CS0-004 incident response explained
Incident Response and Management is 24% of CS0-004, the third-largest domain, and it has three objectives: attack methodology frameworks, the incident response process, and the techniques an analyst applies during an incident. CompTIA’s summary of the domain lists MITRE ATT&CK and the Cyber Kill Chain, the phases from preparation to recovery, and triage, evidence handling, escalation, remediation and root cause identification. Questions are written from the analyst’s chair: given this evidence, what is the best next step.
3.1 Attack methodology frameworks
Two frameworks describe how attacks unfold, and they answer different questions.
| Framework | What it models | Typical use for an analyst |
|---|---|---|
| MITRE ATT&CK | A catalogue of adversary tactics (the goal, such as persistence or lateral movement) and techniques (the method) observed in real intrusions | Map an alert to a technique, find detection gaps, name what an actor did |
| Lockheed Martin Cyber Kill Chain | Seven sequential stages from reconnaissance to actions on objectives | Decide where in the attack to break the chain, describe progress of an intrusion |
ATT&CK is a matrix of behaviours, not a fixed sequence; an intrusion can touch tactics in any order and repeat them. The Kill Chain is linear and intrusion-centric: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. The Diamond Model (adversary, capability, infrastructure, victim) is another vendor-neutral way to pivot between indicators and is worth knowing by name, although the CompTIA summary names only the first two frameworks.
3.2 The incident response process
The objective lists preparation, detection, analysis, containment, eradication and recovery. NIST SP 800-61 Revision 2 grouped the same work into four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Lessons learned follows recovery. NIST published SP 800-61 Revision 3 in April 2025 as a profile of Cybersecurity Framework 2.0, replacing Revision 2 (2012), so newer material groups the work by CSF functions rather than four phases. CompTIA’s own list uses the classic names, so use those on the exam.
- Preparation: plan, playbooks, contact lists, tooling, logging, training and tabletop exercises. Nothing here happens during an incident.
- Detection and analysis: confirm that an alert is a real incident, scope it, classify severity and start documentation.
- Containment: stop the spread and limit damage. Short-term containment isolates a host or blocks an address; long-term containment keeps the business running on a clean temporary arrangement.
- Eradication: remove the cause, such as malware, attacker accounts and the exploited weakness.
- Recovery: restore systems to normal, verify them and monitor for reinfection.
- Post-incident: lessons learned, root cause review and updated controls. The next page, reporting and communication, covers how this is written up.
The incident response lifecycle topic guide walks through the same phases with examples.
3.3 Techniques: triage, evidence, escalation, remediation, root cause
Triage orders work by impact and urgency: which asset, what data, how many systems, is it still spreading. Escalation follows the severity: a suspected breach of regulated data goes to legal and management, not just the next analyst. Evidence handling protects what the investigation relies on. Collect in order of volatility (memory and network connections before disk), hash images, record who held what and when, and work on copies. The chain of custody guide explains why documentation matters if evidence is later challenged. Remediation fixes what allowed the incident, and root cause identification asks why it was possible, which is different from what the malware did.
Worked mini-scenario
An EDR alert shows a finance workstation running an encoded PowerShell command that contacts an unfamiliar domain. The analyst checks the proxy log and finds the same domain contacted from two more hosts, then sees a service account used to sign in to a file server. The incident is confirmed and scoped to three hosts and one account (detection and analysis). Isolating the three hosts and disabling the service account is containment. Removing the persistence mechanism, resetting credentials and closing the phishing path is eradication. Restoring from a known-good state and watching for the domain is recovery. A review that finds the account had excessive rights is root cause work, and it feeds back to preparation.
Easy to confuse
| Pair | Difference |
|---|---|
| Containment vs eradication | Containment stops it spreading; eradication removes it. Contain first |
| Tactic vs technique (ATT&CK) | Tactic is the why, technique is the how |
| Event vs incident | An event is any observable occurrence; an incident is an event that violates or threatens policy or security |
| Eradication vs recovery | Eradication removes the threat; recovery returns services to operation |
| Root cause vs symptom | Ransomware encrypting files is a symptom; the unpatched, exposed remote service is a root cause |
Exam pitfall
Scenarios often tempt a premature action. Wiping and rebuilding an infected host feels decisive but destroys memory and disk evidence and may skip scoping, so it comes after evidence capture and containment. Likewise, notifying customers or regulators is a decision made through the escalation path, not by the first analyst on the alert.
Example questions
Question 1. An analyst confirms that a workstation is beaconing to an external server and that the malware is spreading to file shares. What should happen first?
- A. Reimage the workstation immediately
- B. Hold a lessons-learned meeting
- C. Isolate the affected host and the shares it reaches
- D. Update the incident response playbook
Show answer
Answer: C
Spread is ongoing, so containment comes first: isolate the affected hosts and shares. Reimaging destroys evidence and does not stop spread elsewhere, the lessons-learned meeting is a post-incident activity, and rewriting the playbook is preparation.
Want more questions like this? Full CS0-004 practice tests →
Question 2. A report describes an intruder gaining initial access through a phishing email, then creating a scheduled task to survive reboots. In ATT&CK terms, the scheduled task is an example of which?
- A. Initial access technique
- B. Persistence
- C. Exfiltration
- D. Reconnaissance
Show answer
Answer: B
Surviving reboots is the persistence tactic, and a scheduled task is one technique used for it. Initial access is the earlier phishing step, exfiltration is data theft, and reconnaissance is information gathering before the attack.
Want more questions like this? Full CS0-004 practice tests →
Question 3. While imaging a compromised server, an analyst must decide what to capture first. Which source should be collected before the others?
- A. The disk image
- B. Archived logs on a log server
- C. Backup tapes
- D. A memory capture of the running system
Show answer
Answer: D
Memory is the most volatile source and is lost on power off or reboot, so it is captured first. Disk images, archived logs and backups persist and can be collected afterwards.
Want more questions like this? Full CS0-004 practice tests →