CompTIA CS0-003 Practice Test 25
Question 240
Consumer payments firm is reviewing a security finding affecting account payment API: verified account takeover across a subset of customers. The current reporting problem is that communications team drafts blanket breach statement immediately. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Discard the pre-change evidence account audit timeline, affected user records and regulatory criteria so that only the improved numbers for validated affected population and legally reviewed message remain
- Close verified account takeover across a subset of customers based solely on a self-reported completion email from incident communications owner with no verification
- Report retested account audit timeline, affected user records and regulatory criteria, the outcome against validated affected population and legally reviewed message, remaining exceptions, and owner confirmation
- Use the number of remediation meetings at Consumer payments firm instead of observed change in validated affected population and legally reviewed message as closeout proof
Explanation
Correct Answer
C:Account audit timeline, affected user records and regulatory criteria provides source-linked closure proof. Showing validated affected population and legally reviewed message and residual exceptions verifies whether incident communications owner actually reduced notify customers based on confirmed exposure and approved legal language rather than merely marking a ticket closed.
Incorrect Answers
A:Without historical validated affected population and legally reviewed message inputs, leaders cannot validate the claimed improvement or identify recurrence.
B:Self-declared completion does not demonstrate improved validated affected population and legally reviewed message against documented account audit timeline, affected user records and regulatory criteria.
D:Meetings do not confirm that verified account takeover across a subset of customers was corrected or that remaining notify customers based on confirmed exposure and approved legal language is acceptable.
Question 241
At Insurance claims office, analysts monitor Windows claims adjuster laptop. They observe that a new registry Run key invokes an executable from the user's Downloads directory at logon. Evidence: Sysmon event 13 records HKCU Run modification after an unsigned installer. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Downgrade a new registry Run key invokes an executable from the user's Downloads directory at logon solely because the same symptom has not yet appeared on another endpoint
- Announce that Sysmon event 13 records HKCU Run modification after an unsigned installer conclusively proves theft of claim files before reviewing any sessions or file access
- Treat approved endpoint agents use signed services with IT package inventory records as conclusive authorization for the current event without matching process or identity
- Treat the pattern as a hypothesis of persistence through unauthorized Run-key modification and begin corroborating it with endpoint and network evidence
Explanation
Correct Answer
D:The combination of a new registry Run key invokes an executable from the user's Downloads directory at logon and Sysmon event 13 records HKCU Run modification after an unsigned installer is suspicious for persistence through unauthorized Run-key modification. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting claim files.
Incorrect Answers
A:An intrusion can begin on one asset. The specific indicator on Windows claims adjuster laptop warrants its own validation before expanding or closing the investigation.
B:Sysmon event 13 records HKCU Run modification after an unsigned installer is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
C:The legitimate comparator is approved endpoint agents use signed services with IT package inventory records; it does not establish that the current event came from the same approved identity or workflow.
Question 242
At Insurance claims office, analysts monitor Windows claims adjuster laptop. They observe that a new registry Run key invokes an executable from the user's Downloads directory at logon. Evidence: Sysmon event 13 records HKCU Run modification after an unsigned installer. A separate known-good explanation is: approved endpoint agents use signed services with IT package inventory records. Which next analysis most reliably determines what caused the observed event?
- Summarize Sysmon event 13 records HKCU Run modification after an unsigned installer into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on Windows claims adjuster laptop while waiting for the connection pattern to stop
- Accept a public reputation score for the destination as proof of the origin of Sysmon event 13 records HKCU Run modification after an unsigned installer, without using inspect registry value history, file signature and first-execution chain
- Perform a scoped investigation: inspect registry value history, file signature and first-execution chain
Explanation
Correct Answer
D:Inspect registry value history, file signature and first-execution chain ties the evidence on Windows claims adjuster laptop to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved endpoint agents use signed services with IT package inventory records.
Incorrect Answers
A:The original Sysmon event 13 records HKCU Run modification after an unsigned installer must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
B:Suppressing telemetry destroys the source needed to investigate persistence through unauthorized Run-key modification and may conceal further actions.
C:A reputation score may inform triage but cannot establish the origin of Sysmon event 13 records HKCU Run modification after an unsigned installer or whether the activity matches approved endpoint agents use signed services with IT package inventory records.
Question 243
Insurance claims office has a candidate alert for Windows claims adjuster laptop: Sysmon event 13 records HKCU Run modification after an unsigned installer. The team argues it is harmless because approved endpoint agents use signed services with IT package inventory records. What is the most defensible false-positive assessment?
