CompTIA CS0-003 Practice Test 20
Question 190
Travel booking provider is reviewing a security finding affecting reservation application: unauthorized access incident containment lasted eight hours. The current reporting problem is that report uses alert count as incident response success measure. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Measure improvement in normalized detection/containment intervals and trend by how many slides were added to the board presentation
- Track a defined, evidence-based measure of normalized detection/containment intervals and trend, with trend, scope and accountable source
- Compare Travel booking provider teams only by tickets closed, ignoring which services are still exposed to unauthorized access incident containment lasted eight hours
- Redefine normalized detection/containment intervals and trend every week until all dashboards appear positive
Explanation
Correct Answer
B:The measure normalized detection/containment intervals and trend connects reporting to a change in mean time to detect and contain represent actual response speed, rather than the number of reports or raw alert volume. Trends must use consistent inputs from first detection, declaration, isolation and restoration timestamps.
Incorrect Answers
A:Presentation size does not establish normalized detection/containment intervals and trend or whether unauthorized access incident containment lasted eight hours is managed.
C:Tickets can hide unresolved mean time to detect and contain represent actual response speed; a risk-weighted outcome metric is needed.
D:Inconsistent measures cannot support a credible trend for normalized detection/containment intervals and trend.
Question 191
Travel booking provider is reviewing a security finding affecting reservation application: unauthorized access incident containment lasted eight hours. The current reporting problem is that report uses alert count as incident response success measure. An action plan is being negotiated, but timestamps differ across logging systems. What reporting recommendation best supports practical remediation?
- Ask the SOC incident metrics owner to document mitigation choices for reservation application, service constraints, milestones, approvers and time-bound risk acceptance if needed
- Copy a generic checklist for unauthorized access incident containment lasted eight hours without accountable owners, asset scope or milestones
- Set an immediate fix deadline for reservation application without acknowledging that timestamps differ across logging systems
- Give SOC incident metrics owner an unlimited exception because timestamps differ across logging systems rather than reporting residual risk and expiry
Explanation
Correct Answer
A:Timestamps differ across logging systems creates a real implementation constraint. A plan owned by SOC incident metrics owner with measured risk and delegated approvals protects mean time to detect and contain represent actual response speed better than an unrealistic generic deadline.
Incorrect Answers
B:A non-accountable template cannot address timestamps differ across logging systems or demonstrate progress on unauthorized access incident containment lasted eight hours.
C:Ignoring timestamps differ across logging systems can turn a security fix into service disruption while failing to clarify remaining risk.
D:Mean time to detect and contain represent actual response speed still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
Question 192
Travel booking provider is reviewing a security finding affecting reservation application: unauthorized access incident containment lasted eight hours. The current reporting problem is that report uses alert count as incident response success measure. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Discard the pre-change evidence first detection, declaration, isolation and restoration timestamps so that only the improved numbers for normalized detection/containment intervals and trend remain
- Use the number of remediation meetings at Travel booking provider instead of observed change in normalized detection/containment intervals and trend as closeout proof
- Report retested first detection, declaration, isolation and restoration timestamps, the outcome against normalized detection/containment intervals and trend, remaining exceptions, and owner confirmation
- Close unauthorized access incident containment lasted eight hours based solely on a self-reported completion email from SOC incident metrics owner with no verification
Explanation
Correct Answer
C:First detection, declaration, isolation and restoration timestamps provides source-linked closure proof. Showing normalized detection/containment intervals and trend and residual exceptions verifies whether SOC incident metrics owner actually reduced mean time to detect and contain represent actual response speed rather than merely marking a ticket closed.
Incorrect Answers
A:Without historical normalized detection/containment intervals and trend inputs, leaders cannot validate the claimed improvement or identify recurrence.
B:Meetings do not confirm that unauthorized access incident containment lasted eight hours was corrected or that remaining mean time to detect and contain represent actual response speed is acceptable.
D:Self-declared completion does not demonstrate improved normalized detection/containment intervals and trend against documented first detection, declaration, isolation and restoration timestamps.
Question 193
At Food distributor, analysts monitor warehouse receiving desktop. They observe that a spreadsheet macro launches wscript and a hidden network download. Evidence: Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Downgrade a spreadsheet macro launches wscript and a hidden network download solely because the same symptom has not yet appeared on another endpoint
- Announce that Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL conclusively proves theft of replenishment workflow before reviewing any sessions or file access
- Treat approved spreadsheet automation runs within a signed workbook without spawning interpreters as conclusive authorization for the current event without matching process or identity
- Treat the pattern as a hypothesis of malicious document attachment leading to staged payload execution and begin corroborating it with endpoint and network evidence
Explanation
Correct Answer
D:The combination of a spreadsheet macro launches wscript and a hidden network download and Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL is suspicious for malicious document attachment leading to staged payload execution. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting replenishment workflow.
