CompTIA CS0-003 Practice Test 26
Question 250
At Investment firm, the security team assesses cloud administrative role. The current issue is wildcard IAM policy grants storage admin across accounts; assessment evidence states: policy analyzer flags * action and resource permissions. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use temporarily revoke external assume-role binding as permanent closure of the confirmed issue instead of deploying least-privilege actions and restrictive role trust policy
- Leave wildcard IAM policy grants storage admin across accounts present indefinitely because no incident involving investment document protection was recorded this week
- Sign an exception document but do not implement or test least-privilege actions and restrictive role trust policy on cloud administrative role
- Implement and verify the root-cause fix: least-privilege actions and restrictive role trust policy
Explanation
Correct Answer
D:Least-privilege actions and restrictive role trust policy targets the mechanism wildcard IAM policy grants storage admin across accounts rather than only filtering symptoms. Verification must account for policy analyzer flags * action and resource permissions and continued protection of investment document protection.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying wildcard IAM policy grants storage admin across accounts and should be time-limited with verification and owner oversight.
B:No observed attack does not correct the verified condition policy analyzer flags * action and resource permissions or eliminate its potential impact on investment document protection.
C:Risk acceptance paperwork does not itself remediate wildcard IAM policy grants storage admin across accounts on cloud administrative role; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 251
At Investment firm, the security team assesses cloud administrative role. The current issue is wildcard IAM policy grants storage admin across accounts; assessment evidence states: policy analyzer flags * action and resource permissions. A permanent correction cannot be deployed immediately because quarterly audit needs limited read-only access. Which interim treatment is the safest governed option?
- Apply a time-bound compensating measure, temporarily revoke external assume-role binding, record the residual risk owner and schedule the tested permanent fix
- Claim wildcard IAM policy grants storage admin across accounts is patched when the change ticket opens, without confirming temporarily revoke external assume-role binding or a planned permanent change
- Push least-privilege actions and restrictive role trust policy immediately to all production systems with no safe change window despite quarterly audit needs limited read-only access
- Accept continued exposure of investment document protection without any owner, expiry or compensating verification because quarterly audit needs limited read-only access
Explanation
Correct Answer
A:Temporarily revoke external assume-role binding can reduce short-term exposure while quarterly audit needs limited read-only access delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because investment document protection remains at stake.
Incorrect Answers
B:A work item is not proof that wildcard IAM policy grants storage admin across accounts was corrected or even that temporarily revoke external assume-role binding operates.
C:Ignoring quarterly audit needs limited read-only access could cause avoidable service failure and is not a risk-aware remediation process.
D:Business criticality increases the need for accountable decisions and review; it does not make investment document protection irrelevant.
Question 252
At Investment firm, the security team assesses cloud administrative role. The current issue is wildcard IAM policy grants storage admin across accounts; assessment evidence states: policy analyzer flags * action and resource permissions. The owner reports that least-privilege actions and restrictive role trust policy has been deployed. What evidence should close the vulnerability item?
- Retest the originally affected configuration using simulate effective access with policy test and trust conditions, confirm the vulnerability is gone and record change evidence
- Close policy analyzer flags * action and resource permissions after the deployment tool returns success, without verifying the current state of cloud administrative role
- Suppress future results for wildcard IAM policy grants storage admin across accounts so that the vulnerability dashboard shows a completed remediation
- Use an unrelated server’s clean findings to claim cloud administrative role is fixed without retesting the affected path
Explanation
Correct Answer
A:Closure requires checking the same affected path identified by policy analyzer flags * action and resource permissions, plus regression impact on cloud administrative role. A change ticket alone is not proof of removal of wildcard IAM policy grants storage admin across accounts.
Incorrect Answers
B:Process completion is not evidence that policy analyzer flags * action and resource permissions no longer applies to cloud administrative role.
C:Suppression may hide a failed or incomplete fix, leaving investment document protection exposed despite the administrative record.
D:The result must be tied to cloud administrative role and the actual exposure: cross-account role assumable from partner tenant.
Question 253
At Field insurance company, the incident team supports employee laptop. A new security event is reported: a laptop with client records is reported stolen while encryption state is uncertain. The log clue is: device management shows last heartbeat before theft and stale disk-encryption compliance. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Assign a final attack-chain stage to employee laptop without confirming what behavior actually occurred in device management shows last heartbeat before theft and stale disk-encryption compliance
- Map the observed behavior in device management shows last heartbeat before theft and stale disk-encryption compliance to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Treat an ATT&CK label for a laptop with client records is reported stolen while encryption state is uncertain as a complete recovery instruction without checking evidence or impact
- Attribute a laptop with client records is reported stolen while encryption state is uncertain to a named foreign intelligence service using only device management shows last heartbeat before theft and stale disk-encryption compliance
Explanation
Correct Answer
B:A laptop with client records is reported stolen while encryption state is uncertain and device management shows last heartbeat before theft and stale disk-encryption compliance support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:Attack frameworks describe observable stages and techniques; the device management shows last heartbeat before theft and stale disk-encryption compliance must substantiate whichever stage is assigned.
