hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A senior incident responder for a large…
You are a senior incident responder for a large technology company. During a routine threat hunting exercise, you detect unusual network traffic from a Linux web server to an external IP address that is known to be associated with an advanced persistent threat (APT) group. The web server runs a custom PHP application and is not in the DMZ; instead, it's on the internal network serving a management dashboard. You have captured a memory dump of the web server and analyzed it with volatility. The output shows a suspicious process running with the name 'apache2' but with an invalid parent process (PID 1 is 'apache2' itself). Additionally, you find a kernel module loaded called 'hideproc.ko' that is not part of the standard kernel. The network connections show a reverse shell to the external IP. You need to determine the most effective containment and eradication strategy that minimizes data loss and maintains business continuity while preserving evidence for law enforcement involvement.
⚠ Common exam trap
Candidates often choose a containment-only option (D) or a patch-only option (B) because they underestimate the persistence of kernel-level rootkits, failing to recognize that eradication requires complete reimaging from a trusted source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the web server from the network immediately, capture a full disk and memory image, then reimage the server from a trusted backup or OS image, and restore application data from a known clean backup.
The presence of a kernel rootkit ('hideproc.ko') and a reverse shell indicates deep, persistent compromise that cannot be cleaned by patching or scanning. Isolating the server preserves volatile evidence (memory, disk) for law enforcement, while reimaging from a trusted backup ensures complete removal of the attacker's foothold, minimizing data loss and restoring business continuity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Revert the web server to a previous snapshot from before the suspected compromise date, then run a full antivirus scan on the restored system.
Why it's wrong here
Reverting to a snapshot may not remove a kernel rootkit that persists across boots if it is stored outside the snapshot (e.g., in a dedicated partition). Also, antivirus scans often miss custom APT malware, and this does not preserve evidence properly.
- ✗
Perform a live forensic analysis of the PHP application logs and database to identify the specific vulnerability used, then apply a hotfix to the application code.
Why it's wrong here
Performing a live forensic analysis and applying an application hotfix is insufficient because it fails to address the identified kernel rootkit. An APT will establish deep persistence beyond just the application layer, and a hotfix only targets a specific vulnerability, not the underlying compromise. Furthermore, live analysis on a compromised system risks alerting the attacker or corrupting critical evidence, and it doesn't eradicate the kernel-level malware.
- ✓
Isolate the web server from the network immediately, capture a full disk and memory image, then reimage the server from a trusted backup or OS image, and restore application data from a known clean backup.
Why this is correct
Immediately isolating the web server is crucial for containment, stopping the active reverse shell and preventing lateral movement. Capturing full disk and memory images preserves all forensic evidence, including the kernel rootkit and attacker activities, for post-incident analysis. Reimaging the server from a trusted source and restoring known clean application data ensures complete eradication of all malicious components and persistence mechanisms, preventing re-infection and ensuring system integrity.
- ✗
Block the external IP address at the firewall and block all outbound traffic from the web server except to specific internal IPs, then continue monitoring for other compromised hosts.
Why it's wrong here
Blocking external IP addresses and outbound traffic at the firewall is a network-level containment measure that does not eradicate the threat from the compromised host itself. The kernel rootkit and other APT persistence mechanisms remain active on the server, allowing the attacker to potentially pivot internally, establish new C2 channels, or maintain control. This approach leaves the compromised server operational and vulnerable, failing to achieve true remediation.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Threat Hunting
Key term
Containment
Containment is the incident response phase where security teams isolate a compromised system or network to prevent the threat from spreading further while preserving evidence.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.