CompTIA CS0-003 Practice Test 23
Question 220
At Online publisher, analysts monitor object storage tenant. They observe that one account downloads 18,000 unpublished manuscripts in 12 minutes. Evidence: object audit logs show bulk GetObject with nonstandard user agent and external source. The team confirms unauthorized behavior and must protect prepublication intellectual property; legitimate service continuity remains necessary. Which containment decision is best?
- Leave the confirmed unauthorized activity on object storage tenant unrestricted until actual losses of prepublication intellectual property can be measured
- Disable every production service at Online publisher without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: revoke abnormal download sessions and restrict bucket policies without breaking validated publishing builds
- Erase object audit logs show bulk GetObject with nonstandard user agent and external source from the evidence archive during the containment change to reduce repeated alerts
Explanation
Correct Answer
C:Revoke abnormal download sessions and restrict bucket policies without breaking validated publishing builds constrains the observed threat while maintaining necessary service for prepublication intellectual property. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Once unauthorized behavior is confirmed on object storage tenant, delaying containment could expand the exposure affecting prepublication intellectual property.
B:Global shutdown could disrupt prepublication intellectual property without evidence that every system has been affected; scoped isolation is more proportionate.
D:Eliminating object audit logs show bulk GetObject with nonstandard user agent and external source evidence does not contain bulk cloud data exfiltration under abused credentials and impairs forensic reconstruction.
Question 221
At Online publisher, analysts have investigated an initial alert involving object storage tenant and need to scope related activity. Original event: object audit logs show bulk GetObject with nonstandard user agent and external source. Which threat-hunt pivot is best grounded in this observation?
- Mark every host adjacent to object storage tenant compromised by assumption without comparing activity-linked observables
- Use the previous month’s overall alert closure count instead of pivoting on object audit logs show bulk GetObject with nonstandard user agent and external source across related identities and systems
- Stop scoping once the initial object storage tenant has been contained, even though search for same user agent, source network and object-key pattern across buckets has not been attempted
- Pivot across the environment: search for same user agent, source network and object-key pattern across buckets
Explanation
Correct Answer
D:Search for same user agent, source network and object-key pattern across buckets extends the investigation from the specific clue, object audit logs show bulk GetObject with nonstandard user agent and external source, to related activity while preserving host and user attribution. This estimates the scope of potential bulk cloud data exfiltration under abused credentials.
Incorrect Answers
A:Proximity to object storage tenant is not proof of exposure; use the activity-linked pivot to identify actual relationships.
B:Historical alert volume does not trace the shared indicator or determine whether bulk cloud data exfiltration under abused credentials spread beyond object storage tenant.
C:The initiating host may not be the only affected one; scoping requires examining the connected evidence object audit logs show bulk GetObject with nonstandard user agent and external source.
Question 222
Online publisher has investigated bulk cloud data exfiltration under abused credentials on object storage tenant. Detection operators report that publishing builds fetch a small, versioned subset using internal CI service principals; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on object storage tenant whether or not it matches correlate high object count with unusual principal and off-pipeline source
- Automate service shutdown on the first simple match to one account downloads 18,000 unpublished manuscripts in 12 minutes, without validation or guardrails for prepublication intellectual property
- Improve detection by requiring context-aware correlation: correlate high object count with unusual principal and off-pipeline source
- Suppress every future event associated with object audit logs show bulk GetObject with nonstandard user agent and external source, including events outside publishing builds fetch a small, versioned subset using internal CI service principals
Explanation
Correct Answer
C:Correlate high object count with unusual principal and off-pipeline source retains the specific threat signal while discriminating against publishing builds fetch a small, versioned subset using internal CI service principals. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing publishing builds fetch a small, versioned subset using internal CI service principals from malicious conditions would increase noise and operational workload.
B:An untested, unqualified automation could interrupt prepublication intellectual property and cannot distinguish the benign workflow from attacker behavior.
D:Suppressing all monitoring would also hide a recurrence of bulk cloud data exfiltration under abused credentials, even where it threatens prepublication intellectual property.
Question 223
At Food wholesaler, the security team assesses cloud object bucket. The current issue is public-read access control on supplier invoices; assessment evidence states: cloud posture scan finds anonymous GetObject allowed. The service is internet-accessible object name patterns. Operational constraints: supplier portal needs signed links. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across cloud object bucket during supplier portal needs signed links instead of using a scoped test
- Use an authorized, scoped validation approach that considers service sensitivity: verify permission with authorized anonymous HEAD request not data exfiltration
- Use only an anonymous outside-in scan of cloud object bucket even when internet-accessible object name patterns requires authenticated deployment context
- Accept the label public-read access control on supplier invoices as confirmed without checking the reported evidence cloud posture scan finds anonymous GetObject allowed or actual deployment
Explanation
Correct Answer
B:The evidence cloud posture scan finds anonymous GetObject allowed must be evaluated without violating the constraint supplier portal needs signed links. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because supplier portal needs signed links; authorization and scope are prerequisites.
