nerdexam
CompTIA

CS0-003 · Question #111

A security analyst is investigating an incident related to an alert from the threat detection platform on a host (10.0.1.25) in a staging environment that could be running a cryptomining tool…

The correct answer is D. Remove rules 1, 2, and 5. To best isolate a cryptomining host sending traffic to Bitcoin IPs, while potentially allowing for secure triage, key broad access and specific inbound rules should be removed.

Submitted by anna_se· Mar 6, 2026Incident Response and Management

Question

A security analyst is investigating an incident related to an alert from the threat detection platform on a host (10.0.1.25) in a staging environment that could be running a cryptomining tool because it is sending traffic to an IP address that is related to Bitcoin. The network rules for the instance are the following:

Which of the following is the BEST way to isolate and triage the host?

Exhibit

CS0-003 question #111 exhibit

Options

  • ARemove rules 1, 2, and 3.
  • BRemove rules 1, 2, 4, and 5.
  • CRemove rules 1, 2, 3, 4, and 5.
  • DRemove rules 1, 2, and 5.
  • ERemove rules 1, 4, and 5.
  • FRemove rules 4 and 5.

How the community answered

(33 responses)
  • B
    21% (7)
  • C
    6% (2)
  • D
    58% (19)
  • E
    12% (4)
  • F
    3% (1)

Why each option

To best isolate a cryptomining host sending traffic to Bitcoin IPs, while potentially allowing for secure triage, key broad access and specific inbound rules should be removed.

ARemove rules 1, 2, and 3.

Removing only Rules 1, 2, and 3 would primarily affect inbound access and would not stop the outbound cryptomining traffic (Rule 4 or Rule 5 as outbound).

BRemove rules 1, 2, 4, and 5.

Removing rules 1, 2, 4, and 5 would provide very strong isolation, but might be overly aggressive if a specific, controlled channel (like Rule 3) is desired for triage, making it less ideal for 'BEST isolate AND triage'.

CRemove rules 1, 2, 3, 4, and 5.

Removing all rules (1, 2, 3, 4, and 5) would fully isolate the host, but it would also prevent any form of access for triage, which is part of the requirement.

DRemove rules 1, 2, and 5.Correct

Removing Rule 5, which ambiguously states 'Allow all inbound traffic from 10.0.1.25 to 0.0.0.0/0,' is likely intended to block all outbound traffic originating from the host, thus immediately stopping the cryptomining activity. Additionally, removing Rules 1 and 2 (SSH and HTTP inbound) reduces the attack surface while potentially leaving HTTPS (Rule 3) active for an analyst's secure triage access.

ERemove rules 1, 4, and 5.

Removing rules 1, 4, and 5 would leave HTTP (Rule 2) and HTTPS (Rule 3) inbound open, which does not achieve sufficient isolation.

FRemove rules 4 and 5.

Removing rules 4 and 5 (assuming they are outbound rules) would stop outbound traffic, but leaves Rules 1, 2, and 3 (inbound) open, which isn't full isolation for the host.

Concept tested: Network firewall rules for incident response containment

Topics

#Incident containment#Network isolation#Firewall rules#Cryptomining

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CS0-003 Practice