CompTIA CS0-003 Practice Test 11
Question 100
At Investment adviser, analysts monitor cloud backup administration. They observe that a dormant IAM access key starts listing buckets and exporting compressed archives overnight. Evidence: cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network. The team confirms unauthorized behavior and must protect client financial documents; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: disable the exposed key, preserve audit trails and switch backups to the approved workload identity
- Leave the confirmed unauthorized activity on cloud backup administration unrestricted until actual losses of client financial documents can be measured
- Disable every production service at Investment adviser without measuring whether its dependencies share the observed malicious path
- Erase cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network from the evidence archive during the containment change to reduce repeated alerts
Explanation
Correct Answer
A:Disable the exposed key, preserve audit trails and switch backups to the approved workload identity constrains the observed threat while maintaining necessary service for client financial documents. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Once unauthorized behavior is confirmed on cloud backup administration, delaying containment could expand the exposure affecting client financial documents.
C:Global shutdown could disrupt client financial documents without evidence that every system has been affected; scoped isolation is more proportionate.
D:Eliminating cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network evidence does not contain compromised long-lived cloud credential supporting bulk data theft and impairs forensic reconstruction.
Question 101
Investment adviser receives a three-month-old threat-intelligence bulletin associating an observable with compromised long-lived cloud credential supporting bulk data theft. On cloud backup administration, local telemetry reports: cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions compromised long-lived cloud credential supporting bulk data theft, without checking whether its observable is present on cloud backup administration
- Assess bulletin timeliness and provenance, then corroborate its observables against cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network and affected cloud backup administration
- Dismiss the bulletin solely because Investment adviser has not named the attacker associated with cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network
- Forward the bulletin about compromised long-lived cloud credential supporting bulk data theft as a confirmed breach of cloud backup administration without hosts, timestamps or confidence caveats
Explanation
Correct Answer
B:An old feed with unknown confidence is not automatic proof of activity at Investment adviser. Comparing its timestamps and provenance with cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network reveals whether the indicator is still relevant to cloud backup administration and client financial documents.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network.
C:Actor attribution is not required to assess a supported technique, source confidence or relevance to cloud backup administration.
D:Converting the unverified feed into confirmed activity on cloud backup administration may mislead investigators and prompt harmful response for client financial documents.
Question 102
Investment adviser has investigated compromised long-lived cloud credential supporting bulk data theft on cloud backup administration. Detection operators report that approved backup jobs run under a rotating workload identity through a named private endpoint; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to a dormant IAM access key starts listing buckets and exporting compressed archives overnight, without validation or guardrails for client financial documents
- Suppress every future event associated with cloud audit events show ListBuckets followed by GetObject bursts from a previously unseen network, including events outside approved backup jobs run under a rotating workload identity through a named private endpoint
- Assign critical severity to every routine activity on cloud backup administration whether or not it matches detect dormant-key reactivation followed by unusual object volume outside private endpoints
- Improve detection by requiring context-aware correlation: detect dormant-key reactivation followed by unusual object volume outside private endpoints
Explanation
Correct Answer
D:Detect dormant-key reactivation followed by unusual object volume outside private endpoints retains the specific threat signal while discriminating against approved backup jobs run under a rotating workload identity through a named private endpoint. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt client financial documents and cannot distinguish the benign workflow from attacker behavior.
B:Suppressing all monitoring would also hide a recurrence of compromised long-lived cloud credential supporting bulk data theft, even where it threatens client financial documents.
C:Alert severity without distinguishing approved backup jobs run under a rotating workload identity through a named private endpoint from malicious conditions would increase noise and operational workload.
Question 103
At Insurance aggregator, the security team assesses policy detail API. The current issue is insecure direct object reference on claim IDs; assessment evidence states: changing claim_id returns another customer response. The service is internet-exposed authenticated service. Operational constraints: partner integration calls same endpoint hourly. Which assessment approach is most appropriate before recommending a fix?
- Accept the label insecure direct object reference on claim IDs as confirmed without checking the reported evidence changing claim_id returns another customer response or actual deployment
- Use only an anonymous outside-in scan of policy detail API even when internet-exposed authenticated service requires authenticated deployment context
- Launch unapproved intrusive exploitation across policy detail API during partner integration calls same endpoint hourly instead of using a scoped test
- Use an authorized, scoped validation approach that considers service sensitivity: test two authorized test accounts with swapped object identifiers
Explanation
Correct Answer
D:The evidence changing claim_id returns another customer response must be evaluated without violating the constraint partner integration calls same endpoint hourly. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:The finding does not establish which live component is affected or whether the exposure internet-exposed authenticated service is real.