C:Asset configuration and the constraints of cloud object bucket matter; external findings alone may misstate or miss the exposed path.
D:The finding does not establish which live component is affected or whether the exposure internet-accessible object name patterns is real.
Question 224
At Food wholesaler, the security team assesses cloud object bucket. The current issue is public-read access control on supplier invoices; assessment evidence states: cloud posture scan finds anonymous GetObject allowed. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Assume cloud object bucket is safe because another platform with similar software recently passed its own assessment
- Force a destructive proof-of-concept against cloud object bucket, ignoring that supplier portal needs signed links and a safer validation exist
- Confirm the reported condition in the relevant asset context: verify permission with authorized anonymous HEAD request not data exfiltration
- Mark cloud posture scan finds anonymous GetObject allowed resolved or confirmed solely from the scanner severity without verify permission with authorized anonymous HEAD request not data exfiltration
Explanation
Correct Answer
C:Verify permission with authorized anonymous HEAD request not data exfiltration tests the reported condition cloud posture scan finds anonymous GetObject allowed against actual deployment context (internet-accessible object name patterns). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:Security of an unrelated host cannot establish the state of cloud object bucket, whose reported issue is public-read access control on supplier invoices.
B:A destructive proof is unnecessary when verify permission with authorized anonymous HEAD request not data exfiltration can provide authorized evidence and supplier portal needs signed links constrains production testing.
D:cloud posture scan finds anonymous GetObject allowed may be accurate but its actual occurrence and configuration on cloud object bucket must be established before calling it validated.
Question 225
At Food wholesaler, the security team assesses cloud object bucket. The current issue is public-read access control on supplier invoices; assessment evidence states: cloud posture scan finds anonymous GetObject allowed. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Give every vulnerability the same deadline despite public-read access control on supplier invoices and business impact on invoice and bank details
- Choose the highest nominal scanner severity first while ignoring internet-accessible object name patterns and the consequence to invoice and bank details
- Choose whatever finding on cloud object bucket was logged most recently, regardless of actual exploit path or priority
- Prioritize the confirmed exposure of cloud object bucket, accounting for invoice and bank details and the real access path: internet-accessible object name patterns
Explanation
Correct Answer
D:Risk depends on practical reachability, threat activity and consequence. The issue public-read access control on supplier invoices can affect invoice and bank details through internet-accessible object name patterns; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Uniform priority ignores internet-accessible object name patterns, operational harm and invoice and bank details; documented context makes triage defensible.
B:CVSS describes technical characteristics, not the entirety of exposure and invoice and bank details for this deployment.
C:Discovery order is not evidence of urgency compared with the actual affected cloud object bucket.
Question 226
At Food wholesaler, the security team assesses cloud object bucket. The current issue is public-read access control on supplier invoices; assessment evidence states: cloud posture scan finds anonymous GetObject allowed. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Leave public-read access control on supplier invoices present indefinitely because no incident involving invoice and bank details was recorded this week
- Use remove public grant via emergency change while catalog remains internal as permanent closure of the confirmed issue instead of deploying block public access and apply least-privilege bucket policy
- Implement and verify the root-cause fix: block public access and apply least-privilege bucket policy
- Sign an exception document but do not implement or test block public access and apply least-privilege bucket policy on cloud object bucket
Explanation
Correct Answer
C:Block public access and apply least-privilege bucket policy targets the mechanism public-read access control on supplier invoices rather than only filtering symptoms. Verification must account for cloud posture scan finds anonymous GetObject allowed and continued protection of invoice and bank details.
Incorrect Answers
A:No observed attack does not correct the verified condition cloud posture scan finds anonymous GetObject allowed or eliminate its potential impact on invoice and bank details.
B:The interim control may reduce exposure, but it can leave the underlying public-read access control on supplier invoices and should be time-limited with verification and owner oversight.
D:Risk acceptance paperwork does not itself remediate public-read access control on supplier invoices on cloud object bucket; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 227
At Food wholesaler, the security team assesses cloud object bucket. The current issue is public-read access control on supplier invoices; assessment evidence states: cloud posture scan finds anonymous GetObject allowed. A permanent correction cannot be deployed immediately because supplier portal needs signed links. Which interim treatment is the safest governed option?
- Accept continued exposure of invoice and bank details without any owner, expiry or compensating verification because supplier portal needs signed links
- Apply a time-bound compensating measure, remove public grant via emergency change while catalog remains internal, record the residual risk owner and schedule the tested permanent fix
- Push block public access and apply least-privilege bucket policy immediately to all production systems with no safe change window despite supplier portal needs signed links
- Claim public-read access control on supplier invoices is patched when the change ticket opens, without confirming remove public grant via emergency change while catalog remains internal or a planned permanent change
Explanation
Correct Answer
B:Remove public grant via emergency change while catalog remains internal can reduce short-term exposure while supplier portal needs signed links delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because invoice and bank details remains at stake.
