CompTIA CS0-003 Practice Test 13
Question 120
Rail operator is reviewing a security finding affecting legacy signaling consoles: unsupported system has a compensating jump host with time-limited exception. The current reporting problem is that monthly report says simply 'unpatched critical'. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Discard the pre-change evidence vendor support status, approved exception and verified network segmentation so that only the improved numbers for exception owner, expiry, residual risk and tested safeguards remain
- Close unsupported system has a compensating jump host with time-limited exception based solely on a self-reported completion email from OT risk executive with no verification
- Use the number of remediation meetings at Rail operator instead of observed change in exception owner, expiry, residual risk and tested safeguards as closeout proof
- Report retested vendor support status, approved exception and verified network segmentation, the outcome against exception owner, expiry, residual risk and tested safeguards, remaining exceptions, and owner confirmation
Explanation
Correct Answer
D:Vendor support status, approved exception and verified network segmentation provides source-linked closure proof. Showing exception owner, expiry, residual risk and tested safeguards and residual exceptions verifies whether OT risk executive actually reduced availability risk competes with immediate safety-critical control changes rather than merely marking a ticket closed.
Incorrect Answers
A:Without historical exception owner, expiry, residual risk and tested safeguards inputs, leaders cannot validate the claimed improvement or identify recurrence.
B:Self-declared completion does not demonstrate improved exception owner, expiry, residual risk and tested safeguards against documented vendor support status, approved exception and verified network segmentation.
C:Meetings do not confirm that unsupported system has a compensating jump host with time-limited exception was corrected or that remaining availability risk competes with immediate safety-critical control changes is acceptable.
Question 121
At University research network, analysts monitor faculty workstation subnet. They observe that small TLS connections recur to one rare external host every 63 seconds across idle periods. Evidence: proxy logs show fixed-size POST messages with a persistent new destination. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat approved licensed telemetry uses a published vendor destination and authenticated agent process as conclusive authorization for the current event without matching process or identity
- Downgrade small TLS connections recur to one rare external host every 63 seconds across idle periods solely because the same symptom has not yet appeared on another endpoint
- Treat the pattern as a hypothesis of periodic command-and-control beaconing and begin corroborating it with endpoint and network evidence
- Announce that proxy logs show fixed-size POST messages with a persistent new destination conclusively proves theft of unpublished research datasets before reviewing any sessions or file access
Explanation
Correct Answer
C:The combination of small TLS connections recur to one rare external host every 63 seconds across idle periods and proxy logs show fixed-size POST messages with a persistent new destination is suspicious for periodic command-and-control beaconing. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting unpublished research datasets.
Incorrect Answers
A:The legitimate comparator is approved licensed telemetry uses a published vendor destination and authenticated agent process; it does not establish that the current event came from the same approved identity or workflow.
B:An intrusion can begin on one asset. The specific indicator on faculty workstation subnet warrants its own validation before expanding or closing the investigation.
D:proxy logs show fixed-size POST messages with a persistent new destination is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
Question 122
At University research network, analysts monitor faculty workstation subnet. They observe that small TLS connections recur to one rare external host every 63 seconds across idle periods. Evidence: proxy logs show fixed-size POST messages with a persistent new destination. A separate known-good explanation is: approved licensed telemetry uses a published vendor destination and authenticated agent process. Which next analysis most reliably determines what caused the observed event?
- Perform a scoped investigation: correlate proxy timestamps with endpoint socket owners and DNS resolution history
- Accept a public reputation score for the destination as proof of the origin of proxy logs show fixed-size POST messages with a persistent new destination, without using correlate proxy timestamps with endpoint socket owners and DNS resolution history
- Suspend telemetry collection on faculty workstation subnet while waiting for the connection pattern to stop
- Summarize proxy logs show fixed-size POST messages with a persistent new destination into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
A:Correlate proxy timestamps with endpoint socket owners and DNS resolution history ties the evidence on faculty workstation subnet to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved licensed telemetry uses a published vendor destination and authenticated agent process.
Incorrect Answers
B:A reputation score may inform triage but cannot establish the origin of proxy logs show fixed-size POST messages with a persistent new destination or whether the activity matches approved licensed telemetry uses a published vendor destination and authenticated agent process.
C:Suppressing telemetry destroys the source needed to investigate periodic command-and-control beaconing and may conceal further actions.
D:The original proxy logs show fixed-size POST messages with a persistent new destination must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 123
University research network has a candidate alert for faculty workstation subnet: proxy logs show fixed-size POST messages with a persistent new destination. The team argues it is harmless because approved licensed telemetry uses a published vendor destination and authenticated agent process. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that small TLS connections recur to one rare external host every 63 seconds across idle periods is benign
- Automatically treat every event resembling proxy logs show fixed-size POST messages with a persistent new destination as confirmed compromise of faculty workstation subnet, without checking provenance
- Create a blanket suppression for proxy logs show fixed-size POST messages with a persistent new destination because approved licensed telemetry uses a published vendor destination and authenticated agent process can produce a superficially similar event
- Distinguish proxy logs show fixed-size POST messages with a persistent new destination from the approved behavior (approved licensed telemetry uses a published vendor destination and authenticated agent process) by validating process, identity and time attribution
Explanation
Correct Answer
D:Approved licensed telemetry uses a published vendor destination and authenticated agent process is a plausible alternative, but it must be proven to match the actual source of proxy logs show fixed-size POST messages with a persistent new destination. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: small TLS connections recur to one rare external host every 63 seconds across idle periods.
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting unpublished research datasets.
C:Similarity to approved licensed telemetry uses a published vendor destination and authenticated agent process does not exclude an attacker from producing the same surface event on faculty workstation subnet.
Question 124
At University research network, analysts monitor faculty workstation subnet. They observe that small TLS connections recur to one rare external host every 63 seconds across idle periods. Evidence: proxy logs show fixed-size POST messages with a persistent new destination. The team confirms unauthorized behavior and must protect unpublished research datasets; legitimate service continuity remains necessary. Which containment decision is best?
- Leave the confirmed unauthorized activity on faculty workstation subnet unrestricted until actual losses of unpublished research datasets can be measured
- Erase proxy logs show fixed-size POST messages with a persistent new destination from the evidence archive during the containment change to reduce repeated alerts
- Apply targeted containment: quarantine only the flagged workstation after confirming research instrument dependency
- Disable every production service at University research network without measuring whether its dependencies share the observed malicious path
Explanation
Correct Answer
C:Quarantine only the flagged workstation after confirming research instrument dependency constrains the observed threat while maintaining necessary service for unpublished research datasets. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Once unauthorized behavior is confirmed on faculty workstation subnet, delaying containment could expand the exposure affecting unpublished research datasets.
B:Eliminating proxy logs show fixed-size POST messages with a persistent new destination evidence does not contain periodic command-and-control beaconing and impairs forensic reconstruction.
D:Global shutdown could disrupt unpublished research datasets without evidence that every system has been affected; scoped isolation is more proportionate.
Question 125
University research network has correlated an alert involving faculty workstation subnet; the key observation is proxy logs show fixed-size POST messages with a persistent new destination. Another security organization requests a defensible, privacy-conscious indicator package to hunt for similar behavior. What should be shared?
- Share all raw unpublished research datasets records to prove the alert is important before stripping unnecessary personal or protected content
- Send only the statement that periodic command-and-control beaconing exists with no indicator, observation time or confidence
- Share the validated technical observables and conditions from pivot on destination certificate and beacon interval across research desktops, with timing, confidence, classification and minimal sensitive data
- Declare every system using faculty workstation subnet technology compromised without proof beyond the single observation
Explanation
Correct Answer
C:Pivot on destination certificate and beacon interval across research desktops describes how other defenders can test the observation. Time, confidence and privacy handling preserve investigative value without disclosing unrelated unpublished research datasets data.
Incorrect Answers
A:Sharing investigative indicators does not authorize exposing unpublished research datasets; minimize records and follow approved intelligence-sharing rules.
B:A generic threat label cannot help a partner correlate proxy logs show fixed-size POST messages with a persistent new destination to its own assets or distinguish it from routine activity.
D:The single finding proxy logs show fixed-size POST messages with a persistent new destination on faculty workstation subnet does not prove the same activity across organizations; share enough context for each partner to validate it.
Question 126
University research network has investigated periodic command-and-control beaconing on faculty workstation subnet. Detection operators report that approved licensed telemetry uses a published vendor destination and authenticated agent process; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to small TLS connections recur to one rare external host every 63 seconds across idle periods, without validation or guardrails for unpublished research datasets
- Suppress every future event associated with proxy logs show fixed-size POST messages with a persistent new destination, including events outside approved licensed telemetry uses a published vendor destination and authenticated agent process
- Improve detection by requiring context-aware correlation: combine rare destination, repetitive interval and endpoint-process lineage instead of alerting on HTTPS alone
- Assign critical severity to every routine activity on faculty workstation subnet whether or not it matches combine rare destination, repetitive interval and endpoint-process lineage instead of alerting on HTTPS alone
Explanation
Correct Answer
C:Combine rare destination, repetitive interval and endpoint-process lineage instead of alerting on HTTPS alone retains the specific threat signal while discriminating against approved licensed telemetry uses a published vendor destination and authenticated agent process. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt unpublished research datasets and cannot distinguish the benign workflow from attacker behavior.
B:Suppressing all monitoring would also hide a recurrence of periodic command-and-control beaconing, even where it threatens unpublished research datasets.
