How should I use these Incident Response and Management practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Incident Response and Management questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Incident Response and Management domain.

CS0-003 · topic practice

Incident Response and Management practice questions

Practise CompTIA CySA+ CS0-003 Incident Response and Management practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Incident Response and Management

Practice 10 questions Browse domain →

What the exam tests

What to know about Incident Response and Management

Incident Response and Management questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Incident Response and Management exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Incident Response and Management questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Incident Response and Management explanation →

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, an analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which step should the analyst perform next to validate the alert?

Trap 1: Search for the IP address on VirusTotal and Shodan.

While threat intel enrichment is useful, it is part of validation but not the next immediate step; correlation with internal data is needed first.

Trap 2: Escalate the alert to the incident response team for containment.

Escalation is important but should follow validation.

Trap 3: Contain the host immediately by disconnecting it from the network.

Containment should occur after validation to avoid unnecessary disruption.

Study all Incident Response and Management common traps →

A
Search for the IP address on VirusTotal and Shodan.
Why wrong: While threat intel enrichment is useful, it is part of validation but not the next immediate step; correlation with internal data is needed first.
B
Correlate the alert with other logs and endpoint data to confirm malicious activity.
Correlation helps validate the alert before taking action.
C
Escalate the alert to the incident response team for containment.
Why wrong: Escalation is important but should follow validation.
D
Contain the host immediately by disconnecting it from the network.
Why wrong: Containment should occur after validation to avoid unnecessary disruption.

Incident Response and Management practice questions

What to know about Incident Response and Management

Common Incident Response and Management exam traps

Incident Response and Management questions

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, an analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which step should the analyst perform next to validate the alert?

A forensic analyst is investigating a suspected data breach involving a compromised workstation. The analyst wants to collect volatile data in accordance with the order of volatility. Which sequence of data collection is correct?

After containing a malware outbreak, the incident response team performs static malware analysis on a suspicious executable. Which of the following artifacts would be most helpful in creating a YARA rule to detect variants of the malware?

An organization uses MISP as its threat intelligence platform. After a security incident, the team wants to share IOCs with other trusted organizations. Which standard should they use to package and exchange the threat intelligence?

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for a recent breach was 14 days, while the mean time to respond (MTTR) was 6 hours. Which metric should the team prioritize to improve in future incidents?

A security analyst is performing memory acquisition on a compromised Linux server using LiME. The analyst needs to capture the memory image with minimal impact on the system. Which of the following parameters should the analyst use to ensure the output is forensically sound?

An analyst receives an alert about a user account that has been locked out multiple times within an hour. The account belongs to a system administrator. Which incident category does this scenario most likely fall under?

During a forensic investigation, an analyst creates a disk image using dd with a SHA256 hash. Later, the analyst needs to verify the integrity of the image before analysis. Which command should the analyst use to compare the original hash with a newly computed hash?

During a post-incident activity, the CSIRT performs a root cause analysis for a data breach. They discover that the breach originated from a misconfigured S3 bucket that allowed public read access. Which of the following actions should be included in the lessons learned to prevent recurrence?

A security analyst is responding to a potential data exfiltration incident. As part of the containment strategy, the analyst must preserve evidence. Which TWO actions should the analyst take before containment? (Select two.)

A CSIRT is investigating a ransomware incident that encrypted files on multiple servers. The team needs to determine the initial infection vector. Which THREE pieces of evidence should the team prioritize collecting? (Select three.)

A security analyst is reviewing IOCs from a threat intelligence feed. The analyst wants to enrich the IOCs using open-source tools. Which THREE tools are commonly used for IOC enrichment? (Select three.)

During which phase of the NIST SP 800-61 incident response lifecycle would an organization conduct a lessons learned meeting?

A security analyst detects ransomware on a critical server. Which containment strategy should be implemented FIRST to minimize damage?

During a forensic investigation, an analyst needs to acquire memory from a Linux server. Which tool is specifically designed for this purpose?

Which of the following is the MOST volatile data according to the order of volatility?

An analyst is reviewing a suspicious executable using static analysis. Which of the following would provide information about the functions the executable imports from system libraries?

Track your progress over time

Start a Incident Response and Management only practice session

Related CS0-003 topic practice pages

Security Operations practice questions

Vulnerability Management practice questions

Incident Response and Management practice questions

Reporting and Communication practice questions

CompTIA A+ hardware practice questions

CompTIA A+ mobile devices practice questions

CompTIA A+ networking practice questions

CompTIA A+ operating systems practice questions

CompTIA A+ security practice questions

CompTIA A+ software troubleshooting questions

CompTIA A+ operational procedures questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid