hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A senior security analyst at a mid-sized…
You are a senior security analyst at a mid-sized financial company. The SOC has been alerted by the EDR system about anomalous behavior on a domain controller (DC) that runs Windows Server 2019. The alert indicates that a process named 'svchost.exe' spawned a PowerShell process that executed a one-liner to connect to an external IP address (203.0.113.5) over TCP port 443. Further investigation shows that the DC's event logs have gaps of about 10 minutes each, and the local administrator account 'Administrator' was used to log in from a workstation named 'WKSTN-FIN-12' at the time of the event. The company has strict policies: all administrative access must be via dedicated jump hosts, and privileged accounts are monitored. Upon checking, 'WKSTN-FIN-12' is assigned to an employee in the finance department who has no administrative privileges. The employee reports that they did not log in recently. The CISO wants a swift containment and eradication without losing forensic evidence. Based on this scenario, which of the following is the BEST first course of action?
⚠ Common exam trap
CompTIA often tests the distinction between containment and forensic preservation, trapping candidates who choose memory capture (Option B) as a first step instead of immediate isolation, or who mistakenly think powering down (Option C) preserves evidence when it actually destroys volatile data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Isolate the domain controller from the network by disabling its network interface.
Isolating the domain controller by disabling its network interface is the best first step because it immediately halts any ongoing malicious communication (e.g., C2 traffic over TCP 443) while preserving the volatile state of the system for forensic acquisition. This action prevents further data exfiltration or lateral movement without destroying evidence like memory or logs, which would occur with a power-down. It also aligns with the CISO's requirement for swift containment without losing forensic evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Isolate the domain controller from the network by disabling its network interface.
Why this is correct
Isolating the domain controller by disabling its network interface is the immediate priority in a suspected compromise. This action effectively contains the threat, preventing the attacker from further lateral movement, exfiltrating data, or causing additional damage across the network. Crucially, it preserves the system's current volatile state and disk evidence for subsequent forensic analysis, allowing investigators to understand the attack vector and scope. This containment strategy is a fundamental step in the incident response lifecycle.
- ✗
Capture a memory dump of the domain controller for offline analysis.
Why it's wrong here
While capturing a memory dump is a critical forensic step to preserve volatile data, performing it before isolating the domain controller is suboptimal and risky. Without prior isolation, the attacker could continue to operate, modify system state, or even detect the forensic activity and destroy evidence during the memory acquisition process. Therefore, containment must precede memory capture to ensure the integrity and completeness of the forensic evidence.
- ✗
Power down the domain controller to prevent further damage.
Why it's wrong here
Powering down the domain controller is generally an incorrect initial response to a compromise because it immediately destroys all volatile data, such as active processes, network connections, and cached credentials, which are crucial for forensic investigation. This action can erase valuable evidence regarding the attacker's activities and tools. A controlled shutdown or power-off should only occur after all necessary volatile data has been acquired and the system is fully isolated.
- ✗
Reset the password for the local Administrator account and revoke the user's access.
Why it's wrong here
Resetting the local Administrator password and revoking user access is an insufficient and potentially counterproductive response to a suspected domain controller compromise. This action does not isolate the system from the network, allowing the attacker to maintain persistence or pivot to other systems. Furthermore, it could alert the attacker to detection, prompting them to escalate privileges, destroy evidence, or launch more aggressive attacks before proper containment and investigation can occur.
Go deeper
Related to this question
Learn chapter
Network Traffic Analysis
Key term
EDR
Endpoint Detection and Response (EDR) is a cybersecurity technology that continuously monitors endpoint devices to detect, investigate, and respond to advanced threats.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.