CySA+ Incident Response: Choosing the Next Action From the Evidence

Which response stage is the scenario describing?

For a CySA+ incident-response scenario, choose the action that fits the established evidence, current response stage and your authority to act. CompTIA's CS0-004 objectives 3.2–3.3 cover the response process and applied tasks including triage, timelines, isolation, escalation, verification and root causes.

The objectives list preparation, detection, analysis, containment, eradication, recovery and post-incident work. The CS0-004 V4 objectives, document version 2.0, were checked November 3, 2026. Use the CySA+ objectives and domain guide to confirm the scope of your study materials.

For practice, attach a question to each stage:

• Preparation: Are the plan, responsibilities and response procedures ready to use?
• Detection: What observation needs investigation?
• Analysis: What happened, which assets are involved and what remains uncertain?
• Containment: What authorized action can limit the current harm?
• Eradication: What cause or remaining foothold needs removal?
• Recovery: What evidence will justify returning the service to normal operation?
• Post-incident work: What should change because of what responders learned?

These questions are an editorial study aid. They use CompTIA's stage names; they do not claim that NIST uses an identical seven-stage model. NIST SP 800-61 Revision 3, checked November 3, 2026, supplies the evidence-handling, recovery and improvement principles used below.

Identify the unresolved decision before reading the answer choices. If the scenario already says the affected host is contained, another containment action needs a reason.

What must you validate before choosing an action?

Use this original, synthetic case throughout the guide. It is a practice exercise, not a recalled exam question or a report about a real organization.

At 09:05, an alert reports an unusual upload from workstation WS-17 to an unapproved destination. The analyst has an alert summary but has not yet checked the underlying records. That establishes a lead; the exercise has not established what was sent, which process sent it or whether the activity was authorized.

Before choosing a disruptive response, identify the missing facts:

1. Asset: Does the underlying evidence identify WS-17, and who owns it?
2. Activity: Which process or account performed the upload, and what supports that conclusion?
3. Timing: Is the activity continuing, and do the relevant timestamps support the sequence?
4. Impact: What information or service is affected?
5. Authority: Which response procedure and escalation route apply?

NIST's analysis guidance calls for establishing the sequence, affected assets and underlying causes while preserving investigative records. The CySA+ log-analysis exercise develops that evidence-reading skill in more detail.

Change one fact: if the owner supplies a verified authorization for the exact transfer and the records support it, the analyst must reassess the suspicious-activity hypothesis. If the records instead confirm an unauthorized transfer that is still running, the next decision becomes how to limit that harm within the response plan. Do not silently add either fact to the original alert.

For broader question practice, full CompTIA CySA+ prep planned for launch includes 1,350 questions. Use practice answers to explain which stated fact supports your choice.

How do containment and eradication solve different problems?

Continue the synthetic case. By 09:08, permitted investigation has confirmed the host identity and an unauthorized process actively uploading internal files. The response lead has been notified. The organization's exercise runbook authorizes the analyst to contain this workstation through its endpoint security tool, and the owner confirms that the proposed action has no identified critical service dependency in this scenario.

Containment is now justified: use the authorized procedure to restrict the affected workstation's network activity and verify that the intended restriction took effect. The decision rests on confirmed ongoing harm, known scope and explicit authority. It is not an instruction to isolate every host whenever an alert appears.

Eradication answers a later question: what must be removed or corrected so the incident cannot continue through the identified cause? Suppose the investigation then finds an unauthorized startup entry associated with the process. The approved remediation must address that entry and the investigated cause, with the necessary evidence preserved. Ending one process alone would leave the entry unresolved in this exercise.

Change one fact: if the workstation controls a service whose interruption has serious consequences, the containment choice needs that impact considered through the response plan and responsible owner. If the source of the activity is still uncertain, declaring eradication complete is premature. Neither situation is solved by memorizing “shut it down first.”

Write two separate sentences for your answer: “This action limits the current harm because…” and “The remaining cause still requires…”. If they describe the same task, check whether you have confused containment with eradication.

Which evidence and escalation obligations constrain the choice?

NIST's investigation guidance calls for preserving records' integrity and provenance: their origin and handling must remain clear. It also calls for documenting investigative actions and protecting sensitive records. Formal chain of custody is not necessarily used for every incident, but that does not make evidence handling optional.

For the synthetic case, keep a compact decision record:

• The observation, source and timestamp that support the finding.
• The affected asset and what is still unknown about scope.
• The person or procedure authorizing the action.
• The action taken, its result and the evidence retained.
• The unresolved decision and the responsible next owner.

Follow the organization's evidence and escalation procedures. A candidate should not invent a universal legal notification deadline or assume that every incident will lead to prosecution. The separate CySA+ reporting and metrics guide addresses how to communicate the findings to different audiences.

Return to the incident-response tasks within the CySA+ objectives and check that your practice covers evidence, escalation and verification as well as stage names. For terminology review, full CompTIA CySA+ prep planned for launch includes 500 flashcards.

What must be verified before returning to normal service?

A proposed restore is a recovery candidate, not proof that the service is safe to use. NIST's recovery guidance calls for checking restoration assets for compromise or corruption, validating essential services with their owners in the appropriate order, and verifying restored integrity before production use.

In the synthetic case, the team proposes restoring WS-17 from an approved source. Before declaring recovery complete, require evidence for three decisions:

1. Restoration source: What checks support using this source?
2. Restored state: What verifies integrity and addresses the identified cause and unauthorized startup entry?
3. Service readiness: What owner-led validation shows that the necessary functions are ready to return?

Change one fact: if the unauthorized upload resumes during validation, the recovery condition has failed. Reassess the evidence and response actions; a completed restore operation does not outweigh observed recurring activity. If the owner has not validated an essential function, a clean security check alone does not complete that business check.

Practice spotting these missing conditions with the 20 free CySA+ practice questions. When reviewing an answer, name the evidence that would permit the next stage.

How should lessons change the next response?

NIST describes exercises and operational lessons as inputs for improving incident-response plans. Its after-action guidance also includes documenting the incident, response and recovery actions, and lessons learned. A useful practice review therefore ends with a specific improvement and someone responsible for it.

For this case, an editorial improvement might be: add the workstation owner's current contact and containment authority to the exercise runbook, then test whether the next responder can locate them. Another might be to make restoration-source checks an explicit recovery requirement. Neither requires inventing a new security product or a universal response deadline.

Repeat the scenario after changing one condition: incomplete evidence, missing authority, a critical service dependency or failed recovery validation. For each version, write the next action, its justification and the fact that would change your choice.

Use the free CySA+ study plan to reserve a response exercise and a review session. For practice spanning the wider exam, full CompTIA CySA+ prep planned for launch includes an 85-question mock exam. Keep the immediate goal concrete: explain why an action fits the facts now, and what must be verified before proceeding.