C:A taxonomy is not an incident response plan for employee laptop; scope and safety constraints still matter.
D:Neither a laptop with client records is reported stolen while encryption state is uncertain nor device management shows last heartbeat before theft and stale disk-encryption compliance establishes uniquely identifying actor evidence.
Question 254
At Field insurance company, the incident team supports employee laptop. A new security event is reported: a laptop with client records is reported stolen while encryption state is uncertain. The log clue is: device management shows last heartbeat before theft and stale disk-encryption compliance. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Rebuild employee laptop first and collect the volatile evidence for a laptop with client records is reported stolen while encryption state is uncertain afterward
- Alter original device management shows last heartbeat before theft and stale disk-encryption compliance entries to remove irrelevant records before preserving the forensic timeline
- Keep only a screenshot of device management shows last heartbeat before theft and stale disk-encryption compliance, discarding original artifacts such as preserve MDM inventory, key escrow history and remote management logs
- Preserve and hash incident artifacts: preserve MDM inventory, key escrow history and remote management logs
Explanation
Correct Answer
D:Preserve MDM inventory, key escrow history and remote management logs retains relevant source context and integrity checks so the team can reconstruct a laptop with client records is reported stolen while encryption state is uncertain and support an auditable chain of custody.
Incorrect Answers
A:Volatile evidence relevant to a laptop with client records is reported stolen while encryption state is uncertain may disappear during remediation or reboot.
B:Changing the original device management shows last heartbeat before theft and stale disk-encryption compliance compromises provenance and makes later findings harder to verify.
C:A screenshot cannot replace the underlying preserve MDM inventory, key escrow history and remote management logs needed to establish sequence and integrity.
Question 255
At Field insurance company, the incident team supports employee laptop. A new security event is reported: a laptop with client records is reported stolen while encryption state is uncertain. The log clue is: device management shows last heartbeat before theft and stale disk-encryption compliance. The incident remains active, but employee laptop is operationally important. Which containment decision is most appropriate now?
- Erase device management shows last heartbeat before theft and stale disk-encryption compliance to reduce alert volume rather than isolating the observed attacker route
- Disconnect every service at Field insurance company, regardless of whether it has a dependency on the affected employee laptop
- Execute scoped containment: disable sessions, revoke tokens and request remote lock without assuming wipe succeeded
- Publish a speculative full-incident attribution notice before constraining the active behavior a laptop with client records is reported stolen while encryption state is uncertain
Explanation
Correct Answer
C:Disable sessions, revoke tokens and request remote lock without assuming wipe succeeded stops or limits the observed path while balancing continuity of employee laptop. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Erasing device management shows last heartbeat before theft and stale disk-encryption compliance neither blocks attacker access nor supports a reliable subsequent recovery decision.
B:Broad interruption may unnecessarily affect employee laptop; containment should be scoped to evidenced systems and approved critical-service requirements.
D:Communication matters, but active a laptop with client records is reported stolen while encryption state is uncertain requires proportionate containment and evidence preservation first.
Question 256
At Field insurance company, the incident team supports employee laptop. A new security event is reported: a laptop with client records is reported stolen while encryption state is uncertain. The log clue is: device management shows last heartbeat before theft and stale disk-encryption compliance. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Restore employee laptop without first correcting the access and persistence cause addressed by rotate exposed cached secrets and address missing encryption policy
- Remove the attack’s established access and persistence: rotate exposed cached secrets and address missing encryption policy
- Use only the original firewall block and assume it has also removed all persistence behind a laptop with client records is reported stolen while encryption state is uncertain
- Rewrite the playbook for employee laptop but leave the confirmed malicious access mechanism active
Explanation
Correct Answer
B:Rotate exposed cached secrets and address missing encryption policy targets the mechanism behind a laptop with client records is reported stolen while encryption state is uncertain, reducing recurrence when employee laptop returns to normal operations.
Incorrect Answers
A:Recovery before rotate exposed cached secrets and address missing encryption policy could reintroduce the same compromise path.
C:Containment can stop communication without eliminating the root access that produced device management shows last heartbeat before theft and stale disk-encryption compliance.
D:Updated paperwork does not eradicate the mechanism behind a laptop with client records is reported stolen while encryption state is uncertain.
Question 257
At Field insurance company, the incident team supports employee laptop. A new security event is reported: a laptop with client records is reported stolen while encryption state is uncertain. The log clue is: device management shows last heartbeat before theft and stale disk-encryption compliance. Containment and eradication are complete. Which recovery acceptance test should precede release of employee laptop to normal users?
