CompTIA CS0-003 Practice Test 17
Question 160
At Pharmacy retailer, the incident team supports point-of-sale application. A new security event is reported: checkout JavaScript loads an unauthorized external card-data script. The log clue is: browser resource log and change audit show a new unapproved script reference. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Use only the original firewall block and assume it has also removed all persistence behind checkout JavaScript loads an unauthorized external card-data script
- Restore point-of-sale application without first correcting the access and persistence cause addressed by remove injected resource, rotate publishing token and harden deployment approval
- Rewrite the playbook for point-of-sale application but leave the confirmed malicious access mechanism active
- Remove the attack’s established access and persistence: remove injected resource, rotate publishing token and harden deployment approval
Explanation
Correct Answer
D:Remove injected resource, rotate publishing token and harden deployment approval targets the mechanism behind checkout JavaScript loads an unauthorized external card-data script, reducing recurrence when point-of-sale application returns to normal operations.
Incorrect Answers
A:Containment can stop communication without eliminating the root access that produced browser resource log and change audit show a new unapproved script reference.
B:Recovery before remove injected resource, rotate publishing token and harden deployment approval could reintroduce the same compromise path.
C:Updated paperwork does not eradicate the mechanism behind checkout JavaScript loads an unauthorized external card-data script.
Question 161
At Pharmacy retailer, the incident team supports point-of-sale application. A new security event is reported: checkout JavaScript loads an unauthorized external card-data script. The log clue is: browser resource log and change audit show a new unapproved script reference. Containment and eradication are complete. Which recovery acceptance test should precede release of point-of-sale application to normal users?
- Expose point-of-sale application to users before confirming that the conditions behind checkout JavaScript loads an unauthorized external card-data script are absent
- Perform controlled return-to-service validation: verify card fields do not load unauthorized domains in multiple browser tests
- Approve recovery of point-of-sale application when it boots, without executing the test verify card fields do not load unauthorized domains in multiple browser tests
- Delete preserved evidence including forensic copies of served checkout code, CDN logs and payment telemetry as soon as the service restarts
Explanation
Correct Answer
B:Verify card fields do not load unauthorized domains in multiple browser tests demonstrates that the compromised pathway is absent while point-of-sale application again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, point-of-sale application could immediately face the same exploit condition.
C:A boot event cannot prove verify card fields do not load unauthorized domains in multiple browser tests or protect the service from recurrence of checkout JavaScript loads an unauthorized external card-data script.
D:Evidence retention obligations continue beyond restart; forensic copies of served checkout code, CDN logs and payment telemetry may be required for subsequent review.
Question 162
At Pharmacy retailer, the incident team supports point-of-sale application. A new security event is reported: checkout JavaScript loads an unauthorized external card-data script. The log clue is: browser resource log and change audit show a new unapproved script reference. The incident has been contained and normal service has resumed. A post-incident review identifies that third-party script changes bypassed integrity and deployment approval. Which improvement should be prioritized?
- Discipline the whole on-duty response shift rather than examining the documented weakness third-party script changes bypassed integrity and deployment approval
- Close the follow-up for point-of-sale application merely because restoration completed, without addressing third-party script changes bypassed integrity and deployment approval
- Write a lessons-learned memo about checkout JavaScript loads an unauthorized external card-data script with no due date, control owner or validation activity
- Assign an owner and measurable corrective action addressing the root cause: third-party script changes bypassed integrity and deployment approval, with a future effectiveness test
Explanation
Correct Answer
D:Third-party script changes bypassed integrity and deployment approval was the systemic weakness that enabled or worsened checkout JavaScript loads an unauthorized external card-data script. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:A personnel-only response lacks support from the documented root cause: third-party script changes bypassed integrity and deployment approval.
B:Service restoration does not address third-party script changes bypassed integrity and deployment approval; ignoring it leaves the next incident likely to follow the same route.
C:An unowned recommendation does not produce a verified control improvement for point-of-sale application.
Question 163
University central IT is reviewing a security finding affecting campus endpoint fleet: vulnerability count falls while exposed critical servers remain late. The current reporting problem is that dashboard emphasizes raw number of tickets closed. What information should be delivered first to decision makers responsible for risk reduction is not captured by ticket volume?
- Present a concise, evidence-qualified risk and impact summary based on asset criticality, public exposure and age of exploitable findings, with decisions and uncertainty stated
- State that vulnerability count falls while exposed critical servers remain late was eliminated because University central IT distributed a dashboard on schedule
- Report only the number of tickets closed for campus endpoint fleet, concealing the unresolved exposure from vulnerability count falls while exposed critical servers remain late
- Forward raw telemetry from asset criticality, public exposure and age of exploitable findings to executives without summarizing consequences for risk reduction is not captured by ticket volume
Explanation
Correct Answer
A:Asset criticality, public exposure and age of exploitable findings supports a decision-oriented picture of risk reduction is not captured by ticket volume while separating confirmed facts from unknowns. This corrects the reporting defect: dashboard emphasizes raw number of tickets closed.
