CompTIA CS0-003 Practice Test 1
Question 1
At Community credit union, analysts monitor loan officer workstations. They observe that a host resolves 70-character random subdomains every 40 seconds to a domain created yesterday. Evidence: DNS resolver shows TXT lookups with unusually long replies at 02:10. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of DNS tunneling used as a covert command channel and begin corroborating it with endpoint and network evidence
- Treat approved endpoint protection updates only query signed vendor zones during maintenance as conclusive authorization for the current event without matching process or identity
- Announce that DNS resolver shows TXT lookups with unusually long replies at 02:10 conclusively proves theft of confidential member records before reviewing any sessions or file access
- Downgrade a host resolves 70-character random subdomains every 40 seconds to a domain created yesterday solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
A:The combination of a host resolving 70-character random subdomains every 40 seconds to a domain created yesterday and DNS resolver shows TXT lookups with unusually long replies at 02:10 is suspicious for DNS tunneling used as a covert command channel. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting confidential member records.
Incorrect Answers
B:The legitimate comparator is approved endpoint protection updates only query signed vendor zones during maintenance; it does not establish that the current event came from the same approved identity or workflow.
C:DNS resolver shows TXT lookups with unusually long replies at 02:10 is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
D:An intrusion can begin on one asset. The specific indicator on loan officer workstations warrants its own validation before expanding or closing the investigation.
Question 2
At Community credit union, analysts monitor loan officer workstations. They observe that a host resolves 70-character random subdomains every 40 seconds to a domain created yesterday. Evidence: DNS resolver shows TXT lookups with unusually long replies at 02:10. A separate known-good explanation is: approved endpoint protection updates only query signed vendor zones during maintenance. Which next analysis most reliably determines what caused the observed event?
- Suspend telemetry collection on loan officer workstations while waiting for the connection pattern to stop
- Summarize DNS resolver shows TXT lookups with unusually long replies at 02:10 into a ticket and discard underlying event identifiers before correlation
- Perform a scoped investigation: compare resolver logs with the originating process tree and recent domain registration
- Accept a public reputation score for the destination as proof of the origin of DNS resolver shows TXT lookups with unusually long replies at 02:10, without using compare resolver logs with the originating process tree and recent domain registration
Explanation
Correct Answer
C:Compare resolver logs with the originating process tree and recent domain registration ties the evidence on loan officer workstations to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved endpoint protection updates only query signed vendor zones during maintenance.
Incorrect Answers
A:Suppressing telemetry destroys the source needed to investigate DNS tunneling used as a covert command channel and may conceal further actions.
B:The original DNS resolver shows TXT lookups with unusually long replies at 02:10 must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:A reputation score may inform triage but cannot establish the origin of DNS resolver shows TXT lookups with unusually long replies at 02:10 or whether the activity matches approved endpoint protection updates only query signed vendor zones during maintenance.
Question 3
Community credit union has a candidate alert for loan officer workstations: DNS resolver shows TXT lookups with unusually long replies at 02:10. The team argues it is harmless because approved endpoint protection updates only query signed vendor zones during maintenance. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that a host resolves 70-character random subdomains every 40 seconds to a domain created yesterday is benign
- Automatically treat every event resembling DNS resolver shows TXT lookups with unusually long replies at 02:10 as confirmed compromise of loan officer workstations, without checking provenance
- Distinguish DNS resolver shows TXT lookups with unusually long replies at 02:10 from the approved behavior (approved endpoint protection updates only query signed vendor zones during maintenance) by validating process, identity and time attribution
- Create a blanket suppression for DNS resolver shows TXT lookups with unusually long replies at 02:10 because approved endpoint protection updates only query signed vendor zones during maintenance can produce a superficially similar event
Explanation
Correct Answer
C:Approved endpoint protection updates only query signed vendor zones during maintenance is a plausible alternative, but it must be proven to match the actual source of DNS resolver shows TXT lookups with unusually long replies at 02:10. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: a host resolves 70-character random subdomains every 40 seconds to a domain created yesterday.
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting confidential member records.
D:Similarity to approved endpoint protection updates only query signed vendor zones during maintenance does not exclude an attacker from producing the same surface event on loan officer workstations.
