How should I use these Incident Response and Management practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Incident Response and Management questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Incident Response and Management domain.

CS0-003 · topic practice

Incident Response and Management practice questions

Incident Response questions always test the order of phases and the containment decision. Memorise the six phases in order and understand why containment comes before eradication — it is the most common sequence trap.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Incident Response and Management

Practice 10 questions Browse domain →

What the exam tests

What to know about Incident Response and Management

Incident Response questions test the IR lifecycle phases, evidence handling, containment strategies, and regulatory notification timelines.

IR phases: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.

Evidence preservation: chain of custody, write-blockers, and forensic imaging before analysis.

Containment strategies: isolate vs shut down — choosing based on business continuity vs evidence preservation.

Notification timelines: regulatory requirements (GDPR 72 hours, US state laws) and internal escalation paths.

Watch out for

Common Incident Response and Management exam traps

▸Jumping to Eradication before Containment — the threat is still active if you skip containment.
▸Destroying evidence by powering off a machine that stores volatile memory (RAM) containing malware artefacts.
▸Forgetting that Lessons Learned is a mandatory phase, not an optional debrief.
▸Confusing the IR team's role with law enforcement's role — IR teams preserve evidence for law enforcement, not investigate crimes.

Practice set

Incident Response and Management questions

20 questions · select your answer, then reveal the explanation

Question 1hardmulti select

Read the full Incident Response and Management explanation →

A host is suspected of running fileless malware. Which artefacts should be collected quickly? (Choose two.)

Trap 1: A list of cafeteria purchases

Purchases are unrelated to malware state.

Trap 2: A printed office map

The map does not preserve host compromise evidence.

Study all Incident Response and Management common traps →

A
Memory image or live response data
Fileless activity may exist mainly in memory.
B
Active network connections and running processes
Live state helps reconstruct behaviour.
C
A list of cafeteria purchases
Why wrong: Purchases are unrelated to malware state.
D
A printed office map
Why wrong: The map does not preserve host compromise evidence.

Incident Response and Management practice questions

What to know about Incident Response and Management

Common Incident Response and Management exam traps

Incident Response and Management questions

A host is suspected of running fileless malware. Which artefacts should be collected quickly? (Choose two.)

A phishing incident led to credential theft. Which containment actions are appropriate? (Choose two.)

Which actions belong in eradication after a confirmed web-shell compromise? (Choose two.)

What should be included in incident scoping for ransomware? (Choose three.)

A legal hold is issued during an investigation. Which actions support it? (Choose two.)

A tabletop exercise reveals that no one knows who can approve public statements. What should be updated? (Choose two.)

A responder is acquiring evidence from a potentially compromised server. Which actions support forensic integrity? (Choose two.)

An attacker used a stolen cloud token. Which evidence helps determine blast radius? (Choose two.)

Which actions are appropriate before restoring systems after malware eradication? (Choose two.)

A root-cause analysis finds that an alert fired but was never triaged. Which corrective actions are useful? (Choose two.)

A user reports approving an unexpected OAuth consent prompt for an app named 'Invoice Reader'. The app now has mailbox read permissions. What should the incident responder do first? During detection and analysis, which decision is most defensible?

File shares show rapid encryption and ransom-note creation from one workstation. What is the best immediate containment action? During containment, which decision is most defensible?

A developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first? During eradication, which decision is most defensible?

A web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible?

A laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible?

A server suspected of running fileless malware is still powered on. Which evidence should be captured first if it is safe to do so? During detection and analysis, which decision is most defensible?

After containing a compromised host, analysis shows persistence through a scheduled task and a stolen service account. What is required before recovery? During containment, which decision is most defensible?

An incident was contained successfully, but delayed escalation allowed the attacker more dwell time. What should the post-incident review produce? During eradication, which decision is most defensible?

A malware alert affects a single kiosk with no sensitive access. A second alert shows the same malware on a domain admin workstation. What should drive severity? During recovery, which decision is most defensible?

A company wants to test whether legal, PR, IT, and executives understand their roles during a ransomware incident without touching production systems. What exercise is best? During post-incident improvement, which decision is most defensible?

Track your progress over time

Start a Incident Response and Management only practice session

Related CS0-003 topic practice pages

Security Operations practice questions

Vulnerability Management practice questions

Incident Response and Management practice questions

Reporting and Communication practice questions

CompTIA A+ hardware practice questions

CompTIA A+ mobile devices practice questions

CompTIA A+ networking practice questions

CompTIA A+ operating systems practice questions

CompTIA A+ security practice questions

CompTIA A+ software troubleshooting questions

CompTIA A+ operational procedures questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid