CompTIA CS0-003 Practice Test 19
Question 180
At Community clinic, the security team assesses remote appointment portal. The current issue is outdated OpenSSL dependency with known vulnerability; assessment evidence states: SBOM shows vulnerable library and vulnerable TLS code path. The owner reports that upgrade to supported fixed library then regression-test TLS has been deployed. What evidence should close the vulnerability item?
- Suppress future results for outdated OpenSSL dependency with known vulnerability so that the vulnerability dashboard shows a completed remediation
- Close SBOM shows vulnerable library and vulnerable TLS code path after the deployment tool returns success, without verifying the current state of remote appointment portal
- Use an unrelated server’s clean findings to claim remote appointment portal is fixed without retesting the affected path
- Retest the originally affected configuration using confirm exact runtime loaded version and exploit prerequisites, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by SBOM shows vulnerable library and vulnerable TLS code path, plus regression impact on remote appointment portal. A change ticket alone is not proof of removal of outdated OpenSSL dependency with known vulnerability.
Incorrect Answers
A:Suppression may hide a failed or incomplete fix, leaving patient data exposure exposed despite the administrative record.
B:Process completion is not evidence that SBOM shows vulnerable library and vulnerable TLS code path no longer applies to remote appointment portal.
C:The result must be tied to remote appointment portal and the actual exposure: public internet with patient appointment sessions.
Question 181
At Municipal water utility, the incident team supports SCADA historian. A new security event is reported: an unapproved engineering laptop starts sending new commands toward a controller. The log clue is: OT sensor reports repeated write requests from an unknown service port. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Assign a final attack-chain stage to SCADA historian without confirming what behavior actually occurred in OT sensor reports repeated write requests from an unknown service port
- Treat an ATT&CK label for an unapproved engineering laptop starts sending new commands toward a controller as a complete recovery instruction without checking evidence or impact
- Map the observed behavior in OT sensor reports repeated write requests from an unknown service port to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Attribute an unapproved engineering laptop starts sending new commands toward a controller to a named foreign intelligence service using only OT sensor reports repeated write requests from an unknown service port
Explanation
Correct Answer
C:An unapproved engineering laptop starts sending new commands toward a controller and OT sensor reports repeated write requests from an unknown service port support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:Attack frameworks describe observable stages and techniques; the OT sensor reports repeated write requests from an unknown service port must substantiate whichever stage is assigned.
B:A taxonomy is not an incident response plan for SCADA historian; scope and safety constraints still matter.
D:Neither an unapproved engineering laptop starts sending new commands toward a controller nor OT sensor reports repeated write requests from an unknown service port establishes uniquely identifying actor evidence.
Question 182
At Municipal water utility, the incident team supports SCADA historian. A new security event is reported: an unapproved engineering laptop starts sending new commands toward a controller. The log clue is: OT sensor reports repeated write requests from an unknown service port. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Rebuild SCADA historian first and collect the volatile evidence for an unapproved engineering laptop starts sending new commands toward a controller afterward
- Keep only a screenshot of OT sensor reports repeated write requests from an unknown service port, discarding original artifacts such as passive packet metadata, historian logs and approved engineering change sheets
- Alter original OT sensor reports repeated write requests from an unknown service port entries to remove irrelevant records before preserving the forensic timeline
- Preserve and hash incident artifacts: passive packet metadata, historian logs and approved engineering change sheets
Explanation
Correct Answer
D:Passive packet metadata, historian logs and approved engineering change sheets retains relevant source context and integrity checks so the team can reconstruct an unapproved engineering laptop starts sending new commands toward a controller and support an auditable chain of custody.
Incorrect Answers
A:Volatile evidence relevant to an unapproved engineering laptop starts sending new commands toward a controller may disappear during remediation or reboot.
B:A screenshot cannot replace the underlying passive packet metadata, historian logs and approved engineering change sheets needed to establish sequence and integrity.
C:Changing the original OT sensor reports repeated write requests from an unknown service port compromises provenance and makes later findings harder to verify.
Question 183
At Municipal water utility, the incident team supports SCADA historian. A new security event is reported: an unapproved engineering laptop starts sending new commands toward a controller. The log clue is: OT sensor reports repeated write requests from an unknown service port. The incident remains active, but SCADA historian is operationally important. Which containment decision is most appropriate now?
- Execute scoped containment: block unapproved command path with plant operator coordination, avoiding unsafe PLC power-down
- Erase OT sensor reports repeated write requests from an unknown service port to reduce alert volume rather than isolating the observed attacker route
- Publish a speculative full-incident attribution notice before constraining the active behavior an unapproved engineering laptop starts sending new commands toward a controller
- Disconnect every service at Municipal water utility, regardless of whether it has a dependency on the affected SCADA historian
Explanation
Correct Answer
A:Block unapproved command path with plant operator coordination, avoiding unsafe PLC power-down stops or limits the observed path while balancing continuity of SCADA historian. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
B:Erasing OT sensor reports repeated write requests from an unknown service port neither blocks attacker access nor supports a reliable subsequent recovery decision.
