easyMultiple Choice
CS0-003 Containment strategy Practice Question
After a high-priority SOC escalation, file shares show rapid encryption and ransom-note creation from one workstation. What is the best immediate containment action?
⚠ Common exam trap
The CS0-004 exam often tests the misconception that you should run scans, restore backups, or notify users first, but the trap is that immediate containment (isolation) is always the priority to stop the spread, not investigation or recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the workstation and disable its active sessions to file servers
Isolating the workstation and disabling its active sessions to file servers is the best immediate containment action. This stops the encryption and lateral spread, follows NIST SP 800-61 and standard incident response procedures, and prioritizes containment before investigation or remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run vulnerability scans on every subnet first
Why it's wrong here
Scanning is slower than immediate containment for active encryption.
- ✗
Restore backups before isolating the host
Why it's wrong here
Restoration before containment may lead to reinfection.
- ✗
Email all users the ransom note
Why it's wrong here
That spreads panic and adds no technical containment.
- ✓
Isolate the workstation and disable its active sessions to file servers
Why this is correct
Containment should stop encryption spread while preserving evidence for analysis. In containment, responders need action that reduces risk while preserving the investigation record.
Go deeper
Related to this question
Learn chapter
Endpoint Detection and Response
Key term
SOC
A Security Operations Center (SOC) is a centralized team that monitors, detects, analyzes, and responds to cybersecurity incidents to protect an organization's information systems.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.