CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Blocking the ransomware's command-and-control IP at the firewall

  Why it's wrong here

  While blocking a ransomware C2 IP at the firewall can momentarily disrupt command-and-control, this measure is quickly circumvented because attackers routinely use domain generation algorithms, fast-flux DNS, or multiple fallback addresses to change their infrastructure. Moreover, it fails to address the underlying infection, the initial entry vector, or any laterally spread malware, so the ransomware remains active and capable of continuing its encryption or exfiltration. Consequently, it is only a stopgap containment tactic, not a complete containment or eradication step.

• ✓

  Patching the vulnerability exploited by the ransomware

  Why this is correct

  Patching the specific vulnerability that the ransomware exploited is a definitive eradication measure because it closes the door at the root cause, preventing both the current strain and any similar variations from re-entering through the same path. This step, derived from the incident's root cause analysis, is essential for protecting not only the affected hosts but also all other unpatched systems in the environment. Without this patch, even after rebuilding or credential rotation, the same hole remains, leaving the network vulnerable to immediate reinfection.

• ✓

  Rebuilding affected servers from known-good backups

  Why this is correct

  Rebuilding affected servers from known-good backups is required because ransomware often installs backdoors, disables security controls, or embeds itself in volume shadow copies and system restore points, so simply deleting the malicious files is rarely sufficient. The backups must be verified free of malware and should be restored to a clean, hardened state with patching and configuration baselines reapplied. This approach ensures that the trust boundary of the system is re-established, eliminating any persistent foothold the adversary may have planted, and is a core recovery action in the incident response plan.

• ✓

  Rotating all service account credentials

  Why this is correct

  Rotating all service account credentials is critical because attackers frequently harvest password hashes, Kerberos tickets, or plaintext secrets from memory (e.g., via credential dumping) and then use these accounts to move laterally, maintain persistence, or access data stores. By rotating passwords for every service account, especially those with elevated privileges, the incident response team invalidates any stolen credentials, cutting off a key avenue of access. Additionally, this must include scheduled tasks, application accounts, and any embedded secrets to prevent the attacker from leveraging long-lived accounts to regain a foothold.

• ✗

  Isolating the affected network segment

  Why it's wrong here

  Isolating the affected network segment (e.g., via VLAN segregation or disconnecting switches) is a rapid containment action that physically halts east-west propagation and buys time, but it is not a complete containment solution by itself. Attackers often have pre-positioned remote access, compromised credentials, or alternate paths that bypass the isolated segment, and the isolation does nothing to remove the malware already present or prevent reinfection from a different vector. Furthermore, continuing isolation can severely impact business operations, so it must be followed by proper eradication and recovery steps rather than being viewed as a final answer.

Go deeper

Related to this question