Given a scenario, perform incident response activities
7 practice questions under this official exam objective (CS0-003) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
Ransomware Incident Response: Forensic Imaging vs. Containment
This question tests the correct sequence of incident response activities during an ongoing ransomware attack, specifically prioritizing forensic evide
Preserving Evidence for Suspected Misuse Investigation
This question addresses the critical step of preserving digital evidence during an internal HR investigation. It establishes that creating a forensic
Which Data Sources Survive Malware Cleanup to Reveal Root Cause?
This CySA+ CS0-003 scenario asks which forensic data sources remain useful after malware deletes its dropper, prefetch files, and event log entries. T
What Should Be Done First After PII Is Emailed to a Personal Account?
This CySA+ scenario tests incident-response ordering when an employee has sent PII to a personal webmail account. It establishes that the analyst shou
How Do You Identify the Source IP and IoC in a Website Defacement?
This CS0-003 simulation asks the analyst to correlate web-server and SFTP logs after a website defacement, pick the offending source IP and IoC, then
Post-Investigation Actions: Root Cause Analysis in Incident Response
This question tests the correct sequencing of incident response activities, specifically identifying root cause analysis as a key post-investigation s
Best Method to Preserve System Hard Drive Data for Litigation
This question tests the correct procedure for digital forensics and evidence preservation during litigation. The best method to ensure data integrity