- Delete preserved evidence including preserve MDM inventory, key escrow history and remote management logs as soon as the service restarts
- Perform controlled return-to-service validation: verify no subsequent successful login or data access and replacement device compliance
- Approve recovery of employee laptop when it boots, without executing the test verify no subsequent successful login or data access and replacement device compliance
- Expose employee laptop to users before confirming that the conditions behind a laptop with client records is reported stolen while encryption state is uncertain are absent
Explanation
Correct Answer
B:Verify no subsequent successful login or data access and replacement device compliance demonstrates that the compromised pathway is absent while employee laptop again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Evidence retention obligations continue beyond restart; preserve MDM inventory, key escrow history and remote management logs may be required for subsequent review.
C:A boot event cannot prove verify no subsequent successful login or data access and replacement device compliance or protect the service from recurrence of a laptop with client records is reported stolen while encryption state is uncertain.
D:Without a clean functional/security validation, employee laptop could immediately face the same exploit condition.
Question 258
At Field insurance company, the incident team supports employee laptop. A new security event is reported: a laptop with client records is reported stolen while encryption state is uncertain. The log clue is: device management shows last heartbeat before theft and stale disk-encryption compliance. The incident has been contained and normal service has resumed. A post-incident review identifies that disk encryption was exempted for legacy field devices. Which improvement should be prioritized?
- Discipline the whole on-duty response shift rather than examining the documented weakness disk encryption was exempted for legacy field devices
- Close the follow-up for employee laptop merely because restoration completed, without addressing disk encryption was exempted for legacy field devices
- Write a lessons-learned memo about a laptop with client records is reported stolen while encryption state is uncertain with no due date, control owner or validation activity
- Assign an owner and measurable corrective action addressing the root cause: disk encryption was exempted for legacy field devices, with a future effectiveness test
Explanation
Correct Answer
D:Disk encryption was exempted for legacy field devices was the systemic weakness that enabled or worsened a laptop with client records is reported stolen while encryption state is uncertain. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:A personnel-only response lacks support from the documented root cause: disk encryption was exempted for legacy field devices.
B:Service restoration does not address disk encryption was exempted for legacy field devices; ignoring it leaves the next incident likely to follow the same route.
C:An unowned recommendation does not produce a verified control improvement for employee laptop.
Question 259
Public university is reviewing a security finding affecting student data classification program: auditor finds missing sensitive-data handling attestations. The current reporting problem is that compliance report contains policy counts instead of control results. What information should be delivered first to decision makers responsible for decision makers need evidence of operating control effectiveness?
- Report only the number of tickets closed for student data classification program, concealing the unresolved exposure from auditor finds missing sensitive-data handling attestations
- Forward raw telemetry from sampled access records, training test results and signed owner attestations to executives without summarizing consequences for decision makers need evidence of operating control effectiveness
- State that auditor finds missing sensitive-data handling attestations was eliminated because Public university distributed a dashboard on schedule
- Present a concise, evidence-qualified risk and impact summary based on sampled access records, training test results and signed owner attestations, with decisions and uncertainty stated
Explanation
Correct Answer
D:Sampled access records, training test results and signed owner attestations supports a decision-oriented picture of decision makers need evidence of operating control effectiveness while separating confirmed facts from unknowns. This corrects the reporting defect: compliance report contains policy counts instead of control results.
Incorrect Answers
A:Ticket counts do not establish whether auditor finds missing sensitive-data handling attestations still threatens decision makers need evidence of operating control effectiveness.
B:Raw telemetry may support analysts, but decision makers need the meaning for decision makers need evidence of operating control effectiveness and accountable options.
C:Reporting timeliness is not evidence that sampled access records, training test results and signed owner attestations shows full risk elimination.
Question 260
Public university is reviewing a security finding affecting student data classification program: auditor finds missing sensitive-data handling attestations. The current reporting problem is that compliance report contains policy counts instead of control results. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Remove the timestamps and correlations from sampled access records, training test results and signed owner attestations so the technical report occupies fewer pages
- Provide the original relevant artifacts and validation method from sampled access records, training test results and signed owner attestations, tied to affected assets, owners and retest criteria
- Accept an assertion that compliance program owner completed the correction with no retest against sampled access records, training test results and signed owner attestations
- Give compliance program owner the same board overview rather than the reproducible records from sampled access records, training test results and signed owner attestations
Explanation
Correct Answer
B:Sampled access records, training test results and signed owner attestations gives engineers traceable scope and a basis for confirming that compliance program owner has resolved the identified exposure on student data classification program.
Incorrect Answers
A:Such edits break reproducibility of auditor finds missing sensitive-data handling attestations and make scope or remediation errors harder to find.
C:Self-assessment without test artifacts is weaker than verifiable sampled access records, training test results and signed owner attestations and agreed acceptance conditions.
D:A high-level board summary cannot identify the concrete sampled access records, training test results and signed owner attestations fields needed for technical validation.
