hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: In a regulated payment environment, after…
In a regulated payment environment, after containing a compromised host, analysis shows persistence through a scheduled task and a stolen service account. What is required before recovery? During containment, which decision is most defensible? which action best reduces risk without losing evidence?
⚠ Common exam trap
CompTIA often tests the misconception that containment (isolation) alone is sufficient for recovery, but the exam emphasizes that eradication (removing persistence and rotating credentials) and validation (checking other hosts) are mandatory steps before declaring recovery complete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove persistence, rotate affected credentials, and verify no related hosts remain compromised
After containing a compromised host, the recovery phase requires removing the persistence mechanism (the scheduled task), rotating the stolen service account credentials to prevent re-authentication, and verifying that no other hosts are compromised via lateral movement. This ensures the threat is fully eradicated before returning the host to production, which is critical in a regulated payment environment where PCI DSS or similar standards mandate thorough remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reconnect the host because users need it
Why it's wrong here
Reconnection before eradication can allow reinfection.
- ✗
Disable logging to improve performance
Why it's wrong here
Logging is critical during recovery validation.
- ✗
Close the incident after isolation
Why it's wrong here
Isolation is containment, not full eradication or recovery.
- ✓
Remove persistence, rotate affected credentials, and verify no related hosts remain compromised
Why this is correct
Recovery should follow eradication of persistence and credential exposure. In containment, responders need action that reduces risk while preserving the investigation record.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.