CompTIA CS0-003 Practice Test 14
Question 130
At Municipal ticketing, the security team assesses parking payment forms. The current issue is missing cross-site request forgery guard; assessment evidence states: cross-origin form submits an authenticated state change. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Implement and verify the root-cause fix: anti-CSRF token and same-site cookie policy
- Sign an exception document but do not implement or test anti-CSRF token and same-site cookie policy on parking payment forms
- Use disable cross-site mutation path pending fix as permanent closure of the confirmed issue instead of deploying anti-CSRF token and same-site cookie policy
- Leave missing cross-site request forgery guard present indefinitely because no incident involving payment rule integrity was recorded this week
Explanation
Correct Answer
A:Anti-CSRF token and same-site cookie policy targets the mechanism missing cross-site request forgery guard rather than only filtering symptoms. Verification must account for cross-origin form submits an authenticated state change and continued protection of payment rule integrity.
Incorrect Answers
B:Risk acceptance paperwork does not itself remediate missing cross-site request forgery guard on parking payment forms; authorized, tested implementation is still required when the risk exceeds tolerance.
C:The interim control may reduce exposure, but it can leave the underlying missing cross-site request forgery guard and should be time-limited with verification and owner oversight.
D:No observed attack does not correct the verified condition cross-origin form submits an authenticated state change or eliminate its potential impact on payment rule integrity.
Question 131
At Municipal ticketing, the security team assesses parking payment forms. The current issue is missing cross-site request forgery guard; assessment evidence states: cross-origin form submits an authenticated state change. A permanent correction cannot be deployed immediately because mobile kiosks use embedded browser sessions. Which interim treatment is the safest governed option?
- Apply a time-bound compensating measure, disable cross-site mutation path pending fix, record the residual risk owner and schedule the tested permanent fix
- Claim missing cross-site request forgery guard is patched when the change ticket opens, without confirming disable cross-site mutation path pending fix or a planned permanent change
- Accept continued exposure of payment rule integrity without any owner, expiry or compensating verification because mobile kiosks use embedded browser sessions
- Push anti-CSRF token and same-site cookie policy immediately to all production systems with no safe change window despite mobile kiosks use embedded browser sessions
Explanation
Correct Answer
A:Disable cross-site mutation path pending fix can reduce short-term exposure while mobile kiosks use embedded browser sessions delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because payment rule integrity remains at stake.
Incorrect Answers
B:A work item is not proof that missing cross-site request forgery guard was corrected or even that disable cross-site mutation path pending fix operates.
C:Business criticality increases the need for accountable decisions and review; it does not make payment rule integrity irrelevant.
D:Ignoring mobile kiosks use embedded browser sessions could cause avoidable service failure and is not a risk-aware remediation process.
Question 132
At Municipal ticketing, the security team assesses parking payment forms. The current issue is missing cross-site request forgery guard; assessment evidence states: cross-origin form submits an authenticated state change. The owner reports that anti-CSRF token and same-site cookie policy has been deployed. What evidence should close the vulnerability item?
- Retest the originally affected configuration using test cross-site request with controlled account and SameSite behavior, confirm the vulnerability is gone and record change evidence
- Use an unrelated server’s clean findings to claim parking payment forms is fixed without retesting the affected path
- Close cross-origin form submits an authenticated state change after the deployment tool returns success, without verifying the current state of parking payment forms
- Suppress future results for missing cross-site request forgery guard so that the vulnerability dashboard shows a completed remediation
Explanation
Correct Answer
A:Closure requires checking the same affected path identified by cross-origin form submits an authenticated state change, plus regression impact on parking payment forms. A change ticket alone is not proof of removal of missing cross-site request forgery guard.
Incorrect Answers
B:The result must be tied to parking payment forms and the actual exposure: browser session cookies automatically sent.
C:Process completion is not evidence that cross-origin form submits an authenticated state change no longer applies to parking payment forms.
D:Suppression may hide a failed or incomplete fix, leaving payment rule integrity exposed despite the administrative record.
Question 133
At Regional bank, the incident team supports cloud administration tenant. A new security event is reported: a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset. The log clue is: cloud audit shows policy changes and attempts to disable logging. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Map the observed behavior in cloud audit shows policy changes and attempts to disable logging to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Assign a final attack-chain stage to cloud administration tenant without confirming what behavior actually occurred in cloud audit shows policy changes and attempts to disable logging
- Attribute a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset to a named foreign intelligence service using only cloud audit shows policy changes and attempts to disable logging
- Treat an ATT&CK label for a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset as a complete recovery instruction without checking evidence or impact
Explanation
Correct Answer
A:A privileged cloud role is assumed from an unusual access key after an off-hours MFA reset and cloud audit shows policy changes and attempts to disable logging support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
B:Attack frameworks describe observable stages and techniques; the cloud audit shows policy changes and attempts to disable logging must substantiate whichever stage is assigned.
C:Neither a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset nor cloud audit shows policy changes and attempts to disable logging establishes uniquely identifying actor evidence.
D:A taxonomy is not an incident response plan for cloud administration tenant; scope and safety constraints still matter.
Question 134
At Regional bank, the incident team supports cloud administration tenant. A new security event is reported: a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset. The log clue is: cloud audit shows policy changes and attempts to disable logging. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Preserve and hash incident artifacts: immutable cloud audit trails, role-session details and IdP verification logs
- Alter original cloud audit shows policy changes and attempts to disable logging entries to remove irrelevant records before preserving the forensic timeline
- Keep only a screenshot of cloud audit shows policy changes and attempts to disable logging, discarding original artifacts such as immutable cloud audit trails, role-session details and IdP verification logs
- Rebuild cloud administration tenant first and collect the volatile evidence for a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset afterward
Explanation
Correct Answer
A:Immutable cloud audit trails, role-session details and IdP verification logs retains relevant source context and integrity checks so the team can reconstruct a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset and support an auditable chain of custody.
Incorrect Answers
B:Changing the original cloud audit shows policy changes and attempts to disable logging compromises provenance and makes later findings harder to verify.
C:A screenshot cannot replace the underlying immutable cloud audit trails, role-session details and IdP verification logs needed to establish sequence and integrity.
D:Volatile evidence relevant to a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset may disappear during remediation or reboot.
Question 135
At Regional bank, the incident team supports cloud administration tenant. A new security event is reported: a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset. The log clue is: cloud audit shows policy changes and attempts to disable logging. The incident remains active, but cloud administration tenant is operationally important. Which containment decision is most appropriate now?
- Execute scoped containment: revoke suspicious sessions, protect audit storage and apply emergency boundary policy
- Erase cloud audit shows policy changes and attempts to disable logging to reduce alert volume rather than isolating the observed attacker route
- Disconnect every service at Regional bank, regardless of whether it has a dependency on the affected cloud administration tenant
- Publish a speculative full-incident attribution notice before constraining the active behavior a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset
Explanation
Correct Answer
A:Revoke suspicious sessions, protect audit storage and apply emergency boundary policy stops or limits the observed path while balancing continuity of cloud administration tenant. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
B:Erasing cloud audit shows policy changes and attempts to disable logging neither blocks attacker access nor supports a reliable subsequent recovery decision.
C:Broad interruption may unnecessarily affect cloud administration tenant; containment should be scoped to evidenced systems and approved critical-service requirements.
D:Communication matters, but active a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset requires proportionate containment and evidence preservation first.
Question 136
At Regional bank, the incident team supports cloud administration tenant. A new security event is reported: a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset. The log clue is: cloud audit shows policy changes and attempts to disable logging. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Use only the original firewall block and assume it has also removed all persistence behind a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset
- Remove the attack’s established access and persistence: remove unauthorized role policies, rotate key material and correct privilege delegation
- Rewrite the playbook for cloud administration tenant but leave the confirmed malicious access mechanism active
- Restore cloud administration tenant without first correcting the access and persistence cause addressed by remove unauthorized role policies, rotate key material and correct privilege delegation
Explanation
Correct Answer
B:Remove unauthorized role policies, rotate key material and correct privilege delegation targets the mechanism behind a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset, reducing recurrence when cloud administration tenant returns to normal operations.
Incorrect Answers
A:Containment can stop communication without eliminating the root access that produced cloud audit shows policy changes and attempts to disable logging.
C:Updated paperwork does not eradicate the mechanism behind a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset.
D:Recovery before remove unauthorized role policies, rotate key material and correct privilege delegation could reintroduce the same compromise path.
Question 137
At Regional bank, the incident team supports cloud administration tenant. A new security event is reported: a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset. The log clue is: cloud audit shows policy changes and attempts to disable logging. Containment and eradication are complete. Which recovery acceptance test should precede release of cloud administration tenant to normal users?
- Perform controlled return-to-service validation: validate role access matrix, logging and transaction workloads in a clean test
- Expose cloud administration tenant to users before confirming that the conditions behind a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset are absent
- Approve recovery of cloud administration tenant when it boots, without executing the test validate role access matrix, logging and transaction workloads in a clean test
- Delete preserved evidence including immutable cloud audit trails, role-session details and IdP verification logs as soon as the service restarts
Explanation
Correct Answer
A:Validate role access matrix, logging and transaction workloads in a clean test demonstrates that the compromised pathway is absent while cloud administration tenant again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
B:Without a clean functional/security validation, cloud administration tenant could immediately face the same exploit condition.
