CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Apply security patches to vulnerable systems

  Why this is correct

  Apply security patches to vulnerable systems is the definitive root-cause remediation for a ransomware outbreak. If the initial infection exploited a known software flaw, patching closes the exact vulnerability the attacker used, preventing the same binary from reinfecting hosts after cleanup. This action breaks the kill chain at the exploitation stage and is mandatory before restored systems are placed back on the production network. Without patching, any unpatched host still exposed to the same entry vector will likely be re-encrypted within hours.

• ✓

  Rotate all privileged account credentials

  Why this is correct

  Rotating all privileged account credentials is critical because ransomware operators frequently steal administrator, domain admin, or service account hashes to move laterally and disable backups. Once credentials are compromised, the attacker can maintain persistence even if files are quarantined, using Scheduled Tasks or remote management tools backed by those valid accounts. Immediate rotation of every privileged password, including local admin accounts and Kerberos service tickets, invalidates the attacker's existing access. This must be done before restoring systems, not after, or the attacker will simply re-encrypt the rebuilt servers.

• ✗

  Isolate the infected systems from the network

  Why it's wrong here

  Isolating infected systems from the network is a valid short-term containment tactic that limits lateral movement, but it does nothing to remove the ransomware or recover already encrypted files. Network isolation only buys time for the incident response team to determine the scope of the breach and begin eradication. It may also disrupt business operations if critical servers are disconnected, and it does not address the underlying vulnerability or compromised credentials that allowed the attack. In a formal incident response plan, isolation is a Phase 1 step, not the final remediation.

• ✗

  Block the ransomware's C2 domain at the firewall

  Why it's wrong here

  Blocking the ransomware's C2 domain at the firewall is another short-term containment measure that severs the malicious program's ability to receive commands or exfiltrate data. However, modern ransomware often uses domain generation algorithms (DGA), hardcoded fallback IP addresses, or multiple redundant C2 servers, so one block is insufficient. This action also fails to decrypt files, remove resident malware, or restore systems to a known-good state. It is a defensive countermeasure, not a recovery or eradication step, and must be paired with a comprehensive root-cause investigation.

• ✓

  Rebuild affected servers from clean backups

  Why this is correct

  Rebuilding affected servers from clean backups is the most reliable way to recover encrypted data while ensuring the ransomware is completely eradicated. The backup must be verified malware-free and ideally restored from offline or immutable storage, because many ransomware strains delete or encrypt backup copies. Clean restoration eliminates malicious files, registry entries, and persistence mechanisms that might survive a simple antivirus scan. For fully successful recovery, this step must be combined with patching vulnerabilities and resetting compromised credentials to prevent a repeat infection.

Go deeper

Related to this question