CompTIA CS0-003 Practice Test 18
Question 170
At Legal services firm, analysts monitor finance executive mailbox. They observe that a wire-change email claims to be internal but fails domain authentication. Evidence: email headers show SPF fail, DKIM none and a lookalike Reply-To domain. A separate known-good explanation is: legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of email headers show SPF fail, DKIM none and a lookalike Reply-To domain, without using inspect authentication results, Received hops and domain-registration history
- Perform a scoped investigation: inspect authentication results, Received hops and domain-registration history
- Suspend telemetry collection on finance executive mailbox while waiting for the connection pattern to stop
- Summarize email headers show SPF fail, DKIM none and a lookalike Reply-To domain into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
B:Inspect authentication results, Received hops and domain-registration history ties the evidence on finance executive mailbox to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of email headers show SPF fail, DKIM none and a lookalike Reply-To domain or whether the activity matches legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment.
C:Suppressing telemetry destroys the source needed to investigate business email compromise via sender impersonation and may conceal further actions.
D:The original email headers show SPF fail, DKIM none and a lookalike Reply-To domain must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 171
Legal services firm has a candidate alert for finance executive mailbox: email headers show SPF fail, DKIM none and a lookalike Reply-To domain. The team argues it is harmless because legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that a wire-change email claims to be internal but fails domain authentication is benign
- Distinguish email headers show SPF fail, DKIM none and a lookalike Reply-To domain from the approved behavior (legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment) by validating process, identity and time attribution
- Create a blanket suppression for email headers show SPF fail, DKIM none and a lookalike Reply-To domain because legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment can produce a superficially similar event
- Automatically treat every event resembling email headers show SPF fail, DKIM none and a lookalike Reply-To domain as confirmed compromise of finance executive mailbox, without checking provenance
Explanation
Correct Answer
B:Legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment is a plausible alternative, but it must be proven to match the actual source of email headers show SPF fail, DKIM none and a lookalike Reply-To domain. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: a wire-change email claims to be internal but fails domain authentication.
C:Similarity to legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment does not exclude an attacker from producing the same surface event on finance executive mailbox.
D:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting escrow client funds.
Question 172
At Legal services firm, analysts monitor finance executive mailbox. They observe that a wire-change email claims to be internal but fails domain authentication. Evidence: email headers show SPF fail, DKIM none and a lookalike Reply-To domain. The team confirms unauthorized behavior and must protect escrow client funds; legitimate service continuity remains necessary. Which containment decision is best?
- Disable every production service at Legal services firm without measuring whether its dependencies share the observed malicious path
- Erase email headers show SPF fail, DKIM none and a lookalike Reply-To domain from the evidence archive during the containment change to reduce repeated alerts
- Apply targeted containment: hold the message and verify payment changes through an established independent callback
- Leave the confirmed unauthorized activity on finance executive mailbox unrestricted until actual losses of escrow client funds can be measured
Explanation
Correct Answer
C:Hold the message and verify payment changes through an established independent callback constrains the observed threat while maintaining necessary service for escrow client funds. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Global shutdown could disrupt escrow client funds without evidence that every system has been affected; scoped isolation is more proportionate.
B:Eliminating email headers show SPF fail, DKIM none and a lookalike Reply-To domain evidence does not contain business email compromise via sender impersonation and impairs forensic reconstruction.
D:Once unauthorized behavior is confirmed on finance executive mailbox, delaying containment could expand the exposure affecting escrow client funds.
Question 173
Legal services firm receives a three-month-old threat-intelligence bulletin associating an observable with business email compromise via sender impersonation. On finance executive mailbox, local telemetry reports: email headers show SPF fail, DKIM none and a lookalike Reply-To domain. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions business email compromise via sender impersonation, without checking whether its observable is present on finance executive mailbox
- Dismiss the bulletin solely because Legal services firm has not named the attacker associated with email headers show SPF fail, DKIM none and a lookalike Reply-To domain
- Forward the bulletin about business email compromise via sender impersonation as a confirmed breach of finance executive mailbox without hosts, timestamps or confidence caveats
- Assess bulletin timeliness and provenance, then corroborate its observables against email headers show SPF fail, DKIM none and a lookalike Reply-To domain and affected finance executive mailbox
Explanation
Correct Answer
D:An old feed with unknown confidence is not automatic proof of activity at Legal services firm. Comparing its timestamps and provenance with email headers show SPF fail, DKIM none and a lookalike Reply-To domain reveals whether the indicator is still relevant to finance executive mailbox and escrow client funds.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual email headers show SPF fail, DKIM none and a lookalike Reply-To domain.
B:Actor attribution is not required to assess a supported technique, source confidence or relevance to finance executive mailbox.
