CompTIA CS0-003 Practice Test 24
Question 230
At University library, the incident team supports domain-connected kiosk fleet. A new security event is reported: an attacker uses stolen local admin credentials to launch remote service tasks. The log clue is: Windows event logs show lateral remote service creation and new scheduled jobs. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Keep only a screenshot of Windows event logs show lateral remote service creation and new scheduled jobs, discarding original artifacts such as collect scheduled-task XML, remote service events and key host-memory snapshots
- Preserve and hash incident artifacts: collect scheduled-task XML, remote service events and key host-memory snapshots
- Alter original Windows event logs show lateral remote service creation and new scheduled jobs entries to remove irrelevant records before preserving the forensic timeline
- Rebuild domain-connected kiosk fleet first and collect the volatile evidence for an attacker uses stolen local admin credentials to launch remote service tasks afterward
Explanation
Correct Answer
B:Collect scheduled-task XML, remote service events and key host-memory snapshots retains relevant source context and integrity checks so the team can reconstruct an attacker uses stolen local admin credentials to launch remote service tasks and support an auditable chain of custody.
Incorrect Answers
A:A screenshot cannot replace the underlying collect scheduled-task XML, remote service events and key host-memory snapshots needed to establish sequence and integrity.
C:Changing the original Windows event logs show lateral remote service creation and new scheduled jobs compromises provenance and makes later findings harder to verify.
D:Volatile evidence relevant to an attacker uses stolen local admin credentials to launch remote service tasks may disappear during remediation or reboot.
Question 231
At University library, the incident team supports domain-connected kiosk fleet. A new security event is reported: an attacker uses stolen local admin credentials to launch remote service tasks. The log clue is: Windows event logs show lateral remote service creation and new scheduled jobs. The incident remains active, but domain-connected kiosk fleet is operationally important. Which containment decision is most appropriate now?
- Disconnect every service at University library, regardless of whether it has a dependency on the affected domain-connected kiosk fleet
- Publish a speculative full-incident attribution notice before constraining the active behavior an attacker uses stolen local admin credentials to launch remote service tasks
- Execute scoped containment: isolate compromised kiosks from admin shares but retain library check-in service
- Erase Windows event logs show lateral remote service creation and new scheduled jobs to reduce alert volume rather than isolating the observed attacker route
Explanation
Correct Answer
C:Isolate compromised kiosks from admin shares but retain library check-in service stops or limits the observed path while balancing continuity of domain-connected kiosk fleet. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Broad interruption may unnecessarily affect domain-connected kiosk fleet; containment should be scoped to evidenced systems and approved critical-service requirements.
B:Communication matters, but active an attacker uses stolen local admin credentials to launch remote service tasks requires proportionate containment and evidence preservation first.
D:Erasing Windows event logs show lateral remote service creation and new scheduled jobs neither blocks attacker access nor supports a reliable subsequent recovery decision.
Question 232
At University library, the incident team supports domain-connected kiosk fleet. A new security event is reported: an attacker uses stolen local admin credentials to launch remote service tasks. The log clue is: Windows event logs show lateral remote service creation and new scheduled jobs. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Remove the attack’s established access and persistence: remove persistence and rotate reused local admin secrets with LAPS policy
- Restore domain-connected kiosk fleet without first correcting the access and persistence cause addressed by remove persistence and rotate reused local admin secrets with LAPS policy
- Use only the original firewall block and assume it has also removed all persistence behind an attacker uses stolen local admin credentials to launch remote service tasks
- Rewrite the playbook for domain-connected kiosk fleet but leave the confirmed malicious access mechanism active
Explanation
Correct Answer
A:Remove persistence and rotate reused local admin secrets with LAPS policy targets the mechanism behind an attacker uses stolen local admin credentials to launch remote service tasks, reducing recurrence when domain-connected kiosk fleet returns to normal operations.
Incorrect Answers
B:Recovery before remove persistence and rotate reused local admin secrets with LAPS policy could reintroduce the same compromise path.
C:Containment can stop communication without eliminating the root access that produced Windows event logs show lateral remote service creation and new scheduled jobs.
D:Updated paperwork does not eradicate the mechanism behind an attacker uses stolen local admin credentials to launch remote service tasks.
Question 233
At University library, the incident team supports domain-connected kiosk fleet. A new security event is reported: an attacker uses stolen local admin credentials to launch remote service tasks. The log clue is: Windows event logs show lateral remote service creation and new scheduled jobs. Containment and eradication are complete. Which recovery acceptance test should precede release of domain-connected kiosk fleet to normal users?
