CompTIA CS0-003 Practice Test 16
Question 150
Electric utility has investigated password spraying against OT support identities on vendor remote-access gateway. Detection operators report that legitimate user mistakes usually affect one account and a known interactive workstation; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on vendor remote-access gateway whether or not it matches alert on many distinct principals failing from one client rather than simple per-account lockout
- Automate service shutdown on the first simple match to many Kerberos preauthentication failures across several operator identities come from one jump host, without validation or guardrails for grid maintenance operations
- Suppress every future event associated with domain controller event 4771 failures span 24 users followed by one 4768 success, including events outside legitimate user mistakes usually affect one account and a known interactive workstation
- Improve detection by requiring context-aware correlation: alert on many distinct principals failing from one client rather than simple per-account lockout
Explanation
Correct Answer
D:Alert on many distinct principals failing from one client rather than simple per-account lockout retains the specific threat signal while discriminating against legitimate user mistakes usually affect one account and a known interactive workstation. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing legitimate user mistakes usually affect one account and a known interactive workstation from malicious conditions would increase noise and operational workload.
B:An untested, unqualified automation could interrupt grid maintenance operations and cannot distinguish the benign workflow from attacker behavior.
C:Suppressing all monitoring would also hide a recurrence of password spraying against OT support identities, even where it threatens grid maintenance operations.
Question 151
At Manufacturing design, the security team assesses legacy C parsing service. The current issue is stack buffer overflow in network parser; assessment evidence states: fuzz test crashes on oversized length field with stack corruption. The service is reachable from manufacturing VPN only. Operational constraints: production line change freezes Monday-Friday. Which assessment approach is most appropriate before recommending a fix?
- Use an authorized, scoped validation approach that considers service sensitivity: reproduce crash in isolated debug environment with bounds evidence
- Launch unapproved intrusive exploitation across legacy C parsing service during production line change freezes Monday-Friday instead of using a scoped test
- Use only an anonymous outside-in scan of legacy C parsing service even when reachable from manufacturing VPN only requires authenticated deployment context
- Accept the label stack buffer overflow in network parser as confirmed without checking the reported evidence fuzz test crashes on oversized length field with stack corruption or actual deployment
Explanation
Correct Answer
A:The evidence fuzz test crashes on oversized length field with stack corruption must be evaluated without violating the constraint production line change freezes Monday-Friday. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
B:Uncontrolled testing may breach service safety, especially because production line change freezes Monday-Friday; authorization and scope are prerequisites.
C:Asset configuration and the constraints of legacy C parsing service matter; external findings alone may misstate or miss the exposed path.
D:The finding does not establish which live component is affected or whether the exposure reachable from manufacturing VPN only is real.
Question 152
At Manufacturing design, the security team assesses legacy C parsing service. The current issue is stack buffer overflow in network parser; assessment evidence states: fuzz test crashes on oversized length field with stack corruption. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Mark fuzz test crashes on oversized length field with stack corruption resolved or confirmed solely from the scanner severity without reproduce crash in isolated debug environment with bounds evidence
- Assume legacy C parsing service is safe because another platform with similar software recently passed its own assessment
- Force a destructive proof-of-concept against legacy C parsing service, ignoring that production line change freezes Monday-Friday and a safer validation exist
- Confirm the reported condition in the relevant asset context: reproduce crash in isolated debug environment with bounds evidence
Explanation
Correct Answer
D:Reproduce crash in isolated debug environment with bounds evidence tests the reported condition fuzz test crashes on oversized length field with stack corruption against actual deployment context (reachable from manufacturing VPN only). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:fuzz test crashes on oversized length field with stack corruption may be accurate but its actual occurrence and configuration on legacy C parsing service must be established before calling it validated.
B:Security of an unrelated host cannot establish the state of legacy C parsing service, whose reported issue is stack buffer overflow in network parser.
C:A destructive proof is unnecessary when reproduce crash in isolated debug environment with bounds evidence can provide authorized evidence and production line change freezes Monday-Friday constrains production testing.
Question 153
At Manufacturing design, the security team assesses legacy C parsing service. The current issue is stack buffer overflow in network parser; assessment evidence states: fuzz test crashes on oversized length field with stack corruption. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Prioritize the confirmed exposure of legacy C parsing service, accounting for CAD transfer reliability and the real access path: reachable from manufacturing VPN only
- Choose whatever finding on legacy C parsing service was logged most recently, regardless of actual exploit path or priority
- Give every vulnerability the same deadline despite stack buffer overflow in network parser and business impact on CAD transfer reliability
- Choose the highest nominal scanner severity first while ignoring reachable from manufacturing VPN only and the consequence to CAD transfer reliability
Explanation
Correct Answer
A:Risk depends on practical reachability, threat activity and consequence. The issue stack buffer overflow in network parser can affect CAD transfer reliability through reachable from manufacturing VPN only; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
B:Discovery order is not evidence of urgency compared with the actual affected legacy C parsing service.
