CS0-003 Incident Response and Management Practice Question
A security analyst is classifying an incident where an employee's workstation is infected with ransomware that encrypts files and displays a ransom note. Which incident category and severity level best describe this scenario?
⚠ Common exam trap
In the CompTIA CySA+ exam, a common trap is confusing 'Malware' with 'Data breach' when ransomware is involved. Ransomware typically encrypts files but does not necessarily exfiltrate them; thus classification as 'Malware' is more appropriate than 'Data breach' unless there is evidence of data exfiltration. Additionally, severity is 'moderate' for a single workstation incident, not 'high', which would require broader organizational impact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Malware, moderate
Ransomware is a specific subtype of malware that encrypts files and demands payment, making 'Malware' the appropriate incident category. The severity is 'moderate' because while the infection impacts a single workstation and causes data loss, it does not immediately compromise the entire network or expose sensitive data at scale, aligning with typical moderate-severity criteria for isolated malware incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DDoS, low
Why it's wrong here
DDoS describes volumetric traffic exhausting availability, not file encryption on one endpoint, and low understates the impact. It tempts because DDoS is correctly categorised, at low severity, when junk traffic briefly degrades a non-critical service without data loss.
- ✓
Malware, moderate
Why this is correct
Ransomware is malware, so the category is straightforward. Moderate severity fits because a single infected workstation is contained, not spreading enterprise-wide, yet file encryption and a ransom demand still disrupt business operations and require remediation.
- ✗
Data breach, high
Why it's wrong here
Ransomware encryption is a malware/availability incident, not a data breach: confidentiality loss requires confirmed exfiltration or unauthorised access to data, which the stem never states. It tempts because ransomware often precedes breach disclosure, and confirmed exfiltration would justify high severity.
- ✗
Insider threat, high
Why it's wrong here
Insider threat covers malicious or negligent actions by trusted users; here malware encrypted the workstation, with no evidence the employee acted. It tempts because insider threat is correctly categorised when a trusted user deliberately exfiltrates or misuses access.
Go deeper
Related to this question
Learn chapter
Data Breach Incident Response
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.