hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A hospital's IT department has been receiving…
A hospital's IT department has been receiving reports from nursing staff that the electronic medical record (EMR) system is responding slowly during peak hours. The network team has verified that the local area network is operating normally and there is no bandwidth congestion. The security analyst reviews the firewall logs and observes repeated outbound connections from the EMR server to an external IP address 198.51.100.23 on TCP port 443 at regular 5-minute intervals. Each connection transfers a small amount of data. The analyst also notes that the EMR server's antivirus software is up to date and no malware has been detected. The hospital's security policy requires that all outbound connections from critical servers be explicitly approved. Further investigation reveals that 198.51.100.23 is associated with a hosting provider in a foreign country. The analyst suspects a data exfiltration. Which of the following actions should the analyst take FIRST?
⚠ Common exam trap
CompTIA often tests the principle of 'least disruption first' in incident response, where candidates mistakenly choose an aggressive containment action (like isolation or blocking) before gathering sufficient evidence to confirm the threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture and analyze the network traffic between the EMR server and the external IP.
The analyst must first confirm whether the outbound connections are actually exfiltrating data or are legitimate (e.g., software updates, license checks). Capturing and analyzing the network traffic (e.g., using tcpdump or Wireshark) allows the analyst to inspect the payload and determine the nature of the data being sent, which is a standard step in incident response before taking more disruptive actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install a network-based intrusion detection system to monitor the server.
Why it's wrong here
Installing a network-based intrusion detection system (NIDS) at this stage is a proactive security enhancement, but it does not address the immediate need to investigate the already reported suspicious connections. An IDS would primarily monitor future traffic for known attack signatures or anomalies, offering little insight into the historical or current nature of the specific suspicious communications that have already occurred or are ongoing. This action is a long-term control, not an immediate incident response investigation technique.
- ✓
Capture and analyze the network traffic between the EMR server and the external IP.
Why this is correct
Capturing and analyzing the network traffic between the EMR server and the external IP address is the most effective immediate step. This action allows security analysts to perform deep packet inspection, revealing the protocols, data payloads, and true intent of the communication. This critical evidence determines whether data exfiltration is occurring, what specific data is being sent, and if the connection is malicious or benign, enabling an informed and targeted response without premature disruption.
- ✗
Isolate the EMR server from the network and run a full forensic analysis.
Why it's wrong here
Isolating the EMR server from the network and immediately initiating a full forensic analysis is a drastic containment and recovery step that is premature without further investigation. While isolation is crucial for containing confirmed threats, doing so without understanding the nature of the suspicious traffic could unnecessarily disrupt critical hospital operations if the connections are legitimate. A full forensic analysis is resource-intensive and typically follows initial identification and containment, not precedes it.
- ✗
Block all outbound traffic from the EMR server to the internet immediately.
Why it's wrong here
Blocking all outbound traffic from the EMR server to the internet immediately is an overly aggressive containment measure that could severely disrupt legitimate hospital operations. EMR systems often require outbound connectivity for updates, integrations with external services, or even legitimate vendor support. Implementing such a broad block without first understanding the nature of the suspicious traffic risks causing significant availability issues and impacting patient care unnecessarily.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.