B:Asset configuration and the constraints of policy detail API matter; external findings alone may misstate or miss the exposed path.
C:Uncontrolled testing may breach service safety, especially because partner integration calls same endpoint hourly; authorization and scope are prerequisites.
Question 104
At Insurance aggregator, the security team assesses policy detail API. The current issue is insecure direct object reference on claim IDs; assessment evidence states: changing claim_id returns another customer response. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Confirm the reported condition in the relevant asset context: test two authorized test accounts with swapped object identifiers
- Mark changing claim_id returns another customer response resolved or confirmed solely from the scanner severity without test two authorized test accounts with swapped object identifiers
- Force a destructive proof-of-concept against policy detail API, ignoring that partner integration calls same endpoint hourly and a safer validation exist
- Assume policy detail API is safe because another platform with similar software recently passed its own assessment
Explanation
Correct Answer
A:Test two authorized test accounts with swapped object identifiers tests the reported condition changing claim_id returns another customer response against actual deployment context (internet-exposed authenticated service). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
B:changing claim_id returns another customer response may be accurate but its actual occurrence and configuration on policy detail API must be established before calling it validated.
C:A destructive proof is unnecessary when test two authorized test accounts with swapped object identifiers can provide authorized evidence and partner integration calls same endpoint hourly constrains production testing.
D:Security of an unrelated host cannot establish the state of policy detail API, whose reported issue is insecure direct object reference on claim IDs.
Question 105
At Insurance aggregator, the security team assesses policy detail API. The current issue is insecure direct object reference on claim IDs; assessment evidence states: changing claim_id returns another customer response. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Choose whatever finding on policy detail API was logged most recently, regardless of actual exploit path or priority
- Prioritize the confirmed exposure of policy detail API, accounting for customer claims privacy and the real access path: internet-exposed authenticated service
- Choose the highest nominal scanner severity first while ignoring internet-exposed authenticated service and the consequence to customer claims privacy
- Give every vulnerability the same deadline despite insecure direct object reference on claim IDs and business impact on customer claims privacy
Explanation
Correct Answer
B:Risk depends on practical reachability, threat activity and consequence. The issue insecure direct object reference on claim IDs can affect customer claims privacy through internet-exposed authenticated service; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Discovery order is not evidence of urgency compared with the actual affected policy detail API.
C:CVSS describes technical characteristics, not the entirety of exposure and customer claims privacy for this deployment.
D:Uniform priority ignores internet-exposed authenticated service, operational harm and customer claims privacy; documented context makes triage defensible.
Question 106
At Insurance aggregator, the security team assesses policy detail API. The current issue is insecure direct object reference on claim IDs; assessment evidence states: changing claim_id returns another customer response. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use limit affected endpoint and add detection until authorization patch as permanent closure of the confirmed issue instead of deploying server-side object ownership authorization on every read
- Sign an exception document but do not implement or test server-side object ownership authorization on every read on policy detail API
- Leave insecure direct object reference on claim IDs present indefinitely because no incident involving customer claims privacy was recorded this week
- Implement and verify the root-cause fix: server-side object ownership authorization on every read
Explanation
Correct Answer
D:Server-side object ownership authorization on every read targets the mechanism insecure direct object reference on claim IDs rather than only filtering symptoms. Verification must account for changing claim_id returns another customer response and continued protection of customer claims privacy.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying insecure direct object reference on claim IDs and should be time-limited with verification and owner oversight.
B:Risk acceptance paperwork does not itself remediate insecure direct object reference on claim IDs on policy detail API; authorized, tested implementation is still required when the risk exceeds tolerance.
C:No observed attack does not correct the verified condition changing claim_id returns another customer response or eliminate its potential impact on customer claims privacy.
Question 107
At Insurance aggregator, the security team assesses policy detail API. The current issue is insecure direct object reference on claim IDs; assessment evidence states: changing claim_id returns another customer response. A permanent correction cannot be deployed immediately because partner integration calls same endpoint hourly. Which interim treatment is the safest governed option?
- Apply a time-bound compensating measure, limit affected endpoint and add detection until authorization patch, record the residual risk owner and schedule the tested permanent fix
- Accept continued exposure of customer claims privacy without any owner, expiry or compensating verification because partner integration calls same endpoint hourly
- Push server-side object ownership authorization on every read immediately to all production systems with no safe change window despite partner integration calls same endpoint hourly
- Claim insecure direct object reference on claim IDs is patched when the change ticket opens, without confirming limit affected endpoint and add detection until authorization patch or a planned permanent change
Explanation
Correct Answer
A:Limit affected endpoint and add detection until authorization patch can reduce short-term exposure while partner integration calls same endpoint hourly delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because customer claims privacy remains at stake.
