CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Apply security patches to all systems

  Why this is correct

  Patching is the definitive root-cause remediation because it closes the precise vulnerability (e.g., an unpatched remote code execution flaw in an internet-facing service) that the attacker exploited for initial access. Unlike containment actions, it eliminates the possibility of the same attack vector being reused, even after cleanup or rebuilding. Without applying the patch, any other remediation leaves the underlying weakness exposed, allowing rapid reinfection.

• ✗

  Isolate the affected network segment

  Why it's wrong here

  Isolating the affected network segment (e.g., VLAN segmentation or unplugging switches) is a short-term containment tactic that limits lateral movement and contains the blast radius, but it does not eliminate the attacker's foothold or the vulnerability. The compromised systems remain infected and unpatched, and the attacker may have already established persistence that is unaffected by the isolation. This is a stopgap measure to buy time, not a final fix.

• ✗

  Disable compromised user accounts

  Why it's wrong here

  Disabling compromised user accounts stops the attacker from using stolen credentials through normal authentication, but it ignores other persistence mechanisms such as newly created backdoor accounts, scheduled tasks, or service modifications. The root vulnerability remains unpatched, so the attacker can simply re-exploit the same flaw to regain access even without valid credentials. This is a reactive containment step, not a comprehensive remediation strategy.

• ✗

  Block malicious IPs at the firewall

  Why it's wrong here

  Blocking malicious IPs at the firewall disrupts communication with known command-and-control (C2) servers or attacking hosts, but attackers easily rotate IPs, leverage cloud services, or use DNS over HTTPS to evade such blocks. Compromised systems remain intact and unpatched, so the attacker can pivot through new infrastructure or re-attract from an alternate source. This is an ephemeral, reactive measure that fails to address the underlying vulnerability.

• ✓

  Rebuild compromised systems from known good media

  Why this is correct

  Rebuilding compromised systems from known good media ensures that no persistent malware, rootkits, or backdoors survive, which is essential for systems that are deeply compromised and cannot be trusted. However, rebuilding alone does not correct the security flaw that permitted the initial intrusion; if the vulnerability is left unpatched, the attacker can reinfect the freshly built system using the same exploit. This is a thorough eradication step, but it must be paired with patching to achieve true root-cause resolution.

Go deeper

Related to this question