C:Communication matters, but active an unapproved engineering laptop starts sending new commands toward a controller requires proportionate containment and evidence preservation first.
D:Broad interruption may unnecessarily affect SCADA historian; containment should be scoped to evidenced systems and approved critical-service requirements.
Question 184
At Municipal water utility, the incident team supports SCADA historian. A new security event is reported: an unapproved engineering laptop starts sending new commands toward a controller. The log clue is: OT sensor reports repeated write requests from an unknown service port. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Use only the original firewall block and assume it has also removed all persistence behind an unapproved engineering laptop starts sending new commands toward a controller
- Restore SCADA historian without first correcting the access and persistence cause addressed by remove rogue engineering credentials and restore documented controller access allowlists
- Remove the attack’s established access and persistence: remove rogue engineering credentials and restore documented controller access allowlists
- Rewrite the playbook for SCADA historian but leave the confirmed malicious access mechanism active
Explanation
Correct Answer
C:Remove rogue engineering credentials and restore documented controller access allowlists targets the mechanism behind an unapproved engineering laptop starts sending new commands toward a controller, reducing recurrence when SCADA historian returns to normal operations.
Incorrect Answers
A:Containment can stop communication without eliminating the root access that produced OT sensor reports repeated write requests from an unknown service port.
B:Recovery before remove rogue engineering credentials and restore documented controller access allowlists could reintroduce the same compromise path.
D:Updated paperwork does not eradicate the mechanism behind an unapproved engineering laptop starts sending new commands toward a controller.
Question 185
At Municipal water utility, the incident team supports SCADA historian. A new security event is reported: an unapproved engineering laptop starts sending new commands toward a controller. The log clue is: OT sensor reports repeated write requests from an unknown service port. Containment and eradication are complete. Which recovery acceptance test should precede release of SCADA historian to normal users?
- Expose SCADA historian to users before confirming that the conditions behind an unapproved engineering laptop starts sending new commands toward a controller are absent
- Perform controlled return-to-service validation: replay authorized historian reads and verify water treatment setpoints under plant supervision
- Delete preserved evidence including passive packet metadata, historian logs and approved engineering change sheets as soon as the service restarts
- Approve recovery of SCADA historian when it boots, without executing the test replay authorized historian reads and verify water treatment setpoints under plant supervision
Explanation
Correct Answer
B:Replay authorized historian reads and verify water treatment setpoints under plant supervision demonstrates that the compromised pathway is absent while SCADA historian again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, SCADA historian could immediately face the same exploit condition.
C:Evidence retention obligations continue beyond restart; passive packet metadata, historian logs and approved engineering change sheets may be required for subsequent review.
D:A boot event cannot prove replay authorized historian reads and verify water treatment setpoints under plant supervision or protect the service from recurrence of an unapproved engineering laptop starts sending new commands toward a controller.
Question 186
At Municipal water utility, the incident team supports SCADA historian. A new security event is reported: an unapproved engineering laptop starts sending new commands toward a controller. The log clue is: OT sensor reports repeated write requests from an unknown service port. The incident has been contained and normal service has resumed. A post-incident review identifies that remote vendor maintenance tunnel was left active without change record. Which improvement should be prioritized?
- Close the follow-up for SCADA historian merely because restoration completed, without addressing remote vendor maintenance tunnel was left active without change record
- Discipline the whole on-duty response shift rather than examining the documented weakness remote vendor maintenance tunnel was left active without change record
- Assign an owner and measurable corrective action addressing the root cause: remote vendor maintenance tunnel was left active without change record, with a future effectiveness test
- Write a lessons-learned memo about an unapproved engineering laptop starts sending new commands toward a controller with no due date, control owner or validation activity
Explanation
Correct Answer
C:Remote vendor maintenance tunnel was left active without change record was the systemic weakness that enabled or worsened an unapproved engineering laptop starts sending new commands toward a controller. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:Service restoration does not address remote vendor maintenance tunnel was left active without change record; ignoring it leaves the next incident likely to follow the same route.
B:A personnel-only response lacks support from the documented root cause: remote vendor maintenance tunnel was left active without change record.
D:An unowned recommendation does not produce a verified control improvement for SCADA historian.
Question 187
Travel booking provider is reviewing a security finding affecting reservation application: unauthorized access incident containment lasted eight hours. The current reporting problem is that report uses alert count as incident response success measure. What information should be delivered first to decision makers responsible for mean time to detect and contain represent actual response speed?
