CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Email gateway logs for the week prior to the incident

  Why this is correct

  Email gateway logs are the primary source for identifying phishing payloads because ransomware often arrives via malicious attachments or embedded URLs. These logs capture sender metadata, subject lines, message IDs, and any verdicts (e.g., quarantined, spam, clean), so reviewing the week prior to the incident lets investigators trace the exact message that delivered the initial dropper and recover the full email thread for IoC extraction.

• ✓

  Endpoint detection and response (EDR) logs from affected servers

  Why this is correct

  EDR logs are crucial because they record the execution sequence on the affected servers, including process creation with command-line arguments, file creation/modification events, registry changes, and parent-child process relationships. Analysts can pinpoint the exact executable or script that initiated the encryption, determine whether it used a known LOLBin or PowerShell, and observe post-execution behavior such as privilege escalation or credential dumping before the ransomware ran.

• ✓

  Network traffic logs from the perimeter firewall

  Why this is correct

  Perimeter firewall logs reveal the network-level indicators of compromise, such as initial outbound HTTP/HTTPS connections to attacker-controlled domains or IPs, DNS queries for malicious hostnames, and protocol anomalies that may correspond to command-and-control beaconing. Even if the initial payload was delivered by email, firewall egress logs help map the ransomware's callback infrastructure and may expose the original C2 channel used for key exchange or data staging.

• ✗

  Physical access logs to the data center

  Why it's wrong here

  Physical access logs are not useful because ransomware is overwhelmingly delivered via remote vectors like phishing, exploit kits, or vulnerable network services, and the encryption process itself leaves no trace in door-entry records. Even if an insider were present, these logs would only show who entered the data center, not what they did on the network, and there is no evidence of on-premises tampering in a typical ransomware incident.

• ✗

  Firewall configuration backups

  Why it's wrong here

  Firewall configuration backups are irrelevant for determining the infection vector because they document the rulebase, NAT policies, and interface settings—not the actual traffic flows or the historical events that allowed the malware to enter. While a config change might be a sign of attacker persistence, the question asks for the *initial infection path*, and configuration snapshots do not contain or correlate with the inbound phishing email, file execution, or network session needed for that forensic timeline.

Go deeper

Related to this question