C:Uniform priority ignores reachable from manufacturing VPN only, operational harm and CAD transfer reliability; documented context makes triage defensible.
D:CVSS describes technical characteristics, not the entirety of exposure and CAD transfer reliability for this deployment.
Question 154
At Manufacturing design, the security team assesses legacy C parsing service. The current issue is stack buffer overflow in network parser; assessment evidence states: fuzz test crashes on oversized length field with stack corruption. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Implement and verify the root-cause fix: bounds-checked parsing, memory safety and compiler hardening
- Use network ACL restrict inbound parser access while patched as permanent closure of the confirmed issue instead of deploying bounds-checked parsing, memory safety and compiler hardening
- Leave stack buffer overflow in network parser present indefinitely because no incident involving CAD transfer reliability was recorded this week
- Sign an exception document but do not implement or test bounds-checked parsing, memory safety and compiler hardening on legacy C parsing service
Explanation
Correct Answer
A:Bounds-checked parsing, memory safety and compiler hardening targets the mechanism stack buffer overflow in network parser rather than only filtering symptoms. Verification must account for fuzz test crashes on oversized length field with stack corruption and continued protection of CAD transfer reliability.
Incorrect Answers
B:The interim control may reduce exposure, but it can leave the underlying stack buffer overflow in network parser and should be time-limited with verification and owner oversight.
C:No observed attack does not correct the verified condition fuzz test crashes on oversized length field with stack corruption or eliminate its potential impact on CAD transfer reliability.
D:Risk acceptance paperwork does not itself remediate stack buffer overflow in network parser on legacy C parsing service; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 155
At Manufacturing design, the security team assesses legacy C parsing service. The current issue is stack buffer overflow in network parser; assessment evidence states: fuzz test crashes on oversized length field with stack corruption. A permanent correction cannot be deployed immediately because production line change freezes Monday-Friday. Which interim treatment is the safest governed option?
- Push bounds-checked parsing, memory safety and compiler hardening immediately to all production systems with no safe change window despite production line change freezes Monday-Friday
- Apply a time-bound compensating measure, network ACL restrict inbound parser access while patched, record the residual risk owner and schedule the tested permanent fix
- Claim stack buffer overflow in network parser is patched when the change ticket opens, without confirming network ACL restrict inbound parser access while patched or a planned permanent change
- Accept continued exposure of CAD transfer reliability without any owner, expiry or compensating verification because production line change freezes Monday-Friday
Explanation
Correct Answer
B:Network ACL restrict inbound parser access while patched can reduce short-term exposure while production line change freezes Monday-Friday delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because CAD transfer reliability remains at stake.
Incorrect Answers
A:Ignoring production line change freezes Monday-Friday could cause avoidable service failure and is not a risk-aware remediation process.
C:A work item is not proof that stack buffer overflow in network parser was corrected or even that network ACL restrict inbound parser access while patched operates.
D:Business criticality increases the need for accountable decisions and review; it does not make CAD transfer reliability irrelevant.
Question 156
At Manufacturing design, the security team assesses legacy C parsing service. The current issue is stack buffer overflow in network parser; assessment evidence states: fuzz test crashes on oversized length field with stack corruption. The owner reports that bounds-checked parsing, memory safety and compiler hardening has been deployed. What evidence should close the vulnerability item?
- Use an unrelated server’s clean findings to claim legacy C parsing service is fixed without retesting the affected path
- Suppress future results for stack buffer overflow in network parser so that the vulnerability dashboard shows a completed remediation
- Close fuzz test crashes on oversized length field with stack corruption after the deployment tool returns success, without verifying the current state of legacy C parsing service
- Retest the originally affected configuration using reproduce crash in isolated debug environment with bounds evidence, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by fuzz test crashes on oversized length field with stack corruption, plus regression impact on legacy C parsing service. A change ticket alone is not proof of removal of stack buffer overflow in network parser.
Incorrect Answers
A:The result must be tied to legacy C parsing service and the actual exposure: reachable from manufacturing VPN only.
B:Suppression may hide a failed or incomplete fix, leaving CAD transfer reliability exposed despite the administrative record.
C:Process completion is not evidence that fuzz test crashes on oversized length field with stack corruption no longer applies to legacy C parsing service.