Incorrect Answers
B:Business criticality increases the need for accountable decisions and review; it does not make customer claims privacy irrelevant.
C:Ignoring partner integration calls same endpoint hourly could cause avoidable service failure and is not a risk-aware remediation process.
D:A work item is not proof that insecure direct object reference on claim IDs was corrected or even that limit affected endpoint and add detection until authorization patch operates.
Question 108
At Insurance aggregator, the security team assesses policy detail API. The current issue is insecure direct object reference on claim IDs; assessment evidence states: changing claim_id returns another customer response. The owner reports that server-side object ownership authorization on every read has been deployed. What evidence should close the vulnerability item?
- Close changing claim_id returns another customer response after the deployment tool returns success, without verifying the current state of policy detail API
- Suppress future results for insecure direct object reference on claim IDs so that the vulnerability dashboard shows a completed remediation
- Use an unrelated server’s clean findings to claim policy detail API is fixed without retesting the affected path
- Retest the originally affected configuration using test two authorized test accounts with swapped object identifiers, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by changing claim_id returns another customer response, plus regression impact on policy detail API. A change ticket alone is not proof of removal of insecure direct object reference on claim IDs.
Incorrect Answers
A:Process completion is not evidence that changing claim_id returns another customer response no longer applies to policy detail API.
B:Suppression may hide a failed or incomplete fix, leaving customer claims privacy exposed despite the administrative record.
C:The result must be tied to policy detail API and the actual exposure: internet-exposed authenticated service.
Question 109
At City media streaming, analysts apply the Diamond Model to reports concerning public live-stream portal: a volumetric flood overwhelms edge capacity but no host compromise is detected. Evidence includes traffic records show many distributed UDP sources targeting one service address, but no adversary has been reliably identified. Which representation preserves the observed relationships without invented attribution?
- Assign a specific nation-state to a volumetric flood overwhelms edge capacity but no host compromise is detected and consider all other Diamond Model elements established automatically
- Treat public live-stream portal as the attacker infrastructure and an unnamed public target as the only victim without analyzing the actual incident path
- Record public live-stream portal as the observed victim, the technical action as the capability, any infrastructure evidenced by traffic records show many distributed UDP sources targeting one service address, and adversary identity as unknown
- Use the Diamond Model name as permission to delete raw traffic records show many distributed UDP sources targeting one service address and replace it with a presumed actor narrative
Explanation
Correct Answer
C:The Diamond Model separates victim, capability, infrastructure and adversary. The logs support observed behavior at public live-stream portal but do not establish a named adversary.
Incorrect Answers
A:Neither traffic records show many distributed UDP sources targeting one service address nor event type identifies a particular actor; attribution requires additional independent intelligence.
B:The provided evidence names public live-stream portal as the affected environment. Reversing roles obscures which entity is actually being victimized.
D:Modeling relates evidence; it does not replace source preservation or justify inventing a history of a volumetric flood overwhelms edge capacity but no host compromise is detected.
Question 110
At City media streaming, the incident team supports public live-stream portal. A new security event is reported: a volumetric flood overwhelms edge capacity but no host compromise is detected. The log clue is: traffic records show many distributed UDP sources targeting one service address. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Preserve and hash incident artifacts: packet samples, NetFlow and service response logs retained with chain of custody
- Rebuild public live-stream portal first and collect the volatile evidence for a volumetric flood overwhelms edge capacity but no host compromise is detected afterward
- Keep only a screenshot of traffic records show many distributed UDP sources targeting one service address, discarding original artifacts such as packet samples, NetFlow and service response logs retained with chain of custody
- Alter original traffic records show many distributed UDP sources targeting one service address entries to remove irrelevant records before preserving the forensic timeline
Explanation
Correct Answer
A:Packet samples, NetFlow and service response logs retained with chain of custody retains relevant source context and integrity checks so the team can reconstruct a volumetric flood overwhelms edge capacity but no host compromise is detected and support an auditable chain of custody.
Incorrect Answers
B:Volatile evidence relevant to a volumetric flood overwhelms edge capacity but no host compromise is detected may disappear during remediation or reboot.
C:A screenshot cannot replace the underlying packet samples, NetFlow and service response logs retained with chain of custody needed to establish sequence and integrity.
D:Changing the original traffic records show many distributed UDP sources targeting one service address compromises provenance and makes later findings harder to verify.