C:A boot event cannot prove validate role access matrix, logging and transaction workloads in a clean test or protect the service from recurrence of a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset.
D:Evidence retention obligations continue beyond restart; immutable cloud audit trails, role-session details and IdP verification logs may be required for subsequent review.
Question 138
At Regional bank, the incident team supports cloud administration tenant. A new security event is reported: a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset. The log clue is: cloud audit shows policy changes and attempts to disable logging. The incident has been contained and normal service has resumed. A post-incident review identifies that cloud emergency role lacked short-lived session restriction. Which improvement should be prioritized?
- Assign an owner and measurable corrective action addressing the root cause: cloud emergency role lacked short-lived session restriction, with a future effectiveness test
- Write a lessons-learned memo about a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset with no due date, control owner or validation activity
- Discipline the whole on-duty response shift rather than examining the documented weakness cloud emergency role lacked short-lived session restriction
- Close the follow-up for cloud administration tenant merely because restoration completed, without addressing cloud emergency role lacked short-lived session restriction
Explanation
Correct Answer
A:Cloud emergency role lacked short-lived session restriction was the systemic weakness that enabled or worsened a privileged cloud role is assumed from an unusual access key after an off-hours MFA reset. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
B:An unowned recommendation does not produce a verified control improvement for cloud administration tenant.
C:A personnel-only response lacks support from the documented root cause: cloud emergency role lacked short-lived session restriction.
D:Service restoration does not address cloud emergency role lacked short-lived session restriction; ignoring it leaves the next incident likely to follow the same route.
Question 139
Insurance customer platform is reviewing a security finding affecting managed vulnerability scanning service: vendor remediation SLA breached for exposed customer API. The current reporting problem is that vendor dashboard shows many closed tickets without evidence. What information should be delivered first to decision makers responsible for contract commitments and customer-data exposure both matter?
- Present a concise, evidence-qualified risk and impact summary based on contract SLA, verification scans and reopen events, with decisions and uncertainty stated
- State that vendor remediation SLA breached for exposed customer API was eliminated because Insurance customer platform distributed a dashboard on schedule
- Forward raw telemetry from contract SLA, verification scans and reopen events to executives without summarizing consequences for contract commitments and customer-data exposure both matter
- Report only the number of tickets closed for managed vulnerability scanning service, concealing the unresolved exposure from vendor remediation SLA breached for exposed customer API
Explanation
Correct Answer
A:Contract SLA, verification scans and reopen events supports a decision-oriented picture of contract commitments and customer-data exposure both matter while separating confirmed facts from unknowns. This corrects the reporting defect: vendor dashboard shows many closed tickets without evidence.
Incorrect Answers
B:Reporting timeliness is not evidence that contract SLA, verification scans and reopen events shows full risk elimination.
C:Raw telemetry may support analysts, but decision makers need the meaning for contract commitments and customer-data exposure both matter and accountable options.
D:Ticket counts do not establish whether vendor remediation SLA breached for exposed customer API still threatens contract commitments and customer-data exposure both matter.
Question 140
Insurance customer platform is reviewing a security finding affecting managed vulnerability scanning service: vendor remediation SLA breached for exposed customer API. The current reporting problem is that vendor dashboard shows many closed tickets without evidence. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Remove the timestamps and correlations from contract SLA, verification scans and reopen events so the technical report occupies fewer pages
- Give supplier assurance lead the same board overview rather than the reproducible records from contract SLA, verification scans and reopen events
- Provide the original relevant artifacts and validation method from contract SLA, verification scans and reopen events, tied to affected assets, owners and retest criteria
- Accept an assertion that supplier assurance lead completed the correction with no retest against contract SLA, verification scans and reopen events
Explanation
Correct Answer
C:Contract SLA, verification scans and reopen events gives engineers traceable scope and a basis for confirming that supplier assurance lead has resolved the identified exposure on managed vulnerability scanning service.
Incorrect Answers
A:Such edits break reproducibility of vendor remediation SLA breached for exposed customer API and make scope or remediation errors harder to find.
B:A high-level board summary cannot identify the concrete contract SLA, verification scans and reopen events fields needed for technical validation.
D:Self-assessment without test artifacts is weaker than verifiable contract SLA, verification scans and reopen events and agreed acceptance conditions.
