CS0-003 Incident Response and Management Practice Question
During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which of the following is the most appropriate next step?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Collect additional logs and perform a deeper analysis to confirm the compromise.
After detection, the analyst should collect additional data to confirm the incident and scope the impact before proceeding to containment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notify law enforcement immediately.
Why it's wrong here
Contacting law enforcement prematurely during the detection and analysis phase is inappropriate because the incident has not yet been validated or scoped. Legal notification protocols are typically initiated during or after the containment and evidence preservation stages, once the organization has established a clear, legally defensible understanding of the compromise.
- ✗
Immediately isolate the host from the network.
Why it's wrong here
While network isolation is a critical containment strategy, executing it prematurely during the detection phase can alert an active adversary and destroy volatile forensic evidence, such as RAM contents. Analysts must first confirm the compromise and preserve volatile data before severing network connectivity.
- ✗
Rebuild the host from a known good image.
Why it's wrong here
Rebuilding a compromised host from a clean baseline image is a remediation activity that belongs to the eradication and recovery phase of the incident response lifecycle. Performing this action during detection and analysis would prematurely destroy the system state, preventing analysts from identifying the root cause or determining the extent of the intrusion.
- ✓
Collect additional logs and perform a deeper analysis to confirm the compromise.
Why this is correct
The detection and analysis phase focuses on validating alerts to minimize false positives and accurately scope the potential incident. Gathering supplementary log sources, correlating event data, and conducting deeper forensic analysis are essential steps to confirm that a true compromise has occurred before initiating disruptive containment actions.
Go deeper
Related to this question
Learn chapter
Incident Response Process
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.