Incorrect Answers
A:An intrusion can begin on one asset. The specific indicator on warehouse receiving desktop warrants its own validation before expanding or closing the investigation.
B:Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
C:The legitimate comparator is approved spreadsheet automation runs within a signed workbook without spawning interpreters; it does not establish that the current event came from the same approved identity or workflow.
Question 194
At Food distributor, analysts monitor warehouse receiving desktop. They observe that a spreadsheet macro launches wscript and a hidden network download. Evidence: Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL. A separate known-good explanation is: approved spreadsheet automation runs within a signed workbook without spawning interpreters. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL, without using inspect isolated macro strings and the child process's download destination
- Perform a scoped investigation: inspect isolated macro strings and the child process's download destination
- Summarize Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on warehouse receiving desktop while waiting for the connection pattern to stop
Explanation
Correct Answer
B:Inspect isolated macro strings and the child process's download destination ties the evidence on warehouse receiving desktop to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved spreadsheet automation runs within a signed workbook without spawning interpreters.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL or whether the activity matches approved spreadsheet automation runs within a signed workbook without spawning interpreters.
C:The original Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:Suppressing telemetry destroys the source needed to investigate malicious document attachment leading to staged payload execution and may conceal further actions.
Question 195
Food distributor has a candidate alert for warehouse receiving desktop: Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL. The team argues it is harmless because approved spreadsheet automation runs within a signed workbook without spawning interpreters. What is the most defensible false-positive assessment?
- Automatically treat every event resembling Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL as confirmed compromise of warehouse receiving desktop, without checking provenance
- Create a blanket suppression for Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL because approved spreadsheet automation runs within a signed workbook without spawning interpreters can produce a superficially similar event
- Distinguish Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL from the approved behavior (approved spreadsheet automation runs within a signed workbook without spawning interpreters) by validating process, identity and time attribution
- Interpret an absence of existing vendor signatures as proof that a spreadsheet macro launches wscript and a hidden network download is benign
Explanation
Correct Answer
C:Approved spreadsheet automation runs within a signed workbook without spawning interpreters is a plausible alternative, but it must be proven to match the actual source of Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting replenishment workflow.
B:Similarity to approved spreadsheet automation runs within a signed workbook without spawning interpreters does not exclude an attacker from producing the same surface event on warehouse receiving desktop.
D:Absence of a signature does not refute the concrete behavior: a spreadsheet macro launches wscript and a hidden network download.
Question 196
At Food distributor, analysts monitor warehouse receiving desktop. They observe that a spreadsheet macro launches wscript and a hidden network download. Evidence: Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL. The team confirms unauthorized behavior and must protect replenishment workflow; legitimate service continuity remains necessary. Which containment decision is best?
- Erase Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL from the evidence archive during the containment change to reduce repeated alerts
- Disable every production service at Food distributor without measuring whether its dependencies share the observed malicious path
- Leave the confirmed unauthorized activity on warehouse receiving desktop unrestricted until actual losses of replenishment workflow can be measured
- Apply targeted containment: remove the receiving desktop from outbound access and activate manual receiving procedures
Explanation
Correct Answer
D:Remove the receiving desktop from outbound access and activate manual receiving procedures constrains the observed threat while maintaining necessary service for replenishment workflow. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Eliminating Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL evidence does not contain malicious document attachment leading to staged payload execution and impairs forensic reconstruction.
B:Global shutdown could disrupt replenishment workflow without evidence that every system has been affected; scoped isolation is more proportionate.
C:Once unauthorized behavior is confirmed on warehouse receiving desktop, delaying containment could expand the exposure affecting replenishment workflow.
Question 197
Food distributor has correlated an alert involving warehouse receiving desktop; the key observation is Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL. Another security organization requests a defensible, privacy-conscious indicator package to hunt for similar behavior. What should be shared?
- Share all raw replenishment workflow records to prove the alert is important before stripping unnecessary personal or protected content
- Send only the statement that malicious document attachment leading to staged payload execution exists with no indicator, observation time or confidence
- Share the validated technical observables and conditions from pivot on workbook hash and script child-process command lines, with timing, confidence, classification and minimal sensitive data
- Declare every system using warehouse receiving desktop technology compromised without proof beyond the single observation
Explanation
Correct Answer
C:Pivot on workbook hash and script child-process command lines describes how other defenders can test the observation. Time, confidence and privacy handling preserve investigative value without disclosing unrelated replenishment workflow data.
