CompTIA CS0-003 Practice Test 2
Question 10
At Retail checkout, the security team assesses public payment API. The current issue is unparameterized SQL query in cart lookup; assessment evidence states: scanner sends a quote and receives SQL syntax errors in one parameter. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use temporary rate-limit and WAF rule only until code fix as permanent closure of the confirmed issue instead of deploying parameterized queries and least-privilege database role
- Leave unparameterized SQL query in cart lookup present indefinitely because no incident involving cardholder confidentiality was recorded this week
- Implement and verify the root-cause fix: parameterized queries and least-privilege database role
- Sign an exception document but do not implement or test parameterized queries and least-privilege database role on public payment API
Explanation
Correct Answer
C:Parameterized queries and least-privilege database role targets the mechanism unparameterized SQL query in cart lookup rather than only filtering symptoms. Verification must account for scanner sends a quote and receives SQL syntax errors in one parameter and continued protection of cardholder confidentiality.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying unparameterized SQL query in cart lookup and should be time-limited with verification and owner oversight.
B:No observed attack does not correct the verified condition scanner sends a quote and receives SQL syntax errors in one parameter or eliminate its potential impact on cardholder confidentiality.
D:Risk acceptance paperwork does not itself remediate unparameterized SQL query in cart lookup on public payment API; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 11
At Retail checkout, the security team assesses public payment API. The current issue is unparameterized SQL query in cart lookup; assessment evidence states: scanner sends a quote and receives SQL syntax errors in one parameter. A permanent correction cannot be deployed immediately because daily checkout peaks restrict deployment windows. Which interim treatment is the safest governed option?
- Accept continued exposure of cardholder confidentiality without any owner, expiry or compensating verification because daily checkout peaks restrict deployment windows
- Apply a time-bound compensating measure, temporary rate-limit and WAF rule only until code fix, record the residual risk owner and schedule the tested permanent fix
- Claim unparameterized SQL query in cart lookup is patched when the change ticket opens, without confirming temporary rate-limit and WAF rule only until code fix or a planned permanent change
- Push parameterized queries and least-privilege database role immediately to all production systems with no safe change window despite daily checkout peaks restrict deployment windows
Explanation
Correct Answer
B:Temporary rate-limit and WAF rule only until code fix can reduce short-term exposure while daily checkout peaks restrict deployment windows delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because cardholder confidentiality remains at stake.
Incorrect Answers
A:Business criticality increases the need for accountable decisions and review; it does not make cardholder confidentiality irrelevant.
C:A work item is not proof that unparameterized SQL query in cart lookup was corrected or even that temporary rate-limit and WAF rule only until code fix operates.
D:Ignoring daily checkout peaks restrict deployment windows could cause avoidable service failure and is not a risk-aware remediation process.
Question 12
At Retail checkout, the security team assesses public payment API. The current issue is unparameterized SQL query in cart lookup; assessment evidence states: scanner sends a quote and receives SQL syntax errors in one parameter. The owner reports that parameterized queries and least-privilege database role has been deployed. What evidence should close the vulnerability item?
- Close scanner sends a quote and receives SQL syntax errors in one parameter after the deployment tool returns success, without verifying the current state of public payment API
- Use an unrelated server’s clean findings to claim public payment API is fixed without retesting the affected path
- Suppress future results for unparameterized SQL query in cart lookup so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using confirm using authorized non-destructive parameter probes and query tracing, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by scanner sends a quote and receives SQL syntax errors in one parameter, plus regression impact on public payment API. A change ticket alone is not proof of removal of unparameterized SQL query in cart lookup.
Incorrect Answers
A:Process completion is not evidence that scanner sends a quote and receives SQL syntax errors in one parameter no longer applies to public payment API.
B:The result must be tied to public payment API and the actual exposure: internet-facing with cardholder account access.
C:Suppression may hide a failed or incomplete fix, leaving cardholder confidentiality exposed despite the administrative record.
Question 13
At Regional health network, analysts apply the Diamond Model to reports concerning imaging archive: ransomware encryption begins on two file servers after a suspicious remote-service login. Evidence includes EDR records mass file renames and shadow-copy deletion in same session, but no adversary has been reliably identified. Which representation preserves the observed relationships without invented attribution?
- Assign a specific nation-state to ransomware encryption begins on two file servers after a suspicious remote-service login and consider all other Diamond Model elements established automatically
- Record imaging archive as the observed victim, the technical action as the capability, any infrastructure evidenced by EDR records mass file renames and shadow-copy deletion in same session, and adversary identity as unknown
- Treat imaging archive as the attacker infrastructure and an unnamed public target as the only victim without analyzing the actual incident path
- Use the Diamond Model name as permission to delete raw EDR records mass file renames and shadow-copy deletion in same session and replace it with a presumed actor narrative
Explanation
Correct Answer
B:The Diamond Model separates victim, capability, infrastructure and adversary. The logs support observed behavior at imaging archive but do not establish a named adversary.