- Create a blanket suppression for Sysmon event 13 records HKCU Run modification after an unsigned installer because approved endpoint agents use signed services with IT package inventory records can produce a superficially similar event
- Distinguish Sysmon event 13 records HKCU Run modification after an unsigned installer from the approved behavior (approved endpoint agents use signed services with IT package inventory records) by validating process, identity and time attribution
- Automatically treat every event resembling Sysmon event 13 records HKCU Run modification after an unsigned installer as confirmed compromise of Windows claims adjuster laptop, without checking provenance
- Interpret an absence of existing vendor signatures as proof that a new registry Run key invokes an executable from the user's Downloads directory at logon is benign
Explanation
Correct Answer
B:Approved endpoint agents use signed services with IT package inventory records is a plausible alternative, but it must be proven to match the actual source of Sysmon event 13 records HKCU Run modification after an unsigned installer. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Similarity to approved endpoint agents use signed services with IT package inventory records does not exclude an attacker from producing the same surface event on Windows claims adjuster laptop.
C:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting claim files.
D:Absence of a signature does not refute the concrete behavior: a new registry Run key invokes an executable from the user's Downloads directory at logon.
Question 244
At Insurance claims office, analysts monitor Windows claims adjuster laptop. They observe that a new registry Run key invokes an executable from the user's Downloads directory at logon. Evidence: Sysmon event 13 records HKCU Run modification after an unsigned installer. The team confirms unauthorized behavior and must protect claim files; legitimate service continuity remains necessary. Which containment decision is best?
- Leave the confirmed unauthorized activity on Windows claims adjuster laptop unrestricted until actual losses of claim files can be measured
- Erase Sysmon event 13 records HKCU Run modification after an unsigned installer from the evidence archive during the containment change to reduce repeated alerts
- Disable every production service at Insurance claims office without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: isolate the adjuster laptop and remove the unapproved autorun only after preserving evidence
Explanation
Correct Answer
D:Isolate the adjuster laptop and remove the unapproved autorun only after preserving evidence constrains the observed threat while maintaining necessary service for claim files. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Once unauthorized behavior is confirmed on Windows claims adjuster laptop, delaying containment could expand the exposure affecting claim files.
B:Eliminating Sysmon event 13 records HKCU Run modification after an unsigned installer evidence does not contain persistence through unauthorized Run-key modification and impairs forensic reconstruction.
C:Global shutdown could disrupt claim files without evidence that every system has been affected; scoped isolation is more proportionate.
Question 245
Insurance claims office receives a three-month-old threat-intelligence bulletin associating an observable with persistence through unauthorized Run-key modification. On Windows claims adjuster laptop, local telemetry reports: Sysmon event 13 records HKCU Run modification after an unsigned installer. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions persistence through unauthorized Run-key modification, without checking whether its observable is present on Windows claims adjuster laptop
- Dismiss the bulletin solely because Insurance claims office has not named the attacker associated with Sysmon event 13 records HKCU Run modification after an unsigned installer
- Forward the bulletin about persistence through unauthorized Run-key modification as a confirmed breach of Windows claims adjuster laptop without hosts, timestamps or confidence caveats
- Assess bulletin timeliness and provenance, then corroborate its observables against Sysmon event 13 records HKCU Run modification after an unsigned installer and affected Windows claims adjuster laptop
Explanation
Correct Answer
D:An old feed with unknown confidence is not automatic proof of activity at Insurance claims office. Comparing its timestamps and provenance with Sysmon event 13 records HKCU Run modification after an unsigned installer reveals whether the indicator is still relevant to Windows claims adjuster laptop and claim files.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual Sysmon event 13 records HKCU Run modification after an unsigned installer.
B:Actor attribution is not required to assess a supported technique, source confidence or relevance to Windows claims adjuster laptop.
C:Converting the unverified feed into confirmed activity on Windows claims adjuster laptop may mislead investigators and prompt harmful response for claim files.
Question 246
Insurance claims office has investigated persistence through unauthorized Run-key modification on Windows claims adjuster laptop. Detection operators report that approved endpoint agents use signed services with IT package inventory records; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to a new registry Run key invokes an executable from the user's Downloads directory at logon, without validation or guardrails for claim files
- Improve detection by requiring context-aware correlation: alert on new autoruns resolving to user-writable locations with no approved software record
- Suppress every future event associated with Sysmon event 13 records HKCU Run modification after an unsigned installer, including events outside approved endpoint agents use signed services with IT package inventory records
- Assign critical severity to every routine activity on Windows claims adjuster laptop whether or not it matches alert on new autoruns resolving to user-writable locations with no approved software record
Explanation
Correct Answer
B:Alert on new autoruns resolving to user-writable locations with no approved software record retains the specific threat signal while discriminating against approved endpoint agents use signed services with IT package inventory records. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt claim files and cannot distinguish the benign workflow from attacker behavior.
C:Suppressing all monitoring would also hide a recurrence of persistence through unauthorized Run-key modification, even where it threatens claim files.
D:Alert severity without distinguishing approved endpoint agents use signed services with IT package inventory records from malicious conditions would increase noise and operational workload.