Question 157
At Pharmacy retailer, the incident team supports point-of-sale application. A new security event is reported: checkout JavaScript loads an unauthorized external card-data script. The log clue is: browser resource log and change audit show a new unapproved script reference. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Assign a final attack-chain stage to point-of-sale application without confirming what behavior actually occurred in browser resource log and change audit show a new unapproved script reference
- Attribute checkout JavaScript loads an unauthorized external card-data script to a named foreign intelligence service using only browser resource log and change audit show a new unapproved script reference
- Treat an ATT&CK label for checkout JavaScript loads an unauthorized external card-data script as a complete recovery instruction without checking evidence or impact
- Map the observed behavior in browser resource log and change audit show a new unapproved script reference to a technique-level ATT&CK or kill-chain hypothesis and record confidence
Explanation
Correct Answer
D:Checkout JavaScript loads an unauthorized external card-data script and browser resource log and change audit show a new unapproved script reference support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:Attack frameworks describe observable stages and techniques; the browser resource log and change audit show a new unapproved script reference must substantiate whichever stage is assigned.
B:Neither checkout JavaScript loads an unauthorized external card-data script nor browser resource log and change audit show a new unapproved script reference establishes uniquely identifying actor evidence.
C:A taxonomy is not an incident response plan for point-of-sale application; scope and safety constraints still matter.
Question 158
At Pharmacy retailer, the incident team supports point-of-sale application. A new security event is reported: checkout JavaScript loads an unauthorized external card-data script. The log clue is: browser resource log and change audit show a new unapproved script reference. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Preserve and hash incident artifacts: forensic copies of served checkout code, CDN logs and payment telemetry
- Rebuild point-of-sale application first and collect the volatile evidence for checkout JavaScript loads an unauthorized external card-data script afterward
- Alter original browser resource log and change audit show a new unapproved script reference entries to remove irrelevant records before preserving the forensic timeline
- Keep only a screenshot of browser resource log and change audit show a new unapproved script reference, discarding original artifacts such as forensic copies of served checkout code, CDN logs and payment telemetry
Explanation
Correct Answer
A:Forensic copies of served checkout code, CDN logs and payment telemetry retains relevant source context and integrity checks so the team can reconstruct checkout JavaScript loads an unauthorized external card-data script and support an auditable chain of custody.
Incorrect Answers
B:Volatile evidence relevant to checkout JavaScript loads an unauthorized external card-data script may disappear during remediation or reboot.
C:Changing the original browser resource log and change audit show a new unapproved script reference compromises provenance and makes later findings harder to verify.
D:A screenshot cannot replace the underlying forensic copies of served checkout code, CDN logs and payment telemetry needed to establish sequence and integrity.
Question 159
At Pharmacy retailer, the incident team supports point-of-sale application. A new security event is reported: checkout JavaScript loads an unauthorized external card-data script. The log clue is: browser resource log and change audit show a new unapproved script reference. The incident remains active, but point-of-sale application is operationally important. Which containment decision is most appropriate now?
- Publish a speculative full-incident attribution notice before constraining the active behavior checkout JavaScript loads an unauthorized external card-data script
- Erase browser resource log and change audit show a new unapproved script reference to reduce alert volume rather than isolating the observed attacker route
- Disconnect every service at Pharmacy retailer, regardless of whether it has a dependency on the affected point-of-sale application
- Execute scoped containment: disable checkout script and use verified fallback payment checkout
Explanation
Correct Answer
D:Disable checkout script and use verified fallback payment checkout stops or limits the observed path while balancing continuity of point-of-sale application. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Communication matters, but active checkout JavaScript loads an unauthorized external card-data script requires proportionate containment and evidence preservation first.
B:Erasing browser resource log and change audit show a new unapproved script reference neither blocks attacker access nor supports a reliable subsequent recovery decision.
C:Broad interruption may unnecessarily affect point-of-sale application; containment should be scoped to evidenced systems and approved critical-service requirements.
Question 160
At Pharmacy retailer, the incident team supports point-of-sale application. A new security event is reported: checkout JavaScript loads an unauthorized external card-data script. The log clue is: browser resource log and change audit show a new unapproved script reference. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Use only the original firewall block and assume it has also removed all persistence behind checkout JavaScript loads an unauthorized external card-data script
- Restore point-of-sale application without first correcting the access and persistence cause addressed by remove injected resource, rotate publishing token and harden deployment approval
- Rewrite the playbook for point-of-sale application but leave the confirmed malicious access mechanism active
- Remove the attack’s established access and persistence: remove injected resource, rotate publishing token and harden deployment approval
Explanation
Correct Answer
D:Remove injected resource, rotate publishing token and harden deployment approval targets the mechanism behind checkout JavaScript loads an unauthorized external card-data script, reducing recurrence when point-of-sale application returns to normal operations.
Incorrect Answers
A:Containment can stop communication without eliminating the root access that produced browser resource log and change audit show a new unapproved script reference.
B:Recovery before remove injected resource, rotate publishing token and harden deployment approval could reintroduce the same compromise path.
C:Updated paperwork does not eradicate the mechanism behind checkout JavaScript loads an unauthorized external card-data script.