Incorrect Answers
A:Neither EDR records mass file renames and shadow-copy deletion in same session nor event type identifies a particular actor; attribution requires additional independent intelligence.
C:The provided evidence names imaging archive as the affected environment. Reversing roles obscures which entity is actually being victimized.
D:Modeling relates evidence; it does not replace source preservation or justify inventing a history of ransomware encryption begins on two file servers after a suspicious remote-service login.
Question 14
At Regional health network, the incident team supports imaging archive. A new security event is reported: ransomware encryption begins on two file servers after a suspicious remote-service login. The log clue is: EDR records mass file renames and shadow-copy deletion in same session. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Keep only a screenshot of EDR records mass file renames and shadow-copy deletion in same session, discarding original artifacts such as forensic memory and disk snapshots with recorded hashes
- Rebuild imaging archive first and collect the volatile evidence for ransomware encryption begins on two file servers after a suspicious remote-service login afterward
- Alter original EDR records mass file renames and shadow-copy deletion in same session entries to remove irrelevant records before preserving the forensic timeline
- Preserve and hash incident artifacts: forensic memory and disk snapshots with recorded hashes
Explanation
Correct Answer
D:Forensic memory and disk snapshots with recorded hashes retains relevant source context and integrity checks so the team can reconstruct ransomware encryption begins on two file servers after a suspicious remote-service login and support an auditable chain of custody.
Incorrect Answers
A:A screenshot cannot replace the underlying forensic memory and disk snapshots with recorded hashes needed to establish sequence and integrity.
B:Volatile evidence relevant to ransomware encryption begins on two file servers after a suspicious remote-service login may disappear during remediation or reboot.
C:Changing the original EDR records mass file renames and shadow-copy deletion in same session compromises provenance and makes later findings harder to verify.
Question 15
At Regional health network, the incident team supports imaging archive. A new security event is reported: ransomware encryption begins on two file servers after a suspicious remote-service login. The log clue is: EDR records mass file renames and shadow-copy deletion in same session. The incident remains active, but imaging archive is operationally important. Which containment decision is most appropriate now?
- Disconnect every service at Regional health network, regardless of whether it has a dependency on the affected imaging archive
- Execute scoped containment: isolate impacted storage paths while keeping emergency read-only images available
- Publish a speculative full-incident attribution notice before constraining the active behavior ransomware encryption begins on two file servers after a suspicious remote-service login
- Erase EDR records mass file renames and shadow-copy deletion in same session to reduce alert volume rather than isolating the observed attacker route
Explanation
Correct Answer
B:Isolate impacted storage paths while keeping emergency read-only images available stops or limits the observed path while balancing continuity of imaging archive. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Broad interruption may unnecessarily affect imaging archive; containment should be scoped to evidenced systems and approved critical-service requirements.
C:Communication matters, but active ransomware encryption begins on two file servers after a suspicious remote-service login requires proportionate containment and evidence preservation first.
D:Erasing EDR records mass file renames and shadow-copy deletion in same session neither blocks attacker access nor supports a reliable subsequent recovery decision.
Question 16
At Regional health network, the incident team supports imaging archive. A new security event is reported: ransomware encryption begins on two file servers after a suspicious remote-service login. The log clue is: EDR records mass file renames and shadow-copy deletion in same session. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Use only the original firewall block and assume it has also removed all persistence behind ransomware encryption begins on two file servers after a suspicious remote-service login
- Remove the attack’s established access and persistence: remove malicious binaries, reset exploited service credentials and close the remote access gap
- Restore imaging archive without first correcting the access and persistence cause addressed by remove malicious binaries, reset exploited service credentials and close the remote access gap
- Rewrite the playbook for imaging archive but leave the confirmed malicious access mechanism active
Explanation
Correct Answer
B:Remove malicious binaries, reset exploited service credentials and close the remote access gap targets the mechanism behind ransomware encryption begins on two file servers after a suspicious remote-service login, reducing recurrence when imaging archive returns to normal operations.
Incorrect Answers
A:Containment can stop communication without eliminating the root access that produced EDR records mass file renames and shadow-copy deletion in same session.
C:Recovery before remove malicious binaries, reset exploited service credentials and close the remote access gap could reintroduce the same compromise path.
D:Updated paperwork does not eradicate the mechanism behind ransomware encryption begins on two file servers after a suspicious remote-service login.
Question 17
At Regional health network, the incident team supports imaging archive. A new security event is reported: ransomware encryption begins on two file servers after a suspicious remote-service login. The log clue is: EDR records mass file renames and shadow-copy deletion in same session. Containment and eradication are complete. Which recovery acceptance test should precede release of imaging archive to normal users?
- Expose imaging archive to users before confirming that the conditions behind ransomware encryption begins on two file servers after a suspicious remote-service login are absent
- Approve recovery of imaging archive when it boots, without executing the test restore from immutable backups, test file integrity and clinical access in a quarantine environment
- Perform controlled return-to-service validation: restore from immutable backups, test file integrity and clinical access in a quarantine environment
- Delete preserved evidence including forensic memory and disk snapshots with recorded hashes as soon as the service restarts
Explanation
Correct Answer
C:Restore from immutable backups, test file integrity and clinical access in a quarantine environment demonstrates that the compromised pathway is absent while imaging archive again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, imaging archive could immediately face the same exploit condition.
