CompTIA CS0-003 Practice Test 3
Question 20
National retail bank is reviewing a security finding affecting internet VPN endpoints: critical exposed gateway vulnerabilities with missed remediation dates. The current reporting problem is that executive dashboard lists only total vulnerability count. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Accept an assertion that network service owner completed the correction with no retest against validated asset exposure, vendor advisory and patch completion evidence
- Give network service owner the same board overview rather than the reproducible records from validated asset exposure, vendor advisory and patch completion evidence
- Provide the original relevant artifacts and validation method from validated asset exposure, vendor advisory and patch completion evidence, tied to affected assets, owners and retest criteria
- Remove the timestamps and correlations from validated asset exposure, vendor advisory and patch completion evidence so the technical report occupies fewer pages
Explanation
Correct Answer
C:Validated asset exposure, vendor advisory and patch completion evidence gives engineers traceable scope and a basis for confirming that network service owner has resolved the identified exposure on internet VPN endpoints.
Incorrect Answers
A:Self-assessment without test artifacts is weaker than verifiable validated asset exposure, vendor advisory and patch completion evidence and agreed acceptance conditions.
B:A high-level board summary cannot identify the concrete validated asset exposure, vendor advisory and patch completion evidence fields needed for technical validation.
D:Such edits break reproducibility of critical exposed gateway vulnerabilities with missed remediation dates and make scope or remediation errors harder to find.
Question 21
National retail bank is reviewing a security finding affecting internet VPN endpoints: critical exposed gateway vulnerabilities with missed remediation dates. The current reporting problem is that executive dashboard lists only total vulnerability count. Stakeholders include risk owners and security operations leads. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Release unconfirmed details about critical exposed gateway vulnerabilities with missed remediation dates externally before evidence and approvals from risk owners and security operations leads have been reconciled
- Coordinate fact-checked messages, recipients and timing with risk owners and security operations leads, preserving applicable legal and incident approval paths
- Withhold notification of critical exposed gateway vulnerabilities with missed remediation dates indefinitely even after verified validated asset exposure, vendor advisory and patch completion evidence meets a binding disclosure threshold
- Give a technical engineer sole authority for every legal or public statement otherwise owned by risk owners and security operations leads
Explanation
Correct Answer
B:The parties risk owners and security operations leads have different responsibilities. Using verified validated asset exposure, vendor advisory and patch completion evidence and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
A:Unconfirmed claims could misrepresent the impact of critical exposed gateway vulnerabilities with missed remediation dates and breach communication obligations.
C:If verified validated asset exposure, vendor advisory and patch completion evidence triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
D:Technical diagnosis does not automatically confer the disclosure authority held by risk owners and security operations leads.
Question 22
National retail bank is reviewing a security finding affecting internet VPN endpoints: critical exposed gateway vulnerabilities with missed remediation dates. The current reporting problem is that executive dashboard lists only total vulnerability count. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Track a defined, evidence-based measure of risk-based SLO breaches and approved remediation milestones, with trend, scope and accountable source
- Measure improvement in risk-based SLO breaches and approved remediation milestones by how many slides were added to the board presentation
- Compare National retail bank teams only by tickets closed, ignoring which services are still exposed to critical exposed gateway vulnerabilities with missed remediation dates
- Redefine risk-based SLO breaches and approved remediation milestones every week until all dashboards appear positive
Explanation
Correct Answer
A:The measure risk-based SLO breaches and approved remediation milestones connects reporting to a change in internet-reachable remote access could enable unauthorized account access, rather than the number of reports or raw alert volume. Trends must use consistent inputs from validated asset exposure, vendor advisory and patch completion evidence.
Incorrect Answers
B:Presentation size does not establish risk-based SLO breaches and approved remediation milestones or whether critical exposed gateway vulnerabilities with missed remediation dates is managed.
C:Tickets can hide unresolved internet-reachable remote access could enable unauthorized account access; a risk-weighted outcome metric is needed.
D:Inconsistent measures cannot support a credible trend for risk-based SLO breaches and approved remediation milestones.
Question 23
National retail bank is reviewing a security finding affecting internet VPN endpoints: critical exposed gateway vulnerabilities with missed remediation dates. The current reporting problem is that executive dashboard lists only total vulnerability count. An action plan is being negotiated, but gateway maintenance windows repeatedly postponed by operations. What reporting recommendation best supports practical remediation?
