SaveMyCert
Log in
5 of 5 free questions left today·for 10 a day
CS0-004 · Domain 3

Incident Response and Management practice questions

Incident Response and Management is worth 24% of the CS0-004 exam — the 3rd-heaviest of the 4 domains. Attack methodology frameworks, the incident response process from preparation to post-incident, and hands-on response techniques: triage, evidence, containment, remediation and root cause. Official weighting 24%. 6 fully worked examples are further down this page, answers included.

Exam weight
24%
the 3rd-heaviest of the 4 domains
Questions
143
across 3 topics
Free, no account
5/day
a free account allows 10 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 4 domains, in Learn mode.

Review what you missed

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Incident Response and Management questions, fully explained

Questions from the CS0-004 bank mapped to domain 3, with the answer key and the reasoning behind every option. None of them repeat the examples on the main CS0-004 practice page.

Question 1Incident Response and Management

A threat report on a recent campaign says the actor paired a public exploit for a PDF reader flaw with a remote-access trojan and packaged both inside a fake résumé before any message was sent to the targets. In the Cyber Kill Chain, which phase does this packaging step describe?

Choose one.

  • a
    Reconnaissance

    Reconnaissance is researching and selecting targets (staff lists, email addresses, technologies). Building the payload comes after it.

  • b
    Weaponization Correct

    Weaponization is coupling an exploit with a backdoor into a deliverable payload, here a PDF résumé. It happens on attacker infrastructure before delivery.

  • c
    Delivery

    Delivery is transmitting the payload to the target, by email, web or USB. The report says nothing had been sent yet.

  • d
    Installation

    Installation happens on the victim host after exploitation. The trojan has only been packaged, not installed anywhere.

The concept

Weaponization is the attacker-side phase where an exploit and a backdoor are combined into a deliverable payload.

Why that’s the answer

Pairing the PDF reader exploit with a trojan inside a document is the textbook weaponization step. Defenders rarely see it directly because it happens off their network; they learn about it by analysing the artifacts in delivered payloads. Delivery and installation involve the victim and had not happened yet.

How to reason it out
  1. Note that nothing had been sent to or run on a victim.
  2. Identify the action: combining an exploit and malware into one file.
  3. Match it to the phase between reconnaissance and delivery: weaponization.

Exam tip: Exploit + backdoor packaged into a file, before sending = weaponization.

CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CK — the lesson that teaches this.

Question 2Incident Response and Management

During containment, the team configures internal DNS to answer a malware family's C2 domain with the address of a defender-run server that logs every host that connects, while the implants keep running. In the Cyber Kill Chain courses-of-action matrix, which action does this represent?

Choose one.

  • a
    Deny

    Deny prevents the communication outright, for example a firewall ACL dropping traffic to the C2 address. Here the traffic is answered by a fake endpoint instead.

  • b
    Disrupt

    Disrupt interrupts the flow in transit, such as an inline network IPS killing the session. The redirect does not break sessions; it changes where they go.

  • c
    Deceive Correct

    Redirecting the C2 domain to a defender-controlled server makes the implants talk to infrastructure that impersonates the attacker. The kill chain paper lists DNS redirect as the deceive action for C2.

  • d
    Degrade

    Degrade slows or reduces the channel, such as a tarpit. The connections here complete normally, just to the wrong server.

The concept

The courses-of-action matrix pairs each kill chain phase with six defensive actions: detect, deny, disrupt, degrade, deceive and destroy.

Why that’s the answer

A DNS sinkhole that answers for the attacker's domain feeds the implant false infrastructure and lets defenders observe infected hosts: deception. Deny (firewall ACL), disrupt (inline IPS) and degrade (tarpit or throttling) all act on the real channel rather than impersonating its endpoint, which is why they are the tempting but wrong choices.

How to reason it out
  1. Identify the phase being acted on: command and control.
  2. Ask what the control does to the traffic: blocks it, breaks it, slows it, or misleads it.
  3. A redirect to a defender-run endpoint misleads the implant, so it is deceive.

Exam tip: Block = deny, break in transit = disrupt, slow = degrade, fake endpoint = deceive.

CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CK — the lesson that teaches this.

Question 3Incident Response and Management

A database administrator with legitimate access exported customer records to a personal cloud drive over several weeks. The IR lead tries to model the incident with the Cyber Kill Chain and finds that most of its phases have nothing to record. What BEST explains the poor fit?

Choose one.

  • a
    It has no phase that accounts for removing data from the organization's network

    Actions on objectives covers data exfiltration, so the theft itself can be recorded. The empty phases are the earlier ones.

  • b
    Its early phases assume an outside attacker who has to deliver and exploit a payload Correct

    Weaponization, delivery, exploitation and installation describe an outsider breaking in. An insider who already has access skips them, so they stay empty.

