CompTIA CS0-003 Practice Test 28
Question 270
Manufacturing quality lab has investigated living-off-the-land payload staging using a legitimate Windows binary on test workstation. Detection operators report that certificate-management workflows call certutil for trust-store maintenance in approved scripts; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Improve detection by requiring context-aware correlation: correlate certutil decoding with user-writable output and subsequent executable launch
- Automate service shutdown on the first simple match to a utility runs certutil to decode a file from a web cache just before unknown binary execution, without validation or guardrails for product design drawings
- Assign critical severity to every routine activity on test workstation whether or not it matches correlate certutil decoding with user-writable output and subsequent executable launch
- Suppress every future event associated with process telemetry shows certutil -decode plus user-directory payload launch, including events outside certificate-management workflows call certutil for trust-store maintenance in approved scripts
Explanation
Correct Answer
A:Correlate certutil decoding with user-writable output and subsequent executable launch retains the specific threat signal while discriminating against certificate-management workflows call certutil for trust-store maintenance in approved scripts. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
B:An untested, unqualified automation could interrupt product design drawings and cannot distinguish the benign workflow from attacker behavior.
C:Alert severity without distinguishing certificate-management workflows call certutil for trust-store maintenance in approved scripts from malicious conditions would increase noise and operational workload.
D:Suppressing all monitoring would also hide a recurrence of living-off-the-land payload staging using a legitimate Windows binary, even where it threatens product design drawings.
Question 271
At Retail analytics, the security team assesses unmanaged cache. The current issue is Redis responds without authentication on exposed port; assessment evidence states: scanner shows unauthenticated INFO and CONFIG commands. The service is service reachable from vendor VPN. Operational constraints: checkout lookup latency must remain stable. Which assessment approach is most appropriate before recommending a fix?
- Use only an anonymous outside-in scan of unmanaged cache even when service reachable from vendor VPN requires authenticated deployment context
- Use an authorized, scoped validation approach that considers service sensitivity: confirm bind address, ACLs and network reachability safely
- Launch unapproved intrusive exploitation across unmanaged cache during checkout lookup latency must remain stable instead of using a scoped test
- Accept the label Redis responds without authentication on exposed port as confirmed without checking the reported evidence scanner shows unauthenticated INFO and CONFIG commands or actual deployment
Explanation
Correct Answer
B:The evidence scanner shows unauthenticated INFO and CONFIG commands must be evaluated without violating the constraint checkout lookup latency must remain stable. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Asset configuration and the constraints of unmanaged cache matter; external findings alone may misstate or miss the exposed path.
C:Uncontrolled testing may breach service safety, especially because checkout lookup latency must remain stable; authorization and scope are prerequisites.
D:The finding does not establish which live component is affected or whether the exposure service reachable from vendor VPN is real.
Question 272
At Retail analytics, the security team assesses unmanaged cache. The current issue is Redis responds without authentication on exposed port; assessment evidence states: scanner shows unauthenticated INFO and CONFIG commands. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against unmanaged cache, ignoring that checkout lookup latency must remain stable and a safer validation exist
- Confirm the reported condition in the relevant asset context: confirm bind address, ACLs and network reachability safely
- Assume unmanaged cache is safe because another platform with similar software recently passed its own assessment
- Mark scanner shows unauthenticated INFO and CONFIG commands resolved or confirmed solely from the scanner severity without confirm bind address, ACLs and network reachability safely
Explanation
Correct Answer
B:Confirm bind address, ACLs and network reachability safely tests the reported condition scanner shows unauthenticated INFO and CONFIG commands against actual deployment context (service reachable from vendor VPN). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when confirm bind address, ACLs and network reachability safely can provide authorized evidence and checkout lookup latency must remain stable constrains production testing.
C:Security of an unrelated host cannot establish the state of unmanaged cache, whose reported issue is Redis responds without authentication on exposed port.
D:scanner shows unauthenticated INFO and CONFIG commands may be accurate but its actual occurrence and configuration on unmanaged cache must be established before calling it validated.
Question 273
At Retail analytics, the security team assesses unmanaged cache. The current issue is Redis responds without authentication on exposed port; assessment evidence states: scanner shows unauthenticated INFO and CONFIG commands. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Choose the highest nominal scanner severity first while ignoring service reachable from vendor VPN and the consequence to customer shopping data
- Give every vulnerability the same deadline despite Redis responds without authentication on exposed port and business impact on customer shopping data
- Prioritize the confirmed exposure of unmanaged cache, accounting for customer shopping data and the real access path: service reachable from vendor VPN
- Choose whatever finding on unmanaged cache was logged most recently, regardless of actual exploit path or priority
Explanation
Correct Answer
C:Risk depends on practical reachability, threat activity and consequence. The issue Redis responds without authentication on exposed port can affect customer shopping data through service reachable from vendor VPN; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:CVSS describes technical characteristics, not the entirety of exposure and customer shopping data for this deployment.
