nerdexam
CompTIA

CS0-003 · Question #95

In SIEM software, a security analysis selected some changes to hash signatures from monitored files during the night followed by SMB brute-force attacks against the file servers Based on this behavior

The correct answer is A. Fully segregate the affected servers physically in a network segment, apart from the production. Upon detecting file hash changes and SMB brute-force attacks, the FIRST action to prevent a more serious compromise is to isolate the affected servers.

Submitted by katya_ua· Mar 6, 2026Incident Response and Management

Question

In SIEM software, a security analysis selected some changes to hash signatures from monitored files during the night followed by SMB brute-force attacks against the file servers Based on this behavior, which of the following actions should be taken FIRST to prevent a more serious compromise?

Options

  • AFully segregate the affected servers physically in a network segment, apart from the production
  • BCollect the network traffic during the day to understand if the same activity is also occurring
  • CCheck the hash signatures, comparing them with malware databases to verify if the files are
  • DCollect all the files that have changed and compare them with the previous baseline

How the community answered

(30 responses)
  • A
    50% (15)
  • B
    10% (3)
  • C
    13% (4)
  • D
    27% (8)

Why each option

Upon detecting file hash changes and SMB brute-force attacks, the FIRST action to prevent a more serious compromise is to isolate the affected servers.

AFully segregate the affected servers physically in a network segment, apart from the productionCorrect

Fully segregating the affected servers physically or logically into an isolated network segment is the immediate and most critical action to contain a potential compromise, preventing further spread of malware or unauthorized access and limiting damage.

BCollect the network traffic during the day to understand if the same activity is also occurring

Collecting network traffic is a passive monitoring activity that does not immediately contain an active threat or prevent further compromise.

CCheck the hash signatures, comparing them with malware databases to verify if the files are

Checking hash signatures against malware databases is an analytical step for verification, which should follow containment to prevent further damage.

DCollect all the files that have changed and compare them with the previous baseline

Collecting and comparing changed files to a baseline is part of forensic analysis and damage assessment, which comes after immediate containment.

Concept tested: Incident response containment

Source: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final

Topics

#Incident containment#SIEM analysis#Brute-force attack#Network segmentation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CS0-003 Practice