS0-003 simulation asks the analyst to correlate web-server and SFTP logs after a website defacement, pick the offending source IP and IoC, then
Post-Investigation Actions: Root Cause Analysis in Incident Response
This question tests the correct sequencing of incident response activities, specifically identifying root cause analysis as a key post-investigation s
Best Method to Preserve System Hard Drive Data for Litigation
This question tests the correct procedure for digital forensics and evidence preservation during litigation. The best method to ensure data integrity