  • c
    It requires attributing the adversary to a group before phases can be assigned

    The kill chain is a sequence of attacker steps and needs no attribution. Recording who the adversary is belongs to the Diamond Model's adversary feature.

  • d
    It models activity on network sensors and ignores evidence from database audit logs

    The model is a description of attacker phases, not a sensor design. Any evidence source, including audit logs, can be mapped to a phase.

The concept

The Cyber Kill Chain was built around external, malware-driven intrusions, so it fits insider threats and post-compromise activity poorly.

Why that’s the answer

Most kill chain phases describe getting in: building a payload, delivering it, exploiting a flaw and installing a backdoor. An insider with legitimate credentials does none of that, so only actions on objectives has anything to record. The model does cover exfiltration and needs no attribution, so the other options misdescribe it.

How to reason it out
  1. List the phases and ask which ones an insider performs.
  2. Note that delivery, exploitation and installation have no equivalent for legitimate access.
  3. Conclude that the limitation is the external-intruder assumption.

Exam tip: The kill chain models breaking in; insiders are already inside.

CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CK — the lesson that teaches this.

Question 4Incident Response and Management

After a phishing compromise, an actor spent three weeks dumping credentials, enumerating file shares and moving between servers before deploying ransomware. The Cyber Kill Chain compresses all of this into its final phase. The detection team needs each step broken out at a level detailed enough to compare against its existing detection rules. Which framework BEST meets this need?

Choose one.

  • a
    MITRE ATT&CK Enterprise techniques Correct

    ATT&CK breaks post-compromise activity into tactics and identified techniques (credential dumping, discovery, lateral movement, impact), which detection teams use to measure coverage.

  • b
    Diamond Model activity threads

    Activity threads chain Diamond events in order and support pivoting, but they do not give a standard catalogue of behavior IDs for coverage analysis.

  • c
    Cyber Kill Chain courses-of-action matrix

    The matrix plans defensive actions per kill chain phase, so it inherits the same single coarse phase for everything after C2.

  • d
    NIST SP 800-61 incident response phases

    NIST SP 800-61 describes the defender's response process, not the attacker's behaviors, so it cannot map the actor's steps.

The concept

MITRE ATT&CK is a knowledge base of adversary tactics and techniques with stable IDs, designed for granular, post-compromise behavior mapping.

Why that’s the answer

The requirement is granularity plus standard identifiers for detection gap analysis. ATT&CK separates credential access, discovery, lateral movement and impact into distinct techniques with IDs. The kill chain (and its courses-of-action matrix) lumps them into one phase, the Diamond Model focuses on relationships between features, and NIST SP 800-61 describes the response process.

How to reason it out
  1. Identify the gap: many post-compromise steps collapsed into one kill chain phase.
  2. Identify the requirement: standard, ID-based behaviors for detection coverage.
  3. Pick the framework that catalogues attacker techniques with IDs: ATT&CK.

Exam tip: Need granular, ID-based attacker behaviors for detection work? Use ATT&CK.

CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CK — the lesson that teaches this.

Question 5Incident Response and Management

An analyst is recording a phishing intrusion as a single Diamond Model event and must fill in the model's four core features before adding any meta-features. Which set lists those core features?

Choose one.

  • a
    Adversary, capability, timestamp and result

    Timestamp and result are meta-features recorded alongside an event, not core features.

  • b
    Actor, technique, procedure and impact

    This mixes ATT&CK and general risk vocabulary. The Diamond Model's vertices are adversary, capability, infrastructure and victim.

  • c
    Adversary, capability, infrastructure and victim Correct

    These are the four vertices of the diamond: who attacked, with what tool or technique, over what infrastructure, against whom.

  • d
    Adversary, motive, infrastructure and target

    Motive is not a vertex; intent sits in the extended model's social-political meta-feature. "Target" is not the model's term either.

The concept

Every Diamond Model event has four core features: adversary, capability, infrastructure and victim.

Why that’s the answer

The model's axiom is that an adversary uses a capability over infrastructure against a victim. Those four vertices form the diamond. Timestamp, phase, result, direction, methodology and resources are meta-features added to the event, which is why the near-twin with timestamp and result is wrong.

How to reason it out
  1. Recall the four vertices of the diamond shape.
  2. Separate core features from meta-features such as timestamp and result.
  3. Reject sets that borrow terms from other frameworks.

Exam tip: Adversary, capability, infrastructure, victim: the four corners of the diamond.

CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CK — the lesson that teaches this.

Question 6Incident Response and Management

The second-stage payload in an intrusion was hosted on a small charity's WordPress site, which the actor had compromised earlier; the charity is unaware of the misuse. Applying the Diamond Model to this event, how should the analyst classify the charity's web server?

Choose one.

  • a
    Type 1 infrastructure

    Type 1 infrastructure is fully owned or controlled by the adversary, such as servers it rents or domains it registers. The charity owns this site.