Incorrect Answers
B:Reporting timeliness is not evidence that asset criticality, public exposure and age of exploitable findings shows full risk elimination.
C:Ticket counts do not establish whether vulnerability count falls while exposed critical servers remain late still threatens risk reduction is not captured by ticket volume.
D:Raw telemetry may support analysts, but decision makers need the meaning for risk reduction is not captured by ticket volume and accountable options.
Question 164
University central IT is reviewing a security finding affecting campus endpoint fleet: vulnerability count falls while exposed critical servers remain late. The current reporting problem is that dashboard emphasizes raw number of tickets closed. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Accept an assertion that vulnerability program owner completed the correction with no retest against asset criticality, public exposure and age of exploitable findings
- Remove the timestamps and correlations from asset criticality, public exposure and age of exploitable findings so the technical report occupies fewer pages
- Provide the original relevant artifacts and validation method from asset criticality, public exposure and age of exploitable findings, tied to affected assets, owners and retest criteria
- Give vulnerability program owner the same board overview rather than the reproducible records from asset criticality, public exposure and age of exploitable findings
Explanation
Correct Answer
C:Asset criticality, public exposure and age of exploitable findings gives engineers traceable scope and a basis for confirming that vulnerability program owner has resolved the identified exposure on campus endpoint fleet.
Incorrect Answers
A:Self-assessment without test artifacts is weaker than verifiable asset criticality, public exposure and age of exploitable findings and agreed acceptance conditions.
B:Such edits break reproducibility of vulnerability count falls while exposed critical servers remain late and make scope or remediation errors harder to find.
D:A high-level board summary cannot identify the concrete asset criticality, public exposure and age of exploitable findings fields needed for technical validation.
Question 165
University central IT is reviewing a security finding affecting campus endpoint fleet: vulnerability count falls while exposed critical servers remain late. The current reporting problem is that dashboard emphasizes raw number of tickets closed. Stakeholders include CISO and department IT leads. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Release unconfirmed details about vulnerability count falls while exposed critical servers remain late externally before evidence and approvals from CISO and department IT leads have been reconciled
- Withhold notification of vulnerability count falls while exposed critical servers remain late indefinitely even after verified asset criticality, public exposure and age of exploitable findings meets a binding disclosure threshold
- Give a technical engineer sole authority for every legal or public statement otherwise owned by CISO and department IT leads
- Coordinate fact-checked messages, recipients and timing with CISO and department IT leads, preserving applicable legal and incident approval paths
Explanation
Correct Answer
D:The parties CISO and department IT leads have different responsibilities. Using verified asset criticality, public exposure and age of exploitable findings and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
A:Unconfirmed claims could misrepresent the impact of vulnerability count falls while exposed critical servers remain late and breach communication obligations.
B:If verified asset criticality, public exposure and age of exploitable findings triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
C:Technical diagnosis does not automatically confer the disclosure authority held by CISO and department IT leads.
Question 166
University central IT is reviewing a security finding affecting campus endpoint fleet: vulnerability count falls while exposed critical servers remain late. The current reporting problem is that dashboard emphasizes raw number of tickets closed. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Measure improvement in risk-weighted overdue trends and service-level breaches by how many slides were added to the board presentation
- Track a defined, evidence-based measure of risk-weighted overdue trends and service-level breaches, with trend, scope and accountable source
- Redefine risk-weighted overdue trends and service-level breaches every week until all dashboards appear positive
- Compare University central IT teams only by tickets closed, ignoring which services are still exposed to vulnerability count falls while exposed critical servers remain late
Explanation
Correct Answer
B:The measure risk-weighted overdue trends and service-level breaches connects reporting to a change in risk reduction is not captured by ticket volume, rather than the number of reports or raw alert volume. Trends must use consistent inputs from asset criticality, public exposure and age of exploitable findings.
Incorrect Answers
A:Presentation size does not establish risk-weighted overdue trends and service-level breaches or whether vulnerability count falls while exposed critical servers remain late is managed.
C:Inconsistent measures cannot support a credible trend for risk-weighted overdue trends and service-level breaches.
D:Tickets can hide unresolved risk reduction is not captured by ticket volume; a risk-weighted outcome metric is needed.
Question 167
University central IT is reviewing a security finding affecting campus endpoint fleet: vulnerability count falls while exposed critical servers remain late. The current reporting problem is that dashboard emphasizes raw number of tickets closed. An action plan is being negotiated, but departments run different patch calendars. What reporting recommendation best supports practical remediation?