- Present a concise, evidence-qualified risk and impact summary based on first detection, declaration, isolation and restoration timestamps, with decisions and uncertainty stated
- State that unauthorized access incident containment lasted eight hours was eliminated because Travel booking provider distributed a dashboard on schedule
- Forward raw telemetry from first detection, declaration, isolation and restoration timestamps to executives without summarizing consequences for mean time to detect and contain represent actual response speed
- Report only the number of tickets closed for reservation application, concealing the unresolved exposure from unauthorized access incident containment lasted eight hours
Explanation
Correct Answer
A:First detection, declaration, isolation and restoration timestamps supports a decision-oriented picture of mean time to detect and contain represent actual response speed while separating confirmed facts from unknowns. This corrects the reporting defect: report uses alert count as incident response success measure.
Incorrect Answers
B:Reporting timeliness is not evidence that first detection, declaration, isolation and restoration timestamps shows full risk elimination.
C:Raw telemetry may support analysts, but decision makers need the meaning for mean time to detect and contain represent actual response speed and accountable options.
D:Ticket counts do not establish whether unauthorized access incident containment lasted eight hours still threatens mean time to detect and contain represent actual response speed.
Question 188
Travel booking provider is reviewing a security finding affecting reservation application: unauthorized access incident containment lasted eight hours. The current reporting problem is that report uses alert count as incident response success measure. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Give SOC incident metrics owner the same board overview rather than the reproducible records from first detection, declaration, isolation and restoration timestamps
- Provide the original relevant artifacts and validation method from first detection, declaration, isolation and restoration timestamps, tied to affected assets, owners and retest criteria
- Remove the timestamps and correlations from first detection, declaration, isolation and restoration timestamps so the technical report occupies fewer pages
- Accept an assertion that SOC incident metrics owner completed the correction with no retest against first detection, declaration, isolation and restoration timestamps
Explanation
Correct Answer
B:First detection, declaration, isolation and restoration timestamps gives engineers traceable scope and a basis for confirming that SOC incident metrics owner has resolved the identified exposure on reservation application.
Incorrect Answers
A:A high-level board summary cannot identify the concrete first detection, declaration, isolation and restoration timestamps fields needed for technical validation.
C:Such edits break reproducibility of unauthorized access incident containment lasted eight hours and make scope or remediation errors harder to find.
D:Self-assessment without test artifacts is weaker than verifiable first detection, declaration, isolation and restoration timestamps and agreed acceptance conditions.
Question 189
Travel booking provider is reviewing a security finding affecting reservation application: unauthorized access incident containment lasted eight hours. The current reporting problem is that report uses alert count as incident response success measure. Stakeholders include executive operations and SOC manager. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Release unconfirmed details about unauthorized access incident containment lasted eight hours externally before evidence and approvals from executive operations and SOC manager have been reconciled
- Coordinate fact-checked messages, recipients and timing with executive operations and SOC manager, preserving applicable legal and incident approval paths
- Withhold notification of unauthorized access incident containment lasted eight hours indefinitely even after verified first detection, declaration, isolation and restoration timestamps meets a binding disclosure threshold
- Give a technical engineer sole authority for every legal or public statement otherwise owned by executive operations and SOC manager
Explanation
Correct Answer
B:The parties executive operations and SOC manager have different responsibilities. Using verified first detection, declaration, isolation and restoration timestamps and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
A:Unconfirmed claims could misrepresent the impact of unauthorized access incident containment lasted eight hours and breach communication obligations.
C:If verified first detection, declaration, isolation and restoration timestamps triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
D:Technical diagnosis does not automatically confer the disclosure authority held by executive operations and SOC manager.
Question 190
Travel booking provider is reviewing a security finding affecting reservation application: unauthorized access incident containment lasted eight hours. The current reporting problem is that report uses alert count as incident response success measure. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Measure improvement in normalized detection/containment intervals and trend by how many slides were added to the board presentation
- Track a defined, evidence-based measure of normalized detection/containment intervals and trend, with trend, scope and accountable source
- Compare Travel booking provider teams only by tickets closed, ignoring which services are still exposed to unauthorized access incident containment lasted eight hours
- Redefine normalized detection/containment intervals and trend every week until all dashboards appear positive
Explanation
Correct Answer
B:The measure normalized detection/containment intervals and trend connects reporting to a change in mean time to detect and contain represent actual response speed, rather than the number of reports or raw alert volume. Trends must use consistent inputs from first detection, declaration, isolation and restoration timestamps.
Incorrect Answers
A:Presentation size does not establish normalized detection/containment intervals and trend or whether unauthorized access incident containment lasted eight hours is managed.
C:Tickets can hide unresolved mean time to detect and contain represent actual response speed; a risk-weighted outcome metric is needed.
D:Inconsistent measures cannot support a credible trend for normalized detection/containment intervals and trend.
