CS0-004 - Incident Response and Management (24% of the exam) - Section 3.3
Given a scenario, implement incident response techniques.
Apply the correct response technique to the evidence in front of the analyst: containment (isolation, segmentation), eradication (removing persistence and artefacts), and recovery (restoration and validation), while preserving evidence and chain of custody. Choose the action keyed to the right phase rather than jumping ahead, and act as a defender rather than taking an offensive step.
containment and isolationeradication and persistence removalrecovery and restorationevidence preservation and chain of custodyforensic acquisition order of volatility
Practice question for this objective
lock_openFree sampleIncident Response and Managementmedium
An intrusion analyst is placing observed activity on the Cyber Kill Chain to decide where detection is weakest. Evidence so far: a malicious macro document was opened, a second-stage implant was written to disk, and the implant beaconed outbound every 60 seconds but no lateral movement or data staging has appeared. Which Kill Chain phase has the adversary MOST clearly reached?
AActions on Objectives, because a second-stage implant was successfully written to the victim disk
BDelivery, because a malicious macro document reached and was opened by the user
CExploitation, because the macro executed code when the document was opened
DCommand and Control, because the implant is beaconing to an external controller on a regular intervalcheck_circle Correct
Identify the furthest Cyber Kill Chain phase an adversary has reached from beaconing evidence rather than an earlier completed phase. The Kill Chain is sequential, so the correct read is the latest phase the evidence supports; a steady outbound beacon to an external controller is the signature of Command and Control, which sits after delivery, exploitation, and installation but before actions on objectives.
Why A is wrong: Tempting because the implant landing feels like a goal achieved, but writing a payload is installation, and no data theft or impact has occurred, so this phase is premature.
Why B is wrong: Tempting because the macro document is the delivery mechanism, but the adversary has clearly progressed past delivery to installation and beaconing, so naming delivery understates the furthest phase reached.
Why C is wrong: Tempting because macro execution is exploitation, but that phase is already complete and the beaconing places the adversary later in the chain, so this is not the furthest phase.
Why D is correct: Correct: a repeating outbound beacon to an external controller is the defining evidence of the Command and Control phase, which the 60-second interval demonstrates.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CS0-004 bank for this domain.
Reimage the file server immediately from a known-good gold image to remove the ransomware binary.
errorWhy it is wrong: Tempting because reimaging does remove the malware, but it is an eradication and recovery step that destroys volatile evidence and is premature while spread is not yet contained.
Power off the server at once to stop the beaconing and prevent any further attacker activity
errorWhy it is wrong: Pulling power stops the beacon but destroys volatile memory evidence the legal team needs, so it satisfies containment at the cost of the preservation requirement.
Power the workstation off immediately to guarantee the beaconing traffic stops
errorWhy it is wrong: Powering off does halt exfiltration but destroys volatile memory evidence and the live state management explicitly asked to preserve, so it fails the second requirement.