B:Uniform priority ignores service reachable from vendor VPN, operational harm and customer shopping data; documented context makes triage defensible.
D:Discovery order is not evidence of urgency compared with the actual affected unmanaged cache.
Question 274
At Retail analytics, the security team assesses unmanaged cache. The current issue is Redis responds without authentication on exposed port; assessment evidence states: scanner shows unauthenticated INFO and CONFIG commands. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Leave Redis responds without authentication on exposed port present indefinitely because no incident involving customer shopping data was recorded this week
- Use block Redis from vendor VPN until reconfiguration as permanent closure of the confirmed issue instead of deploying require authenticated TLS connections and narrow firewall rules
- Implement and verify the root-cause fix: require authenticated TLS connections and narrow firewall rules
- Sign an exception document but do not implement or test require authenticated TLS connections and narrow firewall rules on unmanaged cache
Explanation
Correct Answer
C:Require authenticated TLS connections and narrow firewall rules targets the mechanism Redis responds without authentication on exposed port rather than only filtering symptoms. Verification must account for scanner shows unauthenticated INFO and CONFIG commands and continued protection of customer shopping data.
Incorrect Answers
A:No observed attack does not correct the verified condition scanner shows unauthenticated INFO and CONFIG commands or eliminate its potential impact on customer shopping data.
B:The interim control may reduce exposure, but it can leave the underlying Redis responds without authentication on exposed port and should be time-limited with verification and owner oversight.
D:Risk acceptance paperwork does not itself remediate Redis responds without authentication on exposed port on unmanaged cache; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 275
At Retail analytics, the security team assesses unmanaged cache. The current issue is Redis responds without authentication on exposed port; assessment evidence states: scanner shows unauthenticated INFO and CONFIG commands. A permanent correction cannot be deployed immediately because checkout lookup latency must remain stable. Which interim treatment is the safest governed option?
- Accept continued exposure of customer shopping data without any owner, expiry or compensating verification because checkout lookup latency must remain stable
- Claim Redis responds without authentication on exposed port is patched when the change ticket opens, without confirming block Redis from vendor VPN until reconfiguration or a planned permanent change
- Push require authenticated TLS connections and narrow firewall rules immediately to all production systems with no safe change window despite checkout lookup latency must remain stable
- Apply a time-bound compensating measure, block Redis from vendor VPN until reconfiguration, record the residual risk owner and schedule the tested permanent fix
Explanation
Correct Answer
D:Block Redis from vendor VPN until reconfiguration can reduce short-term exposure while checkout lookup latency must remain stable delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because customer shopping data remains at stake.
Incorrect Answers
A:Business criticality increases the need for accountable decisions and review; it does not make customer shopping data irrelevant.
B:A work item is not proof that Redis responds without authentication on exposed port was corrected or even that block Redis from vendor VPN until reconfiguration operates.
C:Ignoring checkout lookup latency must remain stable could cause avoidable service failure and is not a risk-aware remediation process.
Question 276
At Retail analytics, the security team assesses unmanaged cache. The current issue is Redis responds without authentication on exposed port; assessment evidence states: scanner shows unauthenticated INFO and CONFIG commands. The owner reports that require authenticated TLS connections and narrow firewall rules has been deployed. What evidence should close the vulnerability item?
- Use an unrelated server’s clean findings to claim unmanaged cache is fixed without retesting the affected path
- Suppress future results for Redis responds without authentication on exposed port so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using confirm bind address, ACLs and network reachability safely, confirm the vulnerability is gone and record change evidence
- Close scanner shows unauthenticated INFO and CONFIG commands after the deployment tool returns success, without verifying the current state of unmanaged cache
Explanation
Correct Answer
C:Closure requires checking the same affected path identified by scanner shows unauthenticated INFO and CONFIG commands, plus regression impact on unmanaged cache. A change ticket alone is not proof of removal of Redis responds without authentication on exposed port.
Incorrect Answers
A:The result must be tied to unmanaged cache and the actual exposure: service reachable from vendor VPN.
B:Suppression may hide a failed or incomplete fix, leaving customer shopping data exposed despite the administrative record.
D:Process completion is not evidence that scanner shows unauthenticated INFO and CONFIG commands no longer applies to unmanaged cache.