C:Converting the unverified feed into confirmed activity on finance executive mailbox may mislead investigators and prompt harmful response for escrow client funds.
Question 174
Legal services firm has investigated business email compromise via sender impersonation on finance executive mailbox. Detection operators report that legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on finance executive mailbox whether or not it matches correlate sender-alignment failures with new lookalike domains and payment-change language
- Automate service shutdown on the first simple match to a wire-change email claims to be internal but fails domain authentication, without validation or guardrails for escrow client funds
- Suppress every future event associated with email headers show SPF fail, DKIM none and a lookalike Reply-To domain, including events outside legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment
- Improve detection by requiring context-aware correlation: correlate sender-alignment failures with new lookalike domains and payment-change language
Explanation
Correct Answer
D:Correlate sender-alignment failures with new lookalike domains and payment-change language retains the specific threat signal while discriminating against legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing legitimate partner forwarders have pre-registered forwarding rules and signed sender alignment from malicious conditions would increase noise and operational workload.
B:An untested, unqualified automation could interrupt escrow client funds and cannot distinguish the benign workflow from attacker behavior.
C:Suppressing all monitoring would also hide a recurrence of business email compromise via sender impersonation, even where it threatens escrow client funds.
Question 175
At Community clinic, the security team assesses remote appointment portal. The current issue is outdated OpenSSL dependency with known vulnerability; assessment evidence states: SBOM shows vulnerable library and vulnerable TLS code path. The service is public internet with patient appointment sessions. Operational constraints: clinic cannot tolerate unplanned telehealth downtime. Which assessment approach is most appropriate before recommending a fix?
- Use an authorized, scoped validation approach that considers service sensitivity: confirm exact runtime loaded version and exploit prerequisites
- Accept the label outdated OpenSSL dependency with known vulnerability as confirmed without checking the reported evidence SBOM shows vulnerable library and vulnerable TLS code path or actual deployment
- Use only an anonymous outside-in scan of remote appointment portal even when public internet with patient appointment sessions requires authenticated deployment context
- Launch unapproved intrusive exploitation across remote appointment portal during clinic cannot tolerate unplanned telehealth downtime instead of using a scoped test
Explanation
Correct Answer
A:The evidence SBOM shows vulnerable library and vulnerable TLS code path must be evaluated without violating the constraint clinic cannot tolerate unplanned telehealth downtime. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
B:The finding does not establish which live component is affected or whether the exposure public internet with patient appointment sessions is real.
C:Asset configuration and the constraints of remote appointment portal matter; external findings alone may misstate or miss the exposed path.
D:Uncontrolled testing may breach service safety, especially because clinic cannot tolerate unplanned telehealth downtime; authorization and scope are prerequisites.
Question 176
At Community clinic, the security team assesses remote appointment portal. The current issue is outdated OpenSSL dependency with known vulnerability; assessment evidence states: SBOM shows vulnerable library and vulnerable TLS code path. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Confirm the reported condition in the relevant asset context: confirm exact runtime loaded version and exploit prerequisites
- Assume remote appointment portal is safe because another platform with similar software recently passed its own assessment
- Force a destructive proof-of-concept against remote appointment portal, ignoring that clinic cannot tolerate unplanned telehealth downtime and a safer validation exist
- Mark SBOM shows vulnerable library and vulnerable TLS code path resolved or confirmed solely from the scanner severity without confirm exact runtime loaded version and exploit prerequisites
Explanation
Correct Answer
A:Confirm exact runtime loaded version and exploit prerequisites tests the reported condition SBOM shows vulnerable library and vulnerable TLS code path against actual deployment context (public internet with patient appointment sessions). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
B:Security of an unrelated host cannot establish the state of remote appointment portal, whose reported issue is outdated OpenSSL dependency with known vulnerability.
C:A destructive proof is unnecessary when confirm exact runtime loaded version and exploit prerequisites can provide authorized evidence and clinic cannot tolerate unplanned telehealth downtime constrains production testing.
D:SBOM shows vulnerable library and vulnerable TLS code path may be accurate but its actual occurrence and configuration on remote appointment portal must be established before calling it validated.
Question 177
At Community clinic, the security team assesses remote appointment portal. The current issue is outdated OpenSSL dependency with known vulnerability; assessment evidence states: SBOM shows vulnerable library and vulnerable TLS code path. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Prioritize the confirmed exposure of remote appointment portal, accounting for patient data exposure and the real access path: public internet with patient appointment sessions
- Give every vulnerability the same deadline despite outdated OpenSSL dependency with known vulnerability and business impact on patient data exposure
- Choose whatever finding on remote appointment portal was logged most recently, regardless of actual exploit path or priority
- Choose the highest nominal scanner severity first while ignoring public internet with patient appointment sessions and the consequence to patient data exposure
Explanation
Correct Answer
A:Risk depends on practical reachability, threat activity and consequence. The issue outdated OpenSSL dependency with known vulnerability can affect patient data exposure through public internet with patient appointment sessions; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
B:Uniform priority ignores public internet with patient appointment sessions, operational harm and patient data exposure; documented context makes triage defensible.