Incorrect Answers
A:Sharing investigative indicators does not authorize exposing replenishment workflow; minimize records and follow approved intelligence-sharing rules.
B:A generic threat label cannot help a partner correlate Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL to its own assets or distinguish it from routine activity.
D:The single finding Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL on warehouse receiving desktop does not prove the same activity across organizations; share enough context for each partner to validate it.
Question 198
Food distributor has investigated malicious document attachment leading to staged payload execution on warehouse receiving desktop. Detection operators report that approved spreadsheet automation runs within a signed workbook without spawning interpreters; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on warehouse receiving desktop whether or not it matches flag office-to-script interpreters coupled with downloads, excluding approved signed automation
- Improve detection by requiring context-aware correlation: flag office-to-script interpreters coupled with downloads, excluding approved signed automation
- Automate service shutdown on the first simple match to a spreadsheet macro launches wscript and a hidden network download, without validation or guardrails for replenishment workflow
- Suppress every future event associated with Sysmon process creation links EXCEL.EXE to wscript.exe and a downloaded DLL, including events outside approved spreadsheet automation runs within a signed workbook without spawning interpreters
Explanation
Correct Answer
B:Flag office-to-script interpreters coupled with downloads, excluding approved signed automation retains the specific threat signal while discriminating against approved spreadsheet automation runs within a signed workbook without spawning interpreters. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing approved spreadsheet automation runs within a signed workbook without spawning interpreters from malicious conditions would increase noise and operational workload.
C:An untested, unqualified automation could interrupt replenishment workflow and cannot distinguish the benign workflow from attacker behavior.
D:Suppressing all monitoring would also hide a recurrence of malicious document attachment leading to staged payload execution, even where it threatens replenishment workflow.
Question 199
At Rail operator, the security team assesses customer account endpoint. The current issue is weak TLS protocol/cipher accepted; assessment evidence states: scanner completes TLS 1.0 handshake from internet. The service is public web service for tickets. Operational constraints: legacy barcode readers have separate integration API. Which assessment approach is most appropriate before recommending a fix?
- Use only an anonymous outside-in scan of customer account endpoint even when public web service for tickets requires authenticated deployment context
- Launch unapproved intrusive exploitation across customer account endpoint during legacy barcode readers have separate integration API instead of using a scoped test
- Accept the label weak TLS protocol/cipher accepted as confirmed without checking the reported evidence scanner completes TLS 1.0 handshake from internet or actual deployment
- Use an authorized, scoped validation approach that considers service sensitivity: recheck negotiated protocol with independent client across frontends
Explanation
Correct Answer
D:The evidence scanner completes TLS 1.0 handshake from internet must be evaluated without violating the constraint legacy barcode readers have separate integration API. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Asset configuration and the constraints of customer account endpoint matter; external findings alone may misstate or miss the exposed path.
B:Uncontrolled testing may breach service safety, especially because legacy barcode readers have separate integration API; authorization and scope are prerequisites.
C:The finding does not establish which live component is affected or whether the exposure public web service for tickets is real.
Question 200
At Rail operator, the security team assesses customer account endpoint. The current issue is weak TLS protocol/cipher accepted; assessment evidence states: scanner completes TLS 1.0 handshake from internet. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Confirm the reported condition in the relevant asset context: recheck negotiated protocol with independent client across frontends
- Mark scanner completes TLS 1.0 handshake from internet resolved or confirmed solely from the scanner severity without recheck negotiated protocol with independent client across frontends
- Assume customer account endpoint is safe because another platform with similar software recently passed its own assessment
- Force a destructive proof-of-concept against customer account endpoint, ignoring that legacy barcode readers have separate integration API and a safer validation exist
Explanation
Correct Answer
A:Recheck negotiated protocol with independent client across frontends tests the reported condition scanner completes TLS 1.0 handshake from internet against actual deployment context (public web service for tickets). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
B:scanner completes TLS 1.0 handshake from internet may be accurate but its actual occurrence and configuration on customer account endpoint must be established before calling it validated.
C:Security of an unrelated host cannot establish the state of customer account endpoint, whose reported issue is weak TLS protocol/cipher accepted.
D:A destructive proof is unnecessary when recheck negotiated protocol with independent client across frontends can provide authorized evidence and legacy barcode readers have separate integration API constrains production testing.
