nerdexam
CompTIA

CS0-003 · Question #534

A user clicks on a malicious adware link, and the malware successfully downloads to the machine. The malware has a script that invokes command-and-control activity. Which of the following actions is…

The correct answer is C. Block the server on the proxy and firewall. To contain an incident involving malware with command-and-control (C2) activity and prevent further impact, blocking the C2 server at the proxy and firewall is the best immediate action.

Submitted by zhang_li· Mar 6, 2026Incident Response and Management

Question

A user clicks on a malicious adware link, and the malware successfully downloads to the machine. The malware has a script that invokes command-and-control activity. Which of the following actions is the best way to contain the incident without any additional impact?

Options

  • ADisable the user account until the malware investigation is complete.
  • BReview EDR information to determine whether the file was detected and quarantined locally.
  • CBlock the server on the proxy and firewall.
  • DSubmit a recategorization update to the vendor.

How the community answered

(38 responses)
  • A
    13% (5)
  • B
    3% (1)
  • C
    76% (29)
  • D
    8% (3)

Why each option

To contain an incident involving malware with command-and-control (C2) activity and prevent further impact, blocking the C2 server at the proxy and firewall is the best immediate action.

ADisable the user account until the malware investigation is complete.

Disabling the user account might prevent the user from logging in, but it does not address the active command-and-control communication from the infected machine if it's already established.

BReview EDR information to determine whether the file was detected and quarantined locally.

Reviewing EDR information is an important investigative step for understanding the scope and identifying the malware, but it doesn't immediately contain the active C2 communication channel that is causing 'additional impact'.

CBlock the server on the proxy and firewall.Correct

Blocking the C2 server's IP address or domain on the proxy and firewall immediately severs the malicious communication channel, preventing the malware from receiving further commands or exfiltrating data, thereby containing the incident and stopping additional impact from the C2 activity.

DSubmit a recategorization update to the vendor.

Submitting a recategorization update to a vendor is a reactive measure for web filtering or reputation issues and is not an immediate containment action for an active command-and-control incident.

Concept tested: Incident containment for C2 activity

Source: https://www.cisa.gov/us-cert/incident-response-and-resilience-faqs

Topics

#Incident containment#Malware C2#Firewall rules#Proxy blocking

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CS0-003 Practice