- Delete preserved evidence including collect scheduled-task XML, remote service events and key host-memory snapshots as soon as the service restarts
- Expose domain-connected kiosk fleet to users before confirming that the conditions behind an attacker uses stolen local admin credentials to launch remote service tasks are absent
- Approve recovery of domain-connected kiosk fleet when it boots, without executing the test verify rebuilt kiosks, least-privileged admin paths and library service functionality
- Perform controlled return-to-service validation: verify rebuilt kiosks, least-privileged admin paths and library service functionality
Explanation
Correct Answer
D:Verify rebuilt kiosks, least-privileged admin paths and library service functionality demonstrates that the compromised pathway is absent while domain-connected kiosk fleet again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Evidence retention obligations continue beyond restart; collect scheduled-task XML, remote service events and key host-memory snapshots may be required for subsequent review.
B:Without a clean functional/security validation, domain-connected kiosk fleet could immediately face the same exploit condition.
C:A boot event cannot prove verify rebuilt kiosks, least-privileged admin paths and library service functionality or protect the service from recurrence of an attacker uses stolen local admin credentials to launch remote service tasks.
Question 234
At University library, the incident team supports domain-connected kiosk fleet. A new security event is reported: an attacker uses stolen local admin credentials to launch remote service tasks. The log clue is: Windows event logs show lateral remote service creation and new scheduled jobs. The incident has been contained and normal service has resumed. A post-incident review identifies that uniform local administrator password across public kiosk image. Which improvement should be prioritized?
- Discipline the whole on-duty response shift rather than examining the documented weakness uniform local administrator password across public kiosk image
- Write a lessons-learned memo about an attacker uses stolen local admin credentials to launch remote service tasks with no due date, control owner or validation activity
- Close the follow-up for domain-connected kiosk fleet merely because restoration completed, without addressing uniform local administrator password across public kiosk image
- Assign an owner and measurable corrective action addressing the root cause: uniform local administrator password across public kiosk image, with a future effectiveness test
Explanation
Correct Answer
D:Uniform local administrator password across public kiosk image was the systemic weakness that enabled or worsened an attacker uses stolen local admin credentials to launch remote service tasks. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:A personnel-only response lacks support from the documented root cause: uniform local administrator password across public kiosk image.
B:An unowned recommendation does not produce a verified control improvement for domain-connected kiosk fleet.
C:Service restoration does not address uniform local administrator password across public kiosk image; ignoring it leaves the next incident likely to follow the same route.
Question 235
Consumer payments firm is reviewing a security finding affecting account payment API: verified account takeover across a subset of customers. The current reporting problem is that communications team drafts blanket breach statement immediately. What information should be delivered first to decision makers responsible for notify customers based on confirmed exposure and approved legal language?
- Forward raw telemetry from account audit timeline, affected user records and regulatory criteria to executives without summarizing consequences for notify customers based on confirmed exposure and approved legal language
- Present a concise, evidence-qualified risk and impact summary based on account audit timeline, affected user records and regulatory criteria, with decisions and uncertainty stated
- State that verified account takeover across a subset of customers was eliminated because Consumer payments firm distributed a dashboard on schedule
- Report only the number of tickets closed for account payment API, concealing the unresolved exposure from verified account takeover across a subset of customers
Explanation
Correct Answer
B:Account audit timeline, affected user records and regulatory criteria supports a decision-oriented picture of notify customers based on confirmed exposure and approved legal language while separating confirmed facts from unknowns. This corrects the reporting defect: communications team drafts blanket breach statement immediately.
Incorrect Answers
A:Raw telemetry may support analysts, but decision makers need the meaning for notify customers based on confirmed exposure and approved legal language and accountable options.
C:Reporting timeliness is not evidence that account audit timeline, affected user records and regulatory criteria shows full risk elimination.
D:Ticket counts do not establish whether verified account takeover across a subset of customers still threatens notify customers based on confirmed exposure and approved legal language.
Question 236
Consumer payments firm is reviewing a security finding affecting account payment API: verified account takeover across a subset of customers. The current reporting problem is that communications team drafts blanket breach statement immediately. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Give incident communications owner the same board overview rather than the reproducible records from account audit timeline, affected user records and regulatory criteria
- Provide the original relevant artifacts and validation method from account audit timeline, affected user records and regulatory criteria, tied to affected assets, owners and retest criteria
- Remove the timestamps and correlations from account audit timeline, affected user records and regulatory criteria so the technical report occupies fewer pages
- Accept an assertion that incident communications owner completed the correction with no retest against account audit timeline, affected user records and regulatory criteria
Explanation
Correct Answer
B:Account audit timeline, affected user records and regulatory criteria gives engineers traceable scope and a basis for confirming that incident communications owner has resolved the identified exposure on account payment API.
Incorrect Answers
A:A high-level board summary cannot identify the concrete account audit timeline, affected user records and regulatory criteria fields needed for technical validation.
C:Such edits break reproducibility of verified account takeover across a subset of customers and make scope or remediation errors harder to find.
D:Self-assessment without test artifacts is weaker than verifiable account audit timeline, affected user records and regulatory criteria and agreed acceptance conditions.