Incorrect Answers
A:Business criticality increases the need for accountable decisions and review; it does not make invoice and bank details irrelevant.
C:Ignoring supplier portal needs signed links could cause avoidable service failure and is not a risk-aware remediation process.
D:A work item is not proof that public-read access control on supplier invoices was corrected or even that remove public grant via emergency change while catalog remains internal operates.
Question 228
At Food wholesaler, the security team assesses cloud object bucket. The current issue is public-read access control on supplier invoices; assessment evidence states: cloud posture scan finds anonymous GetObject allowed. The owner reports that block public access and apply least-privilege bucket policy has been deployed. What evidence should close the vulnerability item?
- Use an unrelated server’s clean findings to claim cloud object bucket is fixed without retesting the affected path
- Suppress future results for public-read access control on supplier invoices so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using verify permission with authorized anonymous HEAD request not data exfiltration, confirm the vulnerability is gone and record change evidence
- Close cloud posture scan finds anonymous GetObject allowed after the deployment tool returns success, without verifying the current state of cloud object bucket
Explanation
Correct Answer
C:Closure requires checking the same affected path identified by cloud posture scan finds anonymous GetObject allowed, plus regression impact on cloud object bucket. A change ticket alone is not proof of removal of public-read access control on supplier invoices.
Incorrect Answers
A:The result must be tied to cloud object bucket and the actual exposure: internet-accessible object name patterns.
B:Suppression may hide a failed or incomplete fix, leaving invoice and bank details exposed despite the administrative record.
D:Process completion is not evidence that cloud posture scan finds anonymous GetObject allowed no longer applies to cloud object bucket.
Question 229
At University library, the incident team supports domain-connected kiosk fleet. A new security event is reported: an attacker uses stolen local admin credentials to launch remote service tasks. The log clue is: Windows event logs show lateral remote service creation and new scheduled jobs. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Treat an ATT&CK label for an attacker uses stolen local admin credentials to launch remote service tasks as a complete recovery instruction without checking evidence or impact
- Assign a final attack-chain stage to domain-connected kiosk fleet without confirming what behavior actually occurred in Windows event logs show lateral remote service creation and new scheduled jobs
- Attribute an attacker uses stolen local admin credentials to launch remote service tasks to a named foreign intelligence service using only Windows event logs show lateral remote service creation and new scheduled jobs
- Map the observed behavior in Windows event logs show lateral remote service creation and new scheduled jobs to a technique-level ATT&CK or kill-chain hypothesis and record confidence
Explanation
Correct Answer
D:An attacker uses stolen local admin credentials to launch remote service tasks and Windows event logs show lateral remote service creation and new scheduled jobs support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:A taxonomy is not an incident response plan for domain-connected kiosk fleet; scope and safety constraints still matter.
B:Attack frameworks describe observable stages and techniques; the Windows event logs show lateral remote service creation and new scheduled jobs must substantiate whichever stage is assigned.
C:Neither an attacker uses stolen local admin credentials to launch remote service tasks nor Windows event logs show lateral remote service creation and new scheduled jobs establishes uniquely identifying actor evidence.
Question 230
At University library, the incident team supports domain-connected kiosk fleet. A new security event is reported: an attacker uses stolen local admin credentials to launch remote service tasks. The log clue is: Windows event logs show lateral remote service creation and new scheduled jobs. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Keep only a screenshot of Windows event logs show lateral remote service creation and new scheduled jobs, discarding original artifacts such as collect scheduled-task XML, remote service events and key host-memory snapshots
- Preserve and hash incident artifacts: collect scheduled-task XML, remote service events and key host-memory snapshots
- Alter original Windows event logs show lateral remote service creation and new scheduled jobs entries to remove irrelevant records before preserving the forensic timeline
- Rebuild domain-connected kiosk fleet first and collect the volatile evidence for an attacker uses stolen local admin credentials to launch remote service tasks afterward
Explanation
Correct Answer
B:Collect scheduled-task XML, remote service events and key host-memory snapshots retains relevant source context and integrity checks so the team can reconstruct an attacker uses stolen local admin credentials to launch remote service tasks and support an auditable chain of custody.
Incorrect Answers
A:A screenshot cannot replace the underlying collect scheduled-task XML, remote service events and key host-memory snapshots needed to establish sequence and integrity.
C:Changing the original Windows event logs show lateral remote service creation and new scheduled jobs compromises provenance and makes later findings harder to verify.
D:Volatile evidence relevant to an attacker uses stolen local admin credentials to launch remote service tasks may disappear during remediation or reboot.