Question 4
At Community credit union, analysts monitor loan officer workstations. They observe that a host resolves 70-character random subdomains every 40 seconds to a domain created yesterday. Evidence: DNS resolver shows TXT lookups with unusually long replies at 02:10. The team confirms unauthorized behavior and must protect confidential member records; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: isolate only the implicated workstation and block the suspicious domain while keeping teller applications available
- Disable every production service at Community credit union without measuring whether its dependencies share the observed malicious path
- Erase DNS resolver shows TXT lookups with unusually long replies at 02:10 from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on loan officer workstations unrestricted until actual losses of confidential member records can be measured
Explanation
Correct Answer
A:Isolate only the implicated workstation and block the suspicious domain while keeping teller applications available constrains the observed threat while maintaining necessary service for confidential member records. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Global shutdown could disrupt confidential member records without evidence that every system has been affected; scoped isolation is more proportionate.
C:Eliminating DNS resolver shows TXT lookups with unusually long replies at 02:10 evidence does not contain DNS tunneling used as a covert command channel and impairs forensic reconstruction.
D:Once unauthorized behavior is confirmed on loan officer workstations, delaying containment could expand the exposure affecting confidential member records.
Question 5
At Community credit union, analysts have investigated an initial alert involving loan officer workstations and need to scope related activity. Original event: DNS resolver shows TXT lookups with unusually long replies at 02:10. Which threat-hunt pivot is best grounded in this observation?
- Pivot across the environment: search other endpoints for the same domain and randomized-query cadence
- Use the previous month’s overall alert closure count instead of pivoting on DNS resolver shows TXT lookups with unusually long replies at 02:10 across related identities and systems
- Stop scoping once the initial loan officer workstations has been contained, even though search other endpoints for the same domain and randomized-query cadence has not been attempted
- Mark every host adjacent to loan officer workstations compromised by assumption without comparing activity-linked observables
Explanation
Correct Answer
A:Search other endpoints for the same domain and randomized-query cadence extends the investigation from the specific clue, DNS resolver shows TXT lookups with unusually long replies at 02:10, to related activity while preserving host and user attribution. This estimates the scope of potential DNS tunneling used as a covert command channel.
Incorrect Answers
B:Historical alert volume does not trace the shared indicator or determine whether DNS tunneling used as a covert command channel spread beyond loan officer workstations.
C:The initiating host may not be the only affected one; scoping requires examining the connected evidence DNS resolver shows TXT lookups with unusually long replies at 02:10.
D:Proximity to loan officer workstations is not proof of exposure; use the activity-linked pivot to identify actual relationships.
Question 6
Community credit union has investigated DNS tunneling used as a covert command channel on loan officer workstations. Detection operators report that approved endpoint protection updates only query signed vendor zones during maintenance; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Suppress every future event associated with DNS resolver shows TXT lookups with unusually long replies at 02:10, including events outside approved endpoint protection updates only query signed vendor zones during maintenance
- Assign critical severity to every routine activity on loan officer workstations whether or not it matches correlate high-entropy TXT requests with new-domain age and unsanctioned endpoint processes
- Automate service shutdown on the first simple match to a host resolves 70-character random subdomains every 40 seconds to a domain created yesterday, without validation or guardrails for confidential member records
- Improve detection by requiring context-aware correlation: correlate high-entropy TXT requests with new-domain age and unsanctioned endpoint processes
Explanation
Correct Answer
D:Correlate high-entropy TXT requests with new-domain age and unsanctioned endpoint processes retains the specific threat signal while discriminating against approved endpoint protection updates only query signed vendor zones during maintenance. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Suppressing all monitoring would also hide a recurrence of DNS tunneling used as a covert command channel, even where it threatens confidential member records.
B:Alert severity without distinguishing approved endpoint protection updates only query signed vendor zones during maintenance from malicious conditions would increase noise and operational workload.
C:An untested, unqualified automation could interrupt confidential member records and cannot distinguish the benign workflow from attacker behavior.
Question 7
At Retail checkout, the security team assesses public payment API. The current issue is unparameterized SQL query in cart lookup; assessment evidence states: scanner sends a quote and receives SQL syntax errors in one parameter. The service is internet-facing with cardholder account access. Operational constraints: daily checkout peaks restrict deployment windows. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across public payment API during daily checkout peaks restrict deployment windows instead of using a scoped test
- Accept the label unparameterized SQL query in cart lookup as confirmed without checking the reported evidence scanner sends a quote and receives SQL syntax errors in one parameter or actual deployment
- Use only an anonymous outside-in scan of public payment API even when internet-facing with cardholder account access requires authenticated deployment context
- Use an authorized, scoped validation approach that considers service sensitivity: confirm using authorized non-destructive parameter probes and query tracing
Explanation
Correct Answer
D:The evidence scanner sends a quote and receives SQL syntax errors in one parameter must be evaluated without violating the constraint daily checkout peaks restrict deployment windows. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because daily checkout peaks restrict deployment windows; authorization and scope are prerequisites.