- Ask the network service owner to document mitigation choices for internet VPN endpoints, service constraints, milestones, approvers and time-bound risk acceptance if needed
- Set an immediate fix deadline for internet VPN endpoints without acknowledging that gateway maintenance windows repeatedly postponed by operations
- Copy a generic checklist for critical exposed gateway vulnerabilities with missed remediation dates without accountable owners, asset scope or milestones
- Give network service owner an unlimited exception because gateway maintenance windows repeatedly postponed by operations rather than reporting residual risk and expiry
Explanation
Correct Answer
A:Gateway maintenance windows repeatedly postponed by operations creates a real implementation constraint. A plan owned by network service owner with measured risk and delegated approvals protects internet-reachable remote access could enable unauthorized account access better than an unrealistic generic deadline.
Incorrect Answers
B:Ignoring gateway maintenance windows repeatedly postponed by operations can turn a security fix into service disruption while failing to clarify remaining risk.
C:A non-accountable template cannot address gateway maintenance windows repeatedly postponed by operations or demonstrate progress on critical exposed gateway vulnerabilities with missed remediation dates.
D:Internet-reachable remote access could enable unauthorized account access still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
Question 24
National retail bank is reviewing a security finding affecting internet VPN endpoints: critical exposed gateway vulnerabilities with missed remediation dates. The current reporting problem is that executive dashboard lists only total vulnerability count. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Use the number of remediation meetings at National retail bank instead of observed change in risk-based SLO breaches and approved remediation milestones as closeout proof
- Discard the pre-change evidence validated asset exposure, vendor advisory and patch completion evidence so that only the improved numbers for risk-based SLO breaches and approved remediation milestones remain
- Report retested validated asset exposure, vendor advisory and patch completion evidence, the outcome against risk-based SLO breaches and approved remediation milestones, remaining exceptions, and owner confirmation
- Close critical exposed gateway vulnerabilities with missed remediation dates based solely on a self-reported completion email from network service owner with no verification
Explanation
Correct Answer
C:Validated asset exposure, vendor advisory and patch completion evidence provides source-linked closure proof. Showing risk-based SLO breaches and approved remediation milestones and residual exceptions verifies whether network service owner actually reduced internet-reachable remote access could enable unauthorized account access rather than merely marking a ticket closed.
Incorrect Answers
A:Meetings do not confirm that critical exposed gateway vulnerabilities with missed remediation dates was corrected or that remaining internet-reachable remote access could enable unauthorized account access is acceptable.
B:Without historical risk-based SLO breaches and approved remediation milestones inputs, leaders cannot validate the claimed improvement or identify recurrence.
D:Self-declared completion does not demonstrate improved risk-based SLO breaches and approved remediation milestones against documented validated asset exposure, vendor advisory and patch completion evidence.
Question 25
At Regional hospital, analysts monitor clinical scheduling desktop. They observe that a signed office application spawns PowerShell with encoded commands after a document opens. Evidence: EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Downgrade a signed office application spawns PowerShell with encoded commands after a document opens solely because the same symptom has not yet appeared on another endpoint
- Announce that EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS conclusively proves theft of patient appointment data before reviewing any sessions or file access
- Treat authorized administration scripts originate from signed management agents and approved task windows as conclusive authorization for the current event without matching process or identity
- Treat the pattern as a hypothesis of malicious document execution through a living-off-the-land interpreter and begin corroborating it with endpoint and network evidence
Explanation
Correct Answer
D:The combination of a signed office application spawns PowerShell with encoded commands after a document opens and EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS is suspicious for malicious document execution through a living-off-the-land interpreter. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting patient appointment data.
Incorrect Answers
A:An intrusion can begin on one asset. The specific indicator on clinical scheduling desktop warrants its own validation before expanding or closing the investigation.
B:EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
C:The legitimate comparator is authorized administration scripts originate from signed management agents and approved task windows; it does not establish that the current event came from the same approved identity or workflow.
Question 26
At Regional hospital, analysts monitor clinical scheduling desktop. They observe that a signed office application spawns PowerShell with encoded commands after a document opens. Evidence: EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS. A separate known-good explanation is: authorized administration scripts originate from signed management agents and approved task windows. Which next analysis most reliably determines what caused the observed event?
- Perform a scoped investigation: decode the command safely and match its endpoint process ancestry to network telemetry
- Suspend telemetry collection on clinical scheduling desktop while waiting for the connection pattern to stop
- Accept a public reputation score for the destination as proof of the origin of EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS, without using decode the command safely and match its endpoint process ancestry to network telemetry
- Summarize EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
A:Decode the command safely and match its endpoint process ancestry to network telemetry ties the evidence on clinical scheduling desktop to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: authorized administration scripts originate from signed management agents and approved task windows.
Incorrect Answers
B:Suppressing telemetry destroys the source needed to investigate malicious document execution through a living-off-the-land interpreter and may conceal further actions.