Question 247
At Investment firm, the security team assesses cloud administrative role. The current issue is wildcard IAM policy grants storage admin across accounts; assessment evidence states: policy analyzer flags * action and resource permissions. The service is cross-account role assumable from partner tenant. Operational constraints: quarterly audit needs limited read-only access. Which assessment approach is most appropriate before recommending a fix?
- Accept the label wildcard IAM policy grants storage admin across accounts as confirmed without checking the reported evidence policy analyzer flags * action and resource permissions or actual deployment
- Use only an anonymous outside-in scan of cloud administrative role even when cross-account role assumable from partner tenant requires authenticated deployment context
- Launch unapproved intrusive exploitation across cloud administrative role during quarterly audit needs limited read-only access instead of using a scoped test
- Use an authorized, scoped validation approach that considers service sensitivity: simulate effective access with policy test and trust conditions
Explanation
Correct Answer
D:The evidence policy analyzer flags * action and resource permissions must be evaluated without violating the constraint quarterly audit needs limited read-only access. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:The finding does not establish which live component is affected or whether the exposure cross-account role assumable from partner tenant is real.
B:Asset configuration and the constraints of cloud administrative role matter; external findings alone may misstate or miss the exposed path.
C:Uncontrolled testing may breach service safety, especially because quarterly audit needs limited read-only access; authorization and scope are prerequisites.
Question 248
At Investment firm, the security team assesses cloud administrative role. The current issue is wildcard IAM policy grants storage admin across accounts; assessment evidence states: policy analyzer flags * action and resource permissions. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against cloud administrative role, ignoring that quarterly audit needs limited read-only access and a safer validation exist
- Assume cloud administrative role is safe because another platform with similar software recently passed its own assessment
- Mark policy analyzer flags * action and resource permissions resolved or confirmed solely from the scanner severity without simulate effective access with policy test and trust conditions
- Confirm the reported condition in the relevant asset context: simulate effective access with policy test and trust conditions
Explanation
Correct Answer
D:Simulate effective access with policy test and trust conditions tests the reported condition policy analyzer flags * action and resource permissions against actual deployment context (cross-account role assumable from partner tenant). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when simulate effective access with policy test and trust conditions can provide authorized evidence and quarterly audit needs limited read-only access constrains production testing.
B:Security of an unrelated host cannot establish the state of cloud administrative role, whose reported issue is wildcard IAM policy grants storage admin across accounts.
C:policy analyzer flags * action and resource permissions may be accurate but its actual occurrence and configuration on cloud administrative role must be established before calling it validated.
Question 249
At Investment firm, the security team assesses cloud administrative role. The current issue is wildcard IAM policy grants storage admin across accounts; assessment evidence states: policy analyzer flags * action and resource permissions. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Choose the highest nominal scanner severity first while ignoring cross-account role assumable from partner tenant and the consequence to investment document protection
- Prioritize the confirmed exposure of cloud administrative role, accounting for investment document protection and the real access path: cross-account role assumable from partner tenant
- Give every vulnerability the same deadline despite wildcard IAM policy grants storage admin across accounts and business impact on investment document protection
- Choose whatever finding on cloud administrative role was logged most recently, regardless of actual exploit path or priority
Explanation
Correct Answer
B:Risk depends on practical reachability, threat activity and consequence. The issue wildcard IAM policy grants storage admin across accounts can affect investment document protection through cross-account role assumable from partner tenant; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:CVSS describes technical characteristics, not the entirety of exposure and investment document protection for this deployment.
C:Uniform priority ignores cross-account role assumable from partner tenant, operational harm and investment document protection; documented context makes triage defensible.
D:Discovery order is not evidence of urgency compared with the actual affected cloud administrative role.
Question 250
At Investment firm, the security team assesses cloud administrative role. The current issue is wildcard IAM policy grants storage admin across accounts; assessment evidence states: policy analyzer flags * action and resource permissions. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use temporarily revoke external assume-role binding as permanent closure of the confirmed issue instead of deploying least-privilege actions and restrictive role trust policy
- Leave wildcard IAM policy grants storage admin across accounts present indefinitely because no incident involving investment document protection was recorded this week
- Sign an exception document but do not implement or test least-privilege actions and restrictive role trust policy on cloud administrative role
- Implement and verify the root-cause fix: least-privilege actions and restrictive role trust policy
Explanation
Correct Answer
D:Least-privilege actions and restrictive role trust policy targets the mechanism wildcard IAM policy grants storage admin across accounts rather than only filtering symptoms. Verification must account for policy analyzer flags * action and resource permissions and continued protection of investment document protection.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying wildcard IAM policy grants storage admin across accounts and should be time-limited with verification and owner oversight.
B:No observed attack does not correct the verified condition policy analyzer flags * action and resource permissions or eliminate its potential impact on investment document protection.
C:Risk acceptance paperwork does not itself remediate wildcard IAM policy grants storage admin across accounts on cloud administrative role; authorized, tested implementation is still required when the risk exceeds tolerance.