C:Discovery order is not evidence of urgency compared with the actual affected remote appointment portal.
D:CVSS describes technical characteristics, not the entirety of exposure and patient data exposure for this deployment.
Question 178
At Community clinic, the security team assesses remote appointment portal. The current issue is outdated OpenSSL dependency with known vulnerability; assessment evidence states: SBOM shows vulnerable library and vulnerable TLS code path. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Implement and verify the root-cause fix: upgrade to supported fixed library then regression-test TLS
- Use restrict susceptible cipher or path as time-boxed control as permanent closure of the confirmed issue instead of deploying upgrade to supported fixed library then regression-test TLS
- Leave outdated OpenSSL dependency with known vulnerability present indefinitely because no incident involving patient data exposure was recorded this week
- Sign an exception document but do not implement or test upgrade to supported fixed library then regression-test TLS on remote appointment portal
Explanation
Correct Answer
A:Upgrade to supported fixed library then regression-test TLS targets the mechanism outdated OpenSSL dependency with known vulnerability rather than only filtering symptoms. Verification must account for SBOM shows vulnerable library and vulnerable TLS code path and continued protection of patient data exposure.
Incorrect Answers
B:The interim control may reduce exposure, but it can leave the underlying outdated OpenSSL dependency with known vulnerability and should be time-limited with verification and owner oversight.
C:No observed attack does not correct the verified condition SBOM shows vulnerable library and vulnerable TLS code path or eliminate its potential impact on patient data exposure.
D:Risk acceptance paperwork does not itself remediate outdated OpenSSL dependency with known vulnerability on remote appointment portal; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 179
At Community clinic, the security team assesses remote appointment portal. The current issue is outdated OpenSSL dependency with known vulnerability; assessment evidence states: SBOM shows vulnerable library and vulnerable TLS code path. A permanent correction cannot be deployed immediately because clinic cannot tolerate unplanned telehealth downtime. Which interim treatment is the safest governed option?
- Accept continued exposure of patient data exposure without any owner, expiry or compensating verification because clinic cannot tolerate unplanned telehealth downtime
- Claim outdated OpenSSL dependency with known vulnerability is patched when the change ticket opens, without confirming restrict susceptible cipher or path as time-boxed control or a planned permanent change
- Push upgrade to supported fixed library then regression-test TLS immediately to all production systems with no safe change window despite clinic cannot tolerate unplanned telehealth downtime
- Apply a time-bound compensating measure, restrict susceptible cipher or path as time-boxed control, record the residual risk owner and schedule the tested permanent fix
Explanation
Correct Answer
D:Restrict susceptible cipher or path as time-boxed control can reduce short-term exposure while clinic cannot tolerate unplanned telehealth downtime delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because patient data exposure remains at stake.
Incorrect Answers
A:Business criticality increases the need for accountable decisions and review; it does not make patient data exposure irrelevant.
B:A work item is not proof that outdated OpenSSL dependency with known vulnerability was corrected or even that restrict susceptible cipher or path as time-boxed control operates.
C:Ignoring clinic cannot tolerate unplanned telehealth downtime could cause avoidable service failure and is not a risk-aware remediation process.
Question 180
At Community clinic, the security team assesses remote appointment portal. The current issue is outdated OpenSSL dependency with known vulnerability; assessment evidence states: SBOM shows vulnerable library and vulnerable TLS code path. The owner reports that upgrade to supported fixed library then regression-test TLS has been deployed. What evidence should close the vulnerability item?
- Suppress future results for outdated OpenSSL dependency with known vulnerability so that the vulnerability dashboard shows a completed remediation
- Close SBOM shows vulnerable library and vulnerable TLS code path after the deployment tool returns success, without verifying the current state of remote appointment portal
- Use an unrelated server’s clean findings to claim remote appointment portal is fixed without retesting the affected path
- Retest the originally affected configuration using confirm exact runtime loaded version and exploit prerequisites, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by SBOM shows vulnerable library and vulnerable TLS code path, plus regression impact on remote appointment portal. A change ticket alone is not proof of removal of outdated OpenSSL dependency with known vulnerability.
Incorrect Answers
A:Suppression may hide a failed or incomplete fix, leaving patient data exposure exposed despite the administrative record.
B:Process completion is not evidence that SBOM shows vulnerable library and vulnerable TLS code path no longer applies to remote appointment portal.
C:The result must be tied to remote appointment portal and the actual exposure: public internet with patient appointment sessions.
