mediumMultiple SelectObjective-mapped
CS0-003 Practice Question: An incident response team is analyzing a…
An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)
⚠ Common exam trap
CompTIA often tests the distinction between containment actions (immediate isolation) and eradication actions (patching, imaging), so candidates mistakenly select 'creating a forensic image' or 'patching the vulnerability' as containment steps when they actually belong to later phases of the incident response process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolating affected systems from the network by disabling their network interfaces.
Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolating affected systems from the network by disabling their network interfaces.
Why this is correct
Disabling a system's network interface is a host-level containment tactic that immediately severs all traffic to and from the endpoint, cutting off command-and-control (C2), exfiltration, and lateral movement at the machine itself. This is an effective first-response action during an active outbreak because it acts instantly, though it can disrupt operations and can hinder remote forensic access if a terminal is unavailable.
- ✗
Creating a forensic image of the infected systems for later analysis.
Why it's wrong here
While creating a forensic image is essential for preserving evidence and supporting post-incident analysis, it does nothing to stop the malware from continuing to communicate or spread across the network. Containment must occur first to halt active propagation; imaging is a preservation step, not a containment action. In this scenario, it is a wrong answer because it fails to address the immediate threat.
- ✓
Blocking outbound communication from infected hosts at the firewall.
Why this is correct
Blocking outbound traffic from infected hosts at the firewall is a network-level containment measure that prevents data exfiltration and command-and-control (C2) callbacks while still allowing some network connectivity and monitoring. It is a correct action during outbreak containment because it curbs the malware's external communication; however, on its own it may not prevent internal lateral movement unless combined with segmentation or host isolation.
- ✗
Identifying and patching the vulnerability exploited by the malware.
Why it's wrong here
Identifying and patching the exploited vulnerability is part of eradication and recovery, not immediate containment. Patching requires vulnerability analysis, patch availability, and deployment, during which malware can continue spreading; it also does not remediate systems already compromised. Thus, it is not an appropriate initial containment action for an active outbreak.
- ✓
Implementing network segmentation to prevent lateral movement.
Why this is correct
Network segmentation uses VLANs or firewall rules to place infected hosts into isolated VLANs or zones, thereby preventing lateral movement and restricting the malware's ability to reach other critical assets. This is a valid containment strategy because it limits propagation without necessarily removing all connectivity, allowing continued monitoring. It is more deliberate than disabling NICs but still directly addresses the active threat.
- ✗
Notifying law enforcement agencies about the incident.
Why it's wrong here
Notifying law enforcement is a legal and procedural obligation that may be required by policy, but it is not a technical containment action. It has no effect on malware execution, communication, or spread, and should occur in accordance with the incident response plan after containment is initiated. Consequently, it is incorrect in the context of immediate incident containment.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
Worm
A worm is a type of malicious software that can copy itself and spread to other computers over a network, often without any human action.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.