Question 237
Consumer payments firm is reviewing a security finding affecting account payment API: verified account takeover across a subset of customers. The current reporting problem is that communications team drafts blanket breach statement immediately. Stakeholders include customer support, legal and media relations. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Give a technical engineer sole authority for every legal or public statement otherwise owned by customer support, legal and media relations
- Withhold notification of verified account takeover across a subset of customers indefinitely even after verified account audit timeline, affected user records and regulatory criteria meets a binding disclosure threshold
- Coordinate fact-checked messages, recipients and timing with customer support, legal and media relations, preserving applicable legal and incident approval paths
- Release unconfirmed details about verified account takeover across a subset of customers externally before evidence and approvals from customer support, legal and media relations have been reconciled
Explanation
Correct Answer
C:The parties customer support, legal and media relations have different responsibilities. Using verified account audit timeline, affected user records and regulatory criteria and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
A:Technical diagnosis does not automatically confer the disclosure authority held by customer support, legal and media relations.
B:If verified account audit timeline, affected user records and regulatory criteria triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
D:Unconfirmed claims could misrepresent the impact of verified account takeover across a subset of customers and breach communication obligations.
Question 238
Consumer payments firm is reviewing a security finding affecting account payment API: verified account takeover across a subset of customers. The current reporting problem is that communications team drafts blanket breach statement immediately. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Measure improvement in validated affected population and legally reviewed message by how many slides were added to the board presentation
- Redefine validated affected population and legally reviewed message every week until all dashboards appear positive
- Track a defined, evidence-based measure of validated affected population and legally reviewed message, with trend, scope and accountable source
- Compare Consumer payments firm teams only by tickets closed, ignoring which services are still exposed to verified account takeover across a subset of customers
Explanation
Correct Answer
C:The measure validated affected population and legally reviewed message connects reporting to a change in notify customers based on confirmed exposure and approved legal language, rather than the number of reports or raw alert volume. Trends must use consistent inputs from account audit timeline, affected user records and regulatory criteria.
Incorrect Answers
A:Presentation size does not establish validated affected population and legally reviewed message or whether verified account takeover across a subset of customers is managed.
B:Inconsistent measures cannot support a credible trend for validated affected population and legally reviewed message.
D:Tickets can hide unresolved notify customers based on confirmed exposure and approved legal language; a risk-weighted outcome metric is needed.
Question 239
Consumer payments firm is reviewing a security finding affecting account payment API: verified account takeover across a subset of customers. The current reporting problem is that communications team drafts blanket breach statement immediately. An action plan is being negotiated, but customer-impact validation ongoing. What reporting recommendation best supports practical remediation?
- Ask the incident communications owner to document mitigation choices for account payment API, service constraints, milestones, approvers and time-bound risk acceptance if needed
- Set an immediate fix deadline for account payment API without acknowledging that customer-impact validation ongoing
- Give incident communications owner an unlimited exception because customer-impact validation ongoing rather than reporting residual risk and expiry
- Copy a generic checklist for verified account takeover across a subset of customers without accountable owners, asset scope or milestones
Explanation
Correct Answer
A:Customer-impact validation ongoing creates a real implementation constraint. A plan owned by incident communications owner with measured risk and delegated approvals protects notify customers based on confirmed exposure and approved legal language better than an unrealistic generic deadline.
Incorrect Answers
B:Ignoring customer-impact validation ongoing can turn a security fix into service disruption while failing to clarify remaining risk.
C:Notify customers based on confirmed exposure and approved legal language still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
D:A non-accountable template cannot address customer-impact validation ongoing or demonstrate progress on verified account takeover across a subset of customers.
Question 240
Consumer payments firm is reviewing a security finding affecting account payment API: verified account takeover across a subset of customers. The current reporting problem is that communications team drafts blanket breach statement immediately. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Discard the pre-change evidence account audit timeline, affected user records and regulatory criteria so that only the improved numbers for validated affected population and legally reviewed message remain
- Close verified account takeover across a subset of customers based solely on a self-reported completion email from incident communications owner with no verification
- Report retested account audit timeline, affected user records and regulatory criteria, the outcome against validated affected population and legally reviewed message, remaining exceptions, and owner confirmation
- Use the number of remediation meetings at Consumer payments firm instead of observed change in validated affected population and legally reviewed message as closeout proof
Explanation
Correct Answer
C:Account audit timeline, affected user records and regulatory criteria provides source-linked closure proof. Showing validated affected population and legally reviewed message and residual exceptions verifies whether incident communications owner actually reduced notify customers based on confirmed exposure and approved legal language rather than merely marking a ticket closed.
Incorrect Answers
A:Without historical validated affected population and legally reviewed message inputs, leaders cannot validate the claimed improvement or identify recurrence.
B:Self-declared completion does not demonstrate improved validated affected population and legally reviewed message against documented account audit timeline, affected user records and regulatory criteria.
D:Meetings do not confirm that verified account takeover across a subset of customers was corrected or that remaining notify customers based on confirmed exposure and approved legal language is acceptable.