D:Alert severity without distinguishing approved licensed telemetry uses a published vendor destination and authenticated agent process from malicious conditions would increase noise and operational workload.
Question 127
At Municipal ticketing, the security team assesses parking payment forms. The current issue is missing cross-site request forgery guard; assessment evidence states: cross-origin form submits an authenticated state change. The service is browser session cookies automatically sent. Operational constraints: mobile kiosks use embedded browser sessions. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across parking payment forms during mobile kiosks use embedded browser sessions instead of using a scoped test
- Use only an anonymous outside-in scan of parking payment forms even when browser session cookies automatically sent requires authenticated deployment context
- Use an authorized, scoped validation approach that considers service sensitivity: test cross-site request with controlled account and SameSite behavior
- Accept the label missing cross-site request forgery guard as confirmed without checking the reported evidence cross-origin form submits an authenticated state change or actual deployment
Explanation
Correct Answer
C:The evidence cross-origin form submits an authenticated state change must be evaluated without violating the constraint mobile kiosks use embedded browser sessions. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because mobile kiosks use embedded browser sessions; authorization and scope are prerequisites.
B:Asset configuration and the constraints of parking payment forms matter; external findings alone may misstate or miss the exposed path.
D:The finding does not establish which live component is affected or whether the exposure browser session cookies automatically sent is real.
Question 128
At Municipal ticketing, the security team assesses parking payment forms. The current issue is missing cross-site request forgery guard; assessment evidence states: cross-origin form submits an authenticated state change. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against parking payment forms, ignoring that mobile kiosks use embedded browser sessions and a safer validation exist
- Confirm the reported condition in the relevant asset context: test cross-site request with controlled account and SameSite behavior
- Mark cross-origin form submits an authenticated state change resolved or confirmed solely from the scanner severity without test cross-site request with controlled account and SameSite behavior
- Assume parking payment forms is safe because another platform with similar software recently passed its own assessment
Explanation
Correct Answer
B:Test cross-site request with controlled account and SameSite behavior tests the reported condition cross-origin form submits an authenticated state change against actual deployment context (browser session cookies automatically sent). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when test cross-site request with controlled account and SameSite behavior can provide authorized evidence and mobile kiosks use embedded browser sessions constrains production testing.
C:cross-origin form submits an authenticated state change may be accurate but its actual occurrence and configuration on parking payment forms must be established before calling it validated.
D:Security of an unrelated host cannot establish the state of parking payment forms, whose reported issue is missing cross-site request forgery guard.
Question 129
At Municipal ticketing, the security team assesses parking payment forms. The current issue is missing cross-site request forgery guard; assessment evidence states: cross-origin form submits an authenticated state change. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Prioritize the confirmed exposure of parking payment forms, accounting for payment rule integrity and the real access path: browser session cookies automatically sent
- Choose whatever finding on parking payment forms was logged most recently, regardless of actual exploit path or priority
- Give every vulnerability the same deadline despite missing cross-site request forgery guard and business impact on payment rule integrity
- Choose the highest nominal scanner severity first while ignoring browser session cookies automatically sent and the consequence to payment rule integrity
Explanation
Correct Answer
A:Risk depends on practical reachability, threat activity and consequence. The issue missing cross-site request forgery guard can affect payment rule integrity through browser session cookies automatically sent; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
B:Discovery order is not evidence of urgency compared with the actual affected parking payment forms.
C:Uniform priority ignores browser session cookies automatically sent, operational harm and payment rule integrity; documented context makes triage defensible.
D:CVSS describes technical characteristics, not the entirety of exposure and payment rule integrity for this deployment.
Question 130
At Municipal ticketing, the security team assesses parking payment forms. The current issue is missing cross-site request forgery guard; assessment evidence states: cross-origin form submits an authenticated state change. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Implement and verify the root-cause fix: anti-CSRF token and same-site cookie policy
- Sign an exception document but do not implement or test anti-CSRF token and same-site cookie policy on parking payment forms
- Use disable cross-site mutation path pending fix as permanent closure of the confirmed issue instead of deploying anti-CSRF token and same-site cookie policy
- Leave missing cross-site request forgery guard present indefinitely because no incident involving payment rule integrity was recorded this week
Explanation
Correct Answer
A:Anti-CSRF token and same-site cookie policy targets the mechanism missing cross-site request forgery guard rather than only filtering symptoms. Verification must account for cross-origin form submits an authenticated state change and continued protection of payment rule integrity.
Incorrect Answers
B:Risk acceptance paperwork does not itself remediate missing cross-site request forgery guard on parking payment forms; authorized, tested implementation is still required when the risk exceeds tolerance.
C:The interim control may reduce exposure, but it can leave the underlying missing cross-site request forgery guard and should be time-limited with verification and owner oversight.
D:No observed attack does not correct the verified condition cross-origin form submits an authenticated state change or eliminate its potential impact on payment rule integrity.