B:The finding does not establish which live component is affected or whether the exposure internet-facing with cardholder account access is real.
C:Asset configuration and the constraints of public payment API matter; external findings alone may misstate or miss the exposed path.
Question 8
At Retail checkout, the security team assesses public payment API. The current issue is unparameterized SQL query in cart lookup; assessment evidence states: scanner sends a quote and receives SQL syntax errors in one parameter. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against public payment API, ignoring that daily checkout peaks restrict deployment windows and a safer validation exist
- Assume public payment API is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: confirm using authorized non-destructive parameter probes and query tracing
- Mark scanner sends a quote and receives SQL syntax errors in one parameter resolved or confirmed solely from the scanner severity without confirm using authorized non-destructive parameter probes and query tracing
Explanation
Correct Answer
C:Confirm using authorized non-destructive parameter probes and query tracing tests the reported condition scanner sends a quote and receives SQL syntax errors in one parameter against actual deployment context (internet-facing with cardholder account access). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when confirm using authorized non-destructive parameter probes and query tracing can provide authorized evidence and daily checkout peaks restrict deployment windows constrains production testing.
B:Security of an unrelated host cannot establish the state of public payment API, whose reported issue is unparameterized SQL query in cart lookup.
D:scanner sends a quote and receives SQL syntax errors in one parameter may be accurate but its actual occurrence and configuration on public payment API must be established before calling it validated.
Question 9
At Retail checkout, the security team assesses public payment API. The current issue is unparameterized SQL query in cart lookup; assessment evidence states: scanner sends a quote and receives SQL syntax errors in one parameter. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Prioritize the confirmed exposure of public payment API, accounting for cardholder confidentiality and the real access path: internet-facing with cardholder account access
- Choose whatever finding on public payment API was logged most recently, regardless of actual exploit path or priority
- Give every vulnerability the same deadline despite unparameterized SQL query in cart lookup and business impact on cardholder confidentiality
- Choose the highest nominal scanner severity first while ignoring internet-facing with cardholder account access and the consequence to cardholder confidentiality
Explanation
Correct Answer
A:Risk depends on practical reachability, threat activity and consequence. The issue unparameterized SQL query in cart lookup can affect cardholder confidentiality through internet-facing with cardholder account access; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
B:Discovery order is not evidence of urgency compared with the actual affected public payment API.
C:Uniform priority ignores internet-facing with cardholder account access, operational harm and cardholder confidentiality; documented context makes triage defensible.
D:CVSS describes technical characteristics, not the entirety of exposure and cardholder confidentiality for this deployment.
Question 10
At Retail checkout, the security team assesses public payment API. The current issue is unparameterized SQL query in cart lookup; assessment evidence states: scanner sends a quote and receives SQL syntax errors in one parameter. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use temporary rate-limit and WAF rule only until code fix as permanent closure of the confirmed issue instead of deploying parameterized queries and least-privilege database role
- Leave unparameterized SQL query in cart lookup present indefinitely because no incident involving cardholder confidentiality was recorded this week
- Implement and verify the root-cause fix: parameterized queries and least-privilege database role
- Sign an exception document but do not implement or test parameterized queries and least-privilege database role on public payment API
Explanation
Correct Answer
C:Parameterized queries and least-privilege database role targets the mechanism unparameterized SQL query in cart lookup rather than only filtering symptoms. Verification must account for scanner sends a quote and receives SQL syntax errors in one parameter and continued protection of cardholder confidentiality.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying unparameterized SQL query in cart lookup and should be time-limited with verification and owner oversight.
B:No observed attack does not correct the verified condition scanner sends a quote and receives SQL syntax errors in one parameter or eliminate its potential impact on cardholder confidentiality.
D:Risk acceptance paperwork does not itself remediate unparameterized SQL query in cart lookup on public payment API; authorized, tested implementation is still required when the risk exceeds tolerance.
