mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security operations center (SOC) analyst is…
A security operations center (SOC) analyst is investigating an alert from the endpoint detection and response (EDR) system indicating that a process named "svchost.exe" spawned from a parent process "cmd.exe" on a user workstation. The user is a software developer who frequently uses command-line tools. The analyst checks the command line arguments: "cmd.exe /c powershell -EncodedCommand ...". The encoded command decodes to a script that downloads a payload from a remote server and executes it. The analyst also sees that the workstation has established an outbound connection to the same server on port 443. Which of the following is the BEST immediate action?
⚠ Common exam trap
CompTIA often tests the misconception that blocking the remote IP or killing the process is sufficient, but the trap here is that the active outbound connection and running payload require immediate network containment to prevent data exfiltration and lateral movement, not just reactive blocking or process termination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation from the network.
Isolating the workstation is the best immediate action because the EDR alert confirms active compromise: a malicious encoded PowerShell command executed via cmd.exe spawned svchost.exe (a process commonly abused for masquerading), and an outbound connection to the same C2 server on port 443 (HTTPS) indicates ongoing data exfiltration or further payload delivery. Network isolation stops all communication with the attacker while preserving forensic evidence on the endpoint, which is critical for containment in a SOC response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the workstation from the network.
Why this is correct
Network isolation immediately severs all communication pathways for the compromised workstation. This critical containment step prevents the malware from exfiltrating data, receiving further command and control (C2) instructions, or attempting lateral movement to other internal systems. It effectively quarantines the threat, buying crucial time for incident responders to analyze the payload and plan remediation without further risk to the broader network.
- ✗
Disable the user account.
Why it's wrong here
Disabling the user account primarily restricts future authentication attempts by that specific user. However, it does not terminate active processes or established network connections that the malware may have already initiated under that user's context or, more commonly, under a system account with elevated privileges. The malicious payload would continue to execute and potentially communicate, as its runtime environment is unaffected by the account's disabled status.
- ✗
Kill the svchost.exe process.
Why it's wrong here
Killing a generic svchost.exe process is a highly risky and often ineffective action. svchost.exe is a legitimate Windows process that hosts numerous system services, and indiscriminately terminating it can lead to system instability, crashes, or critical service outages. Furthermore, sophisticated malware often injects into multiple legitimate processes or establishes persistence mechanisms that would remain active even if one specific svchost instance were terminated.
- ✗
Block the remote server IP at the firewall.
Why it's wrong here
Blocking the remote server IP at the firewall is a beneficial defensive measure, but it is insufficient as an initial containment strategy for an already compromised workstation. While it prevents future outbound communication to that specific Command and Control (C2) server, it does not address the active malicious processes running locally on the infected machine. The malware could still operate internally, attempt lateral movement, or utilize alternative C2 channels or domain names not covered by the IP block.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.