  • b
    A victim asset

    The charity was compromised earlier, but in this event its server plays the infrastructure role between the adversary and the targeted victim.

  • c
    Type 2 infrastructure Correct

    Type 2 infrastructure is controlled by an intermediary, often an unwitting compromised party, which helps hide the adversary. The charity's server fits that.

  • d
    An adversary capability

    The capability is the payload or technique used. The server only hosts the payload, which makes it infrastructure.

The concept

The Diamond Model splits infrastructure into Type 1 (owned or controlled by the adversary), Type 2 (controlled by an intermediary, often unwitting) and service providers.

Why that’s the answer

Features are assigned by the role they play in the event being analysed. The charity's server delivers the payload to the targeted victim, so it is infrastructure, and because a third party that does not know about the misuse controls it, it is Type 2. It would be a victim asset only in a separate event describing the charity's own compromise.

How to reason it out
  1. Identify the event: payload hosting for an attack on a different victim.
  2. Assign the server its role in that event: infrastructure.
  3. Decide who controls it: an unwitting intermediary means Type 2.

Exam tip: Adversary-owned = Type 1; compromised or unwitting third party = Type 2.

CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CK — the lesson that teaches this.

What CS0-004 domain 3 tests, topic by topic

The official exam guide breaks Incident Response and Management into 3 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published CS0-004 practice questions per topic in Incident Response and Management
TopicWhat it coversQuestions
Summarize concepts related to attack methodology frameworksOfficial CS0-004 objective 3.1. Cyber Kill Chain; Diamond Model of Intrusion Analysis; MITRE ATT&CK.35
Summarize the incident response processOfficial CS0-004 objective 3.2. Preparation; detection; analysis; containment; eradication; recovery; post-incident.40
Given a scenario, implement incident response techniquesOfficial CS0-004 objective 3.3. Developing incident response and communication plans; creating playbooks; defining roles; training (tabletop, simulation); log collection, correlation, augmentation and enrichment; alerts and notifications; triage; establishing a timeline; determining severity and impact; prioritization; evidence gathering (chain of custody, data integrity validation, preservation, legal hold); isolating affected targets; escalation; remediation and verification; release from isolation; restoration; root cause analysis; corrective action development.68
Total143

Revise Incident Response and Management before you drill it

CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CKObjective 3.1 is tested mostly with short scenarios: a description or log excerpt to place in a kill chain phase (often asking how far an intrusion got or which event came earliest), a control to classify in the courses-of-action matrix, an intrusion to record in the Diamond Model (core feature, meta-feature, infrastructure type, operator or customer, persona or asset, centered approach, thread or activity group), an ATT&CK identifier or object type to recognise, a multi-tactic technique to map by the adversary's goal, or a need to match with the best framework or ATT&CK resource. Wrong options are usually real terms from the same framework that fail one detail of the scenario, so check the stated constraint (what data is available, whether a patch exists, who controls the server) before choosing. Some items ask you to select two answers.CySA+ Incident Response Process: Preparation to Post-Incident (CS0-004 3.2)Questions on this objective usually describe a moment in a response and ask which phase an action belongs to, what to do FIRST or NEXT, or which approach BEST meets a stated constraint such as keeping a service running, preserving evidence or minimizing data loss. Others ask you to classify a detection as an event or incident, or as a precursor or indicator. The deciding detail is often a single condition in the scenario: whether the threat is still spreading, whether the system can be isolated, how long the attacker has been present compared with the backup history, or whether existing sessions survive a reset. Wrong options are real response actions that belong to a different phase, act too early or too late, or cause more damage than needed. Expect some Select TWO items.CySA+ Incident Response Techniques: Triage, Evidence and Recovery (CS0-004 3.3)Questions on this objective are mostly scenarios, often with log lines, an alert list, a custody record or hash output to read. They ask which document, role or training type fits, what to do FIRST or NEXT, or which approach BEST meets a stated constraint such as preserving evidence, keeping a business process running or limiting the effect of a change to the systems involved. Read the scenario's details carefully: timestamps, address types, retention limits and whether a control already acted often decide the answer. Wrong options are typically real techniques applied too early, too broadly, to the wrong problem (custody versus integrity, remediation versus corrective action), or in a way that destroys evidence. Expect some Select TWO items.

Other CS0-004 domains

Domain 1: Security Operations34% of the exam · 204 questionsDomain 2: Vulnerability Management26% of the exam · 156 questionsDomain 4: Reporting and Communication16% of the exam · 96 questionsAll CS0-004 practice questionsMixed sessions across all 4 domains — the way the real exam interleaves them.

Incident Response and Management: your questions

Incident Response and Management is domain 3 of the CS0-004 exam guide and carries 24% of the scored content — the 3rd-heaviest of the 4 domains. On a 85-question paper that works out to roughly 20 questions, though CompTIA does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official CS0-004 exam guide.