B:A boot event cannot prove restore from immutable backups, test file integrity and clinical access in a quarantine environment or protect the service from recurrence of ransomware encryption begins on two file servers after a suspicious remote-service login.
D:Evidence retention obligations continue beyond restart; forensic memory and disk snapshots with recorded hashes may be required for subsequent review.
Question 18
At Regional health network, the incident team supports imaging archive. A new security event is reported: ransomware encryption begins on two file servers after a suspicious remote-service login. The log clue is: EDR records mass file renames and shadow-copy deletion in same session. The incident has been contained and normal service has resumed. A post-incident review identifies that unrestricted vendor support session allowed privileged lateral access. Which improvement should be prioritized?
- Discipline the whole on-duty response shift rather than examining the documented weakness unrestricted vendor support session allowed privileged lateral access
- Assign an owner and measurable corrective action addressing the root cause: unrestricted vendor support session allowed privileged lateral access, with a future effectiveness test
- Close the follow-up for imaging archive merely because restoration completed, without addressing unrestricted vendor support session allowed privileged lateral access
- Write a lessons-learned memo about ransomware encryption begins on two file servers after a suspicious remote-service login with no due date, control owner or validation activity
Explanation
Correct Answer
B:Unrestricted vendor support session allowed privileged lateral access was the systemic weakness that enabled or worsened ransomware encryption begins on two file servers after a suspicious remote-service login. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:A personnel-only response lacks support from the documented root cause: unrestricted vendor support session allowed privileged lateral access.
C:Service restoration does not address unrestricted vendor support session allowed privileged lateral access; ignoring it leaves the next incident likely to follow the same route.
D:An unowned recommendation does not produce a verified control improvement for imaging archive.
Question 19
National retail bank is reviewing a security finding affecting internet VPN endpoints: critical exposed gateway vulnerabilities with missed remediation dates. The current reporting problem is that executive dashboard lists only total vulnerability count. What information should be delivered first to decision makers responsible for internet-reachable remote access could enable unauthorized account access?
- Report only the number of tickets closed for internet VPN endpoints, concealing the unresolved exposure from critical exposed gateway vulnerabilities with missed remediation dates
- State that critical exposed gateway vulnerabilities with missed remediation dates was eliminated because National retail bank distributed a dashboard on schedule
- Forward raw telemetry from validated asset exposure, vendor advisory and patch completion evidence to executives without summarizing consequences for internet-reachable remote access could enable unauthorized account access
- Present a concise, evidence-qualified risk and impact summary based on validated asset exposure, vendor advisory and patch completion evidence, with decisions and uncertainty stated
Explanation
Correct Answer
D:Validated asset exposure, vendor advisory and patch completion evidence supports a decision-oriented picture of internet-reachable remote access could enable unauthorized account access while separating confirmed facts from unknowns. This corrects the reporting defect: executive dashboard lists only total vulnerability count.
Incorrect Answers
A:Ticket counts do not establish whether critical exposed gateway vulnerabilities with missed remediation dates still threatens internet-reachable remote access could enable unauthorized account access.
B:Reporting timeliness is not evidence that validated asset exposure, vendor advisory and patch completion evidence shows full risk elimination.
C:Raw telemetry may support analysts, but decision makers need the meaning for internet-reachable remote access could enable unauthorized account access and accountable options.
Question 20
National retail bank is reviewing a security finding affecting internet VPN endpoints: critical exposed gateway vulnerabilities with missed remediation dates. The current reporting problem is that executive dashboard lists only total vulnerability count. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Accept an assertion that network service owner completed the correction with no retest against validated asset exposure, vendor advisory and patch completion evidence
- Give network service owner the same board overview rather than the reproducible records from validated asset exposure, vendor advisory and patch completion evidence
- Provide the original relevant artifacts and validation method from validated asset exposure, vendor advisory and patch completion evidence, tied to affected assets, owners and retest criteria
- Remove the timestamps and correlations from validated asset exposure, vendor advisory and patch completion evidence so the technical report occupies fewer pages
Explanation
Correct Answer
C:Validated asset exposure, vendor advisory and patch completion evidence gives engineers traceable scope and a basis for confirming that network service owner has resolved the identified exposure on internet VPN endpoints.
Incorrect Answers
A:Self-assessment without test artifacts is weaker than verifiable validated asset exposure, vendor advisory and patch completion evidence and agreed acceptance conditions.
B:A high-level board summary cannot identify the concrete validated asset exposure, vendor advisory and patch completion evidence fields needed for technical validation.
D:Such edits break reproducibility of critical exposed gateway vulnerabilities with missed remediation dates and make scope or remediation errors harder to find.
