CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Capture a forensic image of the affected systems

  Why this is correct

  Capturing a forensic image of affected systems is the correct first step because it creates a bit-for-bit copy of the storage media while preserving file slack, unallocated space, and metadata. Using a hardware write-blocker and cryptographic hashing ensures the evidence remains intact and tamper-proof for later analysis. This action is essential for identifying how the data exfiltration occurred, which files were accessed, and what remnants remain, all without altering the original source.

• ✗

  Change passwords for affected accounts

  Why it's wrong here

  Changing passwords for affected accounts is a containment and recovery measure, not an evidence preservation step. Password resets modify authentication logs and Kerberos/Authentication tokens, potentially destroying the very artifacts needed to trace an attacker's lateral movement or account hijacking. In incident response, credential rotation should be performed only after forensic data is captured, so that the evidence of the compromise remains pristine for legal or investigative review.

• ✗

  Disconnect the system from the network

  Why it's wrong here

  Disconnecting the system from the network is a vital containment action to stop ongoing data exfiltration, but it is not the immediate priority in the preservation phase. Network isolation abruptly terminates live connections, causing volatile evidence such as active TCP/UDP sessions, ephemeral ports, and in-memory network buffers to be lost forever. It may also trigger remote kill-switches or anti-forensic routines, so it should be executed only after volatile data and forensic images have been collected.

• ✓

  Record current active network connections

  Why this is correct

  Recording current active network connections is a critical evidence preservation technique because this volatile data disappears the moment the system is rebooted, disconnected, or the attacker cleans up. Documenting netstat output, established connections, remote IPs, ports, and associated process IDs provides a snapshot of potential command-and-control or exfiltration channels. This is a low-impact, non-destructive step that must occur before any containment action that would disrupt the network stack.

• ✗

  Kill malicious processes

  Why it's wrong here

  Killing malicious processes is a classic mistake because it destroys the volatile memory footprint of the malware, including injected code, decrypted payloads, API calls, and encryption keys. Terminating a process may also trigger self-deletion or anti-forensic mechanisms, erasing the very evidence needed to determine how data was exfiltrated. Instead, a memory dump should be collected first; only after forensic preservation should the process be safely stopped as part of containment.

Go deeper

Related to this question