hardMultiple SelectObjective-mapped
CV0-004 Practice Question: A cloud security team is investigating a…
A cloud security team is investigating a potential data breach. Which THREE actions should be taken immediately?
⚠ Common exam trap
CompTIA often tests the misconception that deleting logs or notifying all users immediately is a valid first response, when in fact containment and evidence preservation are the top priorities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the affected systems from the network
Isolating affected systems from the network (B) is a critical immediate action to contain a potential data breach. This prevents lateral movement by an attacker and stops further data exfiltration, aligning with incident response best practices such as NIST SP 800-61. In a cloud environment, this could involve applying a security group rule to deny all traffic or disconnecting a virtual network interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete all logs to prevent further evidence exposure
Why it's wrong here
Deleting logs destroys critical forensic evidence.
- ✓
Isolate the affected systems from the network
Why this is correct
Isolation contains the breach and prevents lateral movement.
- ✓
Capture a forensic snapshot of the affected storage
Why this is correct
A snapshot preserves the state for analysis.
- ✗
Notify all users via email
Why it's wrong here
Notification should come after investigation and legal review.
- ✓
Preserve logs and system state
Why this is correct
Preserving logs and state is essential for incident response.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.