mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst for a mid-sized financial…
You are a security analyst for a mid-sized financial services company. At 2:30 PM, the endpoint detection and response (EDR) console alerts on three workstations in the accounting department, indicating that files are being encrypted with a '.encrypt' extension and a ransom note named 'READ_ME_NOW.html' has been dropped. The workstations are connected to a file server that hosts shared financial records and a domain controller that handles authentication. The file server and domain controller have not shown signs of compromise yet. Your incident response plan states that containment must begin within 15 minutes of detection. Based on your analysis of the EDR telemetry, the encryption process appears to be spreading via SMB connections from the first infected workstation. Which of the following is the BEST immediate containment action to prevent further spread while preserving evidence?
⚠ Common exam trap
CompTIA often tests the distinction between containment (stopping the spread) and eradication (removing the threat), and the trap here is that candidates confuse immediate containment with remediation actions like patching or shutting down systems, which either take too long or destroy evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immediately isolate the three workstations by disconnecting their network cables at the patch panel or disabling their switch ports.
Immediately isolating the three infected workstations at the network level (disconnecting cables or disabling switch ports) stops the SMB-based encryption propagation without destroying volatile forensic data. This containment action preserves the running processes, memory, and disk state for later analysis, which would be lost if the systems were powered off. The 15-minute containment window makes network isolation the fastest and most effective method to halt lateral movement while maintaining evidence integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Immediately isolate the three workstations by disconnecting their network cables at the patch panel or disabling their switch ports.
Why this is correct
This action is the most effective initial containment strategy. Disconnecting network cables or disabling switch ports immediately prevents further lateral movement of the ransomware to other systems, including critical servers, while keeping the infected workstations powered on. This preserves volatile memory and disk state, which is crucial for forensic analysis to identify the initial infection vector, malware characteristics, and potential exfiltration attempts before remediation.
- ✗
Shut down the file server and domain controller to protect critical systems from potential encryption.
Why it's wrong here
Shutting down critical infrastructure like file servers and domain controllers is premature and highly disruptive, impacting business operations unnecessarily when these systems are not confirmed to be compromised. Furthermore, powering off these servers would destroy valuable volatile memory data, such as active network connections, running processes, and logged-in users, which could be vital for understanding the broader scope of the attack if they were indeed targeted or compromised. The immediate priority is containing the *known* infection.
- ✗
Power off the three infected workstations immediately to contain the encryption process.
Why it's wrong here
Powering off the infected workstations immediately, while seemingly containing the encryption, would destroy critical volatile memory data. This includes running processes, network connections, open files, and cached credentials, all of which are invaluable for forensic investigators to determine the initial compromise vector, the malware's behavior, and potential command-and-control communications. Preserving this evidence is paramount for a thorough incident response.
- ✗
Apply the latest SMB vulnerability patch to the file server and domain controller to block the propagation vector.
Why it's wrong here
Applying patches to the file server and domain controller, while a good long-term security practice, does not address the immediate threat of active ransomware on the three workstations. The encryption process on the already infected machines would continue locally, and patching does not prevent lateral movement from systems already compromised and potentially exploiting other vulnerabilities or credentials. Containment of the active threat takes precedence over preventative patching at this stage.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
Key term
Isolation
Isolation is the process of separating a compromised or suspicious system from a network to prevent the spread of malware or unauthorized access.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.