Question 277
At Mobile gaming platform, the incident team supports account login API. A new security event is reported: credential stuffing creates bursts of failed logins and a few successful takeovers. The log clue is: IdP logs show hundreds of accounts attempted from bot infrastructure. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Map the observed behavior in IdP logs show hundreds of accounts attempted from bot infrastructure to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Treat an ATT&CK label for credential stuffing creates bursts of failed logins and a few successful takeovers as a complete recovery instruction without checking evidence or impact
- Assign a final attack-chain stage to account login API without confirming what behavior actually occurred in IdP logs show hundreds of accounts attempted from bot infrastructure
- Attribute credential stuffing creates bursts of failed logins and a few successful takeovers to a named foreign intelligence service using only IdP logs show hundreds of accounts attempted from bot infrastructure
Explanation
Correct Answer
A:Credential stuffing creates bursts of failed logins and a few successful takeovers and IdP logs show hundreds of accounts attempted from bot infrastructure support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
B:A taxonomy is not an incident response plan for account login API; scope and safety constraints still matter.
C:Attack frameworks describe observable stages and techniques; the IdP logs show hundreds of accounts attempted from bot infrastructure must substantiate whichever stage is assigned.
D:Neither credential stuffing creates bursts of failed logins and a few successful takeovers nor IdP logs show hundreds of accounts attempted from bot infrastructure establishes uniquely identifying actor evidence.
Question 278
At Mobile gaming platform, the incident team supports account login API. A new security event is reported: credential stuffing creates bursts of failed logins and a few successful takeovers. The log clue is: IdP logs show hundreds of accounts attempted from bot infrastructure. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Alter original IdP logs show hundreds of accounts attempted from bot infrastructure entries to remove irrelevant records before preserving the forensic timeline
- Rebuild account login API first and collect the volatile evidence for credential stuffing creates bursts of failed logins and a few successful takeovers afterward
- Keep only a screenshot of IdP logs show hundreds of accounts attempted from bot infrastructure, discarding original artifacts such as retain source patterns, successful session IDs and account change audit
- Preserve and hash incident artifacts: retain source patterns, successful session IDs and account change audit
Explanation
Correct Answer
D:Retain source patterns, successful session IDs and account change audit retains relevant source context and integrity checks so the team can reconstruct credential stuffing creates bursts of failed logins and a few successful takeovers and support an auditable chain of custody.
Incorrect Answers
A:Changing the original IdP logs show hundreds of accounts attempted from bot infrastructure compromises provenance and makes later findings harder to verify.
B:Volatile evidence relevant to credential stuffing creates bursts of failed logins and a few successful takeovers may disappear during remediation or reboot.
C:A screenshot cannot replace the underlying retain source patterns, successful session IDs and account change audit needed to establish sequence and integrity.
Question 279
At Mobile gaming platform, the incident team supports account login API. A new security event is reported: credential stuffing creates bursts of failed logins and a few successful takeovers. The log clue is: IdP logs show hundreds of accounts attempted from bot infrastructure. The incident remains active, but account login API is operationally important. Which containment decision is most appropriate now?
- Publish a speculative full-incident attribution notice before constraining the active behavior credential stuffing creates bursts of failed logins and a few successful takeovers
- Disconnect every service at Mobile gaming platform, regardless of whether it has a dependency on the affected account login API
- Erase IdP logs show hundreds of accounts attempted from bot infrastructure to reduce alert volume rather than isolating the observed attacker route
- Execute scoped containment: activate bot controls and revoke suspect sessions without global customer lockout
Explanation
Correct Answer
D:Activate bot controls and revoke suspect sessions without global customer lockout stops or limits the observed path while balancing continuity of account login API. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Communication matters, but active credential stuffing creates bursts of failed logins and a few successful takeovers requires proportionate containment and evidence preservation first.
B:Broad interruption may unnecessarily affect account login API; containment should be scoped to evidenced systems and approved critical-service requirements.
C:Erasing IdP logs show hundreds of accounts attempted from bot infrastructure neither blocks attacker access nor supports a reliable subsequent recovery decision.
Question 280
At Mobile gaming platform, the incident team supports account login API. A new security event is reported: credential stuffing creates bursts of failed logins and a few successful takeovers. The log clue is: IdP logs show hundreds of accounts attempted from bot infrastructure. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Remove the attack’s established access and persistence: force reauthentication of affected users and disable abused recovery mechanism
- Restore account login API without first correcting the access and persistence cause addressed by force reauthentication of affected users and disable abused recovery mechanism
- Use only the original firewall block and assume it has also removed all persistence behind credential stuffing creates bursts of failed logins and a few successful takeovers
- Rewrite the playbook for account login API but leave the confirmed malicious access mechanism active
Explanation
Correct Answer
A:Force reauthentication of affected users and disable abused recovery mechanism targets the mechanism behind credential stuffing creates bursts of failed logins and a few successful takeovers, reducing recurrence when account login API returns to normal operations.
Incorrect Answers
B:Recovery before force reauthentication of affected users and disable abused recovery mechanism could reintroduce the same compromise path.
C:Containment can stop communication without eliminating the root access that produced IdP logs show hundreds of accounts attempted from bot infrastructure.
D:Updated paperwork does not eradicate the mechanism behind credential stuffing creates bursts of failed logins and a few successful takeovers.
