CS0-003 Incident Response and Management Practice Question
During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a finance workstation to a known malicious IP address at 2:00 AM. The analyst checks the firewall logs and sees a single connection. Which action should the analyst take FIRST according to NIST SP 800-61?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate the incident by reviewing additional data sources.
NIST SP 800-61 emphasizes that during detection and analysis, the first step is to validate the incident as a true positive before escalating or containing. The analyst should confirm the alert is not a false positive by gathering additional evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Validate the incident by reviewing additional data sources.
Why this is correct
Validating the incident is the crucial initial step in the detection and analysis phase. This involves corroborating the initial alert by reviewing additional data sources such as logs from firewalls, intrusion detection systems, endpoint detection and response (EDR) tools, and network flow data. This process helps to confirm if the alert represents a true security incident, thereby minimizing false positives and preventing the premature allocation of valuable incident response resources to non-threats.
- ✗
Run a full antivirus scan on the workstation.
Why it's wrong here
Running a full antivirus scan on the workstation is a response action typically performed during the eradication or recovery phases, not the initial detection and analysis. While it can identify malware, initiating such a scan prematurely, before validating the incident and potentially containing the threat, could alert an attacker to detection or even interfere with forensic data collection. The primary goal during detection is understanding, not immediate remediation.
- ✗
Isolate the workstation from the network immediately.
Why it's wrong here
Isolating the workstation from the network immediately is a containment strategy, which generally follows the detection and analysis phase. Premature isolation, before validating the incident and understanding its scope, could hinder further investigation by cutting off access to critical telemetry or prevent the collection of live forensic data. Furthermore, isolating a system based on a false positive can unnecessarily disrupt business operations and waste resources.
- ✗
Notify law enforcement per the incident response plan.
Why it's wrong here
Notifying law enforcement is a significant step reserved for confirmed, severe incidents with potential legal ramifications, and it typically occurs much later in the incident response lifecycle, often after containment and evidence preservation. During the detection and analysis phase, the focus is on understanding the nature and scope of the event, not on external legal reporting. Premature notification could lead to unnecessary legal involvement or complicate internal investigation efforts.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
False positive
A false positive is an alert or result that indicates a security threat or vulnerability exists when in fact there is no real issue.
Key term
Alert
An alert is a notification that something unusual or potentially harmful has happened in a computer system or network.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.