C:A reputation score may inform triage but cannot establish the origin of EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS or whether the activity matches authorized administration scripts originate from signed management agents and approved task windows.
D:The original EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 27
Regional hospital has a candidate alert for clinical scheduling desktop: EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS. The team argues it is harmless because authorized administration scripts originate from signed management agents and approved task windows. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that a signed office application spawns PowerShell with encoded commands after a document opens is benign
- Distinguish EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS from the approved behavior (authorized administration scripts originate from signed management agents and approved task windows) by validating process, identity and time attribution
- Automatically treat every event resembling EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS as confirmed compromise of clinical scheduling desktop, without checking provenance
- Create a blanket suppression for EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS because authorized administration scripts originate from signed management agents and approved task windows can produce a superficially similar event
Explanation
Correct Answer
B:Authorized administration scripts originate from signed management agents and approved task windows is a plausible alternative, but it must be proven to match the actual source of EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: a signed office application spawns PowerShell with encoded commands after a document opens.
C:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting patient appointment data.
D:Similarity to authorized administration scripts originate from signed management agents and approved task windows does not exclude an attacker from producing the same surface event on clinical scheduling desktop.
Question 28
At Regional hospital, analysts monitor clinical scheduling desktop. They observe that a signed office application spawns PowerShell with encoded commands after a document opens. Evidence: EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS. The team confirms unauthorized behavior and must protect patient appointment data; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: isolate the affected desktop from clinical VLANs while maintaining emergency scheduling fallback
- Disable every production service at Regional hospital without measuring whether its dependencies share the observed malicious path
- Leave the confirmed unauthorized activity on clinical scheduling desktop unrestricted until actual losses of patient appointment data can be measured
- Erase EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS from the evidence archive during the containment change to reduce repeated alerts
Explanation
Correct Answer
A:Isolate the affected desktop from clinical VLANs while maintaining emergency scheduling fallback constrains the observed threat while maintaining necessary service for patient appointment data. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Global shutdown could disrupt patient appointment data without evidence that every system has been affected; scoped isolation is more proportionate.
C:Once unauthorized behavior is confirmed on clinical scheduling desktop, delaying containment could expand the exposure affecting patient appointment data.
D:Eliminating EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS evidence does not contain malicious document execution through a living-off-the-land interpreter and impairs forensic reconstruction.
Question 29
Regional hospital receives a three-month-old threat-intelligence bulletin associating an observable with malicious document execution through a living-off-the-land interpreter. On clinical scheduling desktop, local telemetry reports: EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions malicious document execution through a living-off-the-land interpreter, without checking whether its observable is present on clinical scheduling desktop
- Assess bulletin timeliness and provenance, then corroborate its observables against EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS and affected clinical scheduling desktop
- Dismiss the bulletin solely because Regional hospital has not named the attacker associated with EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS
- Forward the bulletin about malicious document execution through a living-off-the-land interpreter as a confirmed breach of clinical scheduling desktop without hosts, timestamps or confidence caveats
Explanation
Correct Answer
B:An old feed with unknown confidence is not automatic proof of activity at Regional hospital. Comparing its timestamps and provenance with EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS reveals whether the indicator is still relevant to clinical scheduling desktop and patient appointment data.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS.
C:Actor attribution is not required to assess a supported technique, source confidence or relevance to clinical scheduling desktop.
D:Converting the unverified feed into confirmed activity on clinical scheduling desktop may mislead investigators and prompt harmful response for patient appointment data.
Question 30
Regional hospital has investigated malicious document execution through a living-off-the-land interpreter on clinical scheduling desktop. Detection operators report that authorized administration scripts originate from signed management agents and approved task windows; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to a signed office application spawns PowerShell with encoded commands after a document opens, without validation or guardrails for patient appointment data
- Improve detection by requiring context-aware correlation: alert on office-to-shell parentage with encoded arguments while excluding approved management agent ancestry
- Assign critical severity to every routine activity on clinical scheduling desktop whether or not it matches alert on office-to-shell parentage with encoded arguments while excluding approved management agent ancestry
- Suppress every future event associated with EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS, including events outside authorized administration scripts originate from signed management agents and approved task windows
Explanation
Correct Answer
B:Alert on office-to-shell parentage with encoded arguments while excluding approved management agent ancestry retains the specific threat signal while discriminating against authorized administration scripts originate from signed management agents and approved task windows. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt patient appointment data and cannot distinguish the benign workflow from attacker behavior.
C:Alert severity without distinguishing authorized administration scripts originate from signed management agents and approved task windows from malicious conditions would increase noise and operational workload.
D:Suppressing all monitoring would also hide a recurrence of malicious document execution through a living-off-the-land interpreter, even where it threatens patient appointment data.
