mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: Refer to the exhibit
Exhibit
2025-02-15 08:23:45 | src=192.168.2.10 | dst=10.0.0.5 | port=443 | action=blocked | signature=ET TROJAN Suspicious Outbound Connection
Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?
⚠ Common exam trap
CompTIA often tests the candidate's ability to resist the impulse to immediately block or contain, emphasizing that verification against a baseline is the mandatory next step before any action in the incident response process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the baseline behavior of the source IP
The first step in incident response is to validate whether the activity is malicious by comparing it against a known baseline. Repeated entries from the same source IP could indicate a benign automated process (e.g., a legitimate monitoring tool or scheduled scan) rather than an attack. Checking the baseline behavior prevents unnecessary disruption and aligns with the NIST SP 800-61 incident response framework's emphasis on identification and analysis before containment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately block the source IP at the firewall
Why it's wrong here
Immediately blocking a source IP based solely on a SIEM alert, without prior verification, carries a significant risk of disrupting legitimate business operations. Many SIEM alerts can be false positives or indicate benign activity, especially if the alert threshold is low or the signature is overly broad. A security analyst's initial step should involve validating the alert's legitimacy to avoid impacting critical services or users.
- ✓
Check the baseline behavior of the source IP
Why this is correct
Checking the baseline behavior of the source IP is a crucial initial step in incident response, as it provides essential context for the triggered SIEM alert. By comparing the current activity against established normal patterns for that IP, the analyst can determine if the behavior is truly anomalous or if it represents a routine, albeit unusual, operation. This comparison helps to quickly differentiate between legitimate, expected traffic and genuinely suspicious activity, thereby reducing false positives and prioritizing actual threats.
- ✗
Update the signature database
Why it's wrong here
Updating the signature database is not an appropriate immediate response to an active SIEM alert that has already triggered. The alert indicates that an existing signature successfully identified a pattern, meaning the current database was sufficient to detect this specific event. While regular signature updates are vital for proactive defense against new threats, they do not directly address the investigation or remediation of an alert that has already been generated by an existing rule.
- ✗
Isolate the affected system for forensic analysis
Why it's wrong here
Isolating an affected system for forensic analysis is a containment strategy typically employed after an analyst has confirmed malicious activity and determined the scope of the compromise. Performing isolation as the very first step, without initial investigation or verification, could prematurely disrupt critical business functions or hinder the collection of live evidence. Initial steps should focus on validating the alert and understanding the nature of the potential incident before enacting such a disruptive measure.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
Analysis
In incident response, analysis is the process of examining data and events to determine what happened, how it happened, and what actions to take.
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.