- Copy a generic checklist for vulnerability count falls while exposed critical servers remain late without accountable owners, asset scope or milestones
- Ask the vulnerability program owner to document mitigation choices for campus endpoint fleet, service constraints, milestones, approvers and time-bound risk acceptance if needed
- Give vulnerability program owner an unlimited exception because departments run different patch calendars rather than reporting residual risk and expiry
- Set an immediate fix deadline for campus endpoint fleet without acknowledging that departments run different patch calendars
Explanation
Correct Answer
B:Departments run different patch calendars creates a real implementation constraint. A plan owned by vulnerability program owner with measured risk and delegated approvals protects risk reduction is not captured by ticket volume better than an unrealistic generic deadline.
Incorrect Answers
A:A non-accountable template cannot address departments run different patch calendars or demonstrate progress on vulnerability count falls while exposed critical servers remain late.
C:Risk reduction is not captured by ticket volume still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
D:Ignoring departments run different patch calendars can turn a security fix into service disruption while failing to clarify remaining risk.
Question 168
University central IT is reviewing a security finding affecting campus endpoint fleet: vulnerability count falls while exposed critical servers remain late. The current reporting problem is that dashboard emphasizes raw number of tickets closed. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Report retested asset criticality, public exposure and age of exploitable findings, the outcome against risk-weighted overdue trends and service-level breaches, remaining exceptions, and owner confirmation
- Use the number of remediation meetings at University central IT instead of observed change in risk-weighted overdue trends and service-level breaches as closeout proof
- Close vulnerability count falls while exposed critical servers remain late based solely on a self-reported completion email from vulnerability program owner with no verification
- Discard the pre-change evidence asset criticality, public exposure and age of exploitable findings so that only the improved numbers for risk-weighted overdue trends and service-level breaches remain
Explanation
Correct Answer
A:Asset criticality, public exposure and age of exploitable findings provides source-linked closure proof. Showing risk-weighted overdue trends and service-level breaches and residual exceptions verifies whether vulnerability program owner actually reduced risk reduction is not captured by ticket volume rather than merely marking a ticket closed.
Incorrect Answers
B:Meetings do not confirm that vulnerability count falls while exposed critical servers remain late was corrected or that remaining risk reduction is not captured by ticket volume is acceptable.
C:Self-declared completion does not demonstrate improved risk-weighted overdue trends and service-level breaches against documented asset criticality, public exposure and age of exploitable findings.
D:Without historical risk-weighted overdue trends and service-level breaches inputs, leaders cannot validate the claimed improvement or identify recurrence.
Question 169
At Legal services firm, analysts monitor finance executive mailbox. They observe that a wire-change email claims to be internal but fails domain authentication. Evidence: email headers show SPF fail, DKIM none and a lookalike Reply-To domain. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Announce that email headers show SPF fail, DKIM none and a lookalike Reply-To domain conclusively proves theft of escrow client funds before reviewing any sessions or file access
- Treat legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment as conclusive authorization for the current event without matching process or identity
- Downgrade a wire-change email claims to be internal but fails domain authentication solely because the same symptom has not yet appeared on another endpoint
- Treat the pattern as a hypothesis of business email compromise via sender impersonation and begin corroborating it with endpoint and network evidence
Explanation
Correct Answer
D:The combination of a wire-change email claims to be internal but fails domain authentication and email headers show SPF fail, DKIM none and a lookalike Reply-To domain is suspicious for business email compromise via sender impersonation. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting escrow client funds.
Incorrect Answers
A:email headers show SPF fail, DKIM none and a lookalike Reply-To domain is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
B:The legitimate comparator is legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment; it does not establish that the current event came from the same approved identity or workflow.
C:An intrusion can begin on one asset. The specific indicator on finance executive mailbox warrants its own validation before expanding or closing the investigation.
Question 170
At Legal services firm, analysts monitor finance executive mailbox. They observe that a wire-change email claims to be internal but fails domain authentication. Evidence: email headers show SPF fail, DKIM none and a lookalike Reply-To domain. A separate known-good explanation is: legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of email headers show SPF fail, DKIM none and a lookalike Reply-To domain, without using inspect authentication results, Received hops and domain-registration history
- Perform a scoped investigation: inspect authentication results, Received hops and domain-registration history
- Suspend telemetry collection on finance executive mailbox while waiting for the connection pattern to stop
- Summarize email headers show SPF fail, DKIM none and a lookalike Reply-To domain into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
B:Inspect authentication results, Received hops and domain-registration history ties the evidence on finance executive mailbox to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of email headers show SPF fail, DKIM none and a lookalike Reply-To domain or whether the activity matches legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment.
C:Suppressing telemetry destroys the source needed to investigate business email compromise via sender impersonation and may conceal further actions.
D:The original email headers show SPF fail, DKIM none and a lookalike Reply-To domain must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
