CS0-003 Incident Response and Management Practice Question
An incident responder is called to a server room where a critical database server is exhibiting signs of compromise. The responder must preserve evidence while preventing further damage. Which of the following is a short-term containment strategy that also preserves evidence?
⚠ Common exam trap
In the CompTIA CySA+ exam, the trap is that candidates may select Option C (power off) thinking it 'freezes' the state, but this destroys volatile evidence and does not contain the incident if the attacker has remote access. Option D (memory dump) is a forensic step, not containment. Option A (reboot) modifies the system. Only Option B isolates while preserving volatile data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disconnect the network cable from the server.
Disconnecting the network cable (Option B) is the correct short-term containment strategy because it immediately isolates the compromised database server from the network, preventing further lateral movement or data exfiltration, while preserving the volatile system state (memory, running processes, open network connections) for forensic analysis. This action stops active network-based attacks without altering the contents of RAM or disk, which is critical for evidence integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reboot the server into safe mode.
Why it's wrong here
Rebooting a server, even into safe mode, irrevocably alters the system's volatile memory, destroys active processes, and clears critical log buffers. This action contaminates the forensic evidence by changing the live state of the compromised system, making it impossible to capture the true initial state of the intrusion and understand the full scope of the attack.
- ✓
Disconnect the network cable from the server.
Why this is correct
Disconnecting the network cable immediately isolates the compromised server from the network, preventing further malicious activity such as data exfiltration, lateral movement, or command-and-control communication. This crucial containment step preserves the current volatile system state for subsequent forensic acquisition without introducing significant changes, allowing for a more accurate investigation.
- ✗
Power off the server to freeze the system state.
Why it's wrong here
Powering off the server immediately destroys all volatile memory contents, including running processes, active network connections, open files, and potentially critical encryption keys or malware residing only in RAM. This irreversible loss of ephemeral data significantly hinders forensic analysis, as much of the evidence crucial for understanding the attack's scope and methodology resides in the system's live memory.
- ✗
Run a memory dump with WinPmem before any action.
Why it's wrong here
While a memory dump is an essential forensic step, performing it *before* isolating the system is a critical misstep in incident response. Executing tools on a live, potentially compromised network-connected server risks alerting the attacker, allowing them to destroy evidence, exfiltrate more data, or escalate privileges during the acquisition process. Containment must precede forensic collection to secure the environment.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Containment strategy
A containment strategy is a set of actions taken during a security incident to stop the threat from spreading or causing further damage while preserving evidence for analysis.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.