CS0-003 Incident Response and Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Conducting more frequent tabletop exercises

  Why it's wrong here

  While tabletop exercises are highly valuable for validating incident response plans, improving communication, and training personnel on containment procedures, they do not enhance real-time technical visibility. They are administrative simulations that cannot actively monitor endpoints or reduce the time it takes to detect an ongoing live intrusion.

• ✗

  Rotating credentials for all service accounts

  Why it's wrong here

  Rotating service account credentials is an effective containment or eradication strategy designed to invalidate compromised credentials and limit lateral movement. However, this reactive hardening measure does not provide the continuous monitoring or telemetry required to identify and alert on malicious activity in its early stages.

• ✓

  Deploying additional endpoint detection and response (EDR) sensors

  Why this is correct

  Deploying additional EDR sensors directly addresses visibility gaps by expanding host-level monitoring across the enterprise. This allows the security team to collect real-time telemetry, analyze behavioral anomalies, and rapidly detect malicious activities, thereby significantly reducing the mean time to detect (MTTD) future incidents.

• ✗

  Implementing a new patch management process

  Why it's wrong here

  Implementing a robust patch management process is a proactive security hygiene practice that reduces the organization's attack surface by remediating known vulnerabilities. While this prevents exploits from succeeding, it does not provide the active detection capabilities or real-time alerting needed to discover active adversaries who bypass these defenses.

Go deeper

Related to this question