CompTIA CS0-003 Practice Test 30
Question 290
At National rail service, analysts monitor crew scheduling server. They observe that outbound SSH traffic to port 2222 spikes after a maintenance window ends. Evidence: NetFlow shows gigabytes leaving a server with no approved remote maintenance session. A separate known-good explanation is: authorized vendor SSH sessions use a bastion and fixed service port. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of NetFlow shows gigabytes leaving a server with no approved remote maintenance session, without using correlate source process, bastion logs and destination IP reputation
- Suspend telemetry collection on crew scheduling server while waiting for the connection pattern to stop
- Perform a scoped investigation: correlate source process, bastion logs and destination IP reputation
- Summarize NetFlow shows gigabytes leaving a server with no approved remote maintenance session into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
C:Correlate source process, bastion logs and destination IP reputation ties the evidence on crew scheduling server to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: authorized vendor SSH sessions use a bastion and fixed service port.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of NetFlow shows gigabytes leaving a server with no approved remote maintenance session or whether the activity matches authorized vendor SSH sessions use a bastion and fixed service port.
B:Suppressing telemetry destroys the source needed to investigate unauthorized remote channel or data transfer over alternate SSH port and may conceal further actions.
D:The original NetFlow shows gigabytes leaving a server with no approved remote maintenance session must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 291
National rail service has a candidate alert for crew scheduling server: NetFlow shows gigabytes leaving a server with no approved remote maintenance session. The team argues it is harmless because authorized vendor SSH sessions use a bastion and fixed service port. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that outbound SSH traffic to port 2222 spikes after a maintenance window ends is benign
- Automatically treat every event resembling NetFlow shows gigabytes leaving a server with no approved remote maintenance session as confirmed compromise of crew scheduling server, without checking provenance
- Distinguish NetFlow shows gigabytes leaving a server with no approved remote maintenance session from the approved behavior (authorized vendor SSH sessions use a bastion and fixed service port) by validating process, identity and time attribution
- Create a blanket suppression for NetFlow shows gigabytes leaving a server with no approved remote maintenance session because authorized vendor SSH sessions use a bastion and fixed service port can produce a superficially similar event
Explanation
Correct Answer
C:Authorized vendor SSH sessions use a bastion and fixed service port is a plausible alternative, but it must be proven to match the actual source of NetFlow shows gigabytes leaving a server with no approved remote maintenance session. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: outbound SSH traffic to port 2222 spikes after a maintenance window ends.
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting driver rosters.
D:Similarity to authorized vendor SSH sessions use a bastion and fixed service port does not exclude an attacker from producing the same surface event on crew scheduling server.
Question 292
At National rail service, analysts monitor crew scheduling server. They observe that outbound SSH traffic to port 2222 spikes after a maintenance window ends. Evidence: NetFlow shows gigabytes leaving a server with no approved remote maintenance session. The team confirms unauthorized behavior and must protect driver rosters; legitimate service continuity remains necessary. Which containment decision is best?
- Disable every production service at National rail service without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: block the off-bastion flow and protect crew scheduling through standby service
- Erase NetFlow shows gigabytes leaving a server with no approved remote maintenance session from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on crew scheduling server unrestricted until actual losses of driver rosters can be measured
Explanation
Correct Answer
B:Block the off-bastion flow and protect crew scheduling through standby service constrains the observed threat while maintaining necessary service for driver rosters. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Global shutdown could disrupt driver rosters without evidence that every system has been affected; scoped isolation is more proportionate.
C:Eliminating NetFlow shows gigabytes leaving a server with no approved remote maintenance session evidence does not contain unauthorized remote channel or data transfer over alternate SSH port and impairs forensic reconstruction.
D:Once unauthorized behavior is confirmed on crew scheduling server, delaying containment could expand the exposure affecting driver rosters.
Question 293
At National rail service, analysts have investigated an initial alert involving crew scheduling server and need to scope related activity. Original event: NetFlow shows gigabytes leaving a server with no approved remote maintenance session. Which threat-hunt pivot is best grounded in this observation?
- Mark every host adjacent to crew scheduling server compromised by assumption without comparing activity-linked observables
- Pivot across the environment: pivot on atypical destination and SSH port across server fleet
- Use the previous month’s overall alert closure count instead of pivoting on NetFlow shows gigabytes leaving a server with no approved remote maintenance session across related identities and systems
- Stop scoping once the initial crew scheduling server has been contained, even though pivot on atypical destination and SSH port across server fleet has not been attempted
Explanation
Correct Answer
B:Pivot on atypical destination and SSH port across server fleet extends the investigation from the specific clue, NetFlow shows gigabytes leaving a server with no approved remote maintenance session, to related activity while preserving host and user attribution. This estimates the scope of potential unauthorized remote channel or data transfer over alternate SSH port.
Incorrect Answers
A:Proximity to crew scheduling server is not proof of exposure; use the activity-linked pivot to identify actual relationships.
C:Historical alert volume does not trace the shared indicator or determine whether unauthorized remote channel or data transfer over alternate SSH port spread beyond crew scheduling server.
D:The initiating host may not be the only affected one; scoping requires examining the connected evidence NetFlow shows gigabytes leaving a server with no approved remote maintenance session.
Question 294
National rail service has investigated unauthorized remote channel or data transfer over alternate SSH port on crew scheduling server. Detection operators report that authorized vendor SSH sessions use a bastion and fixed service port; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Suppress every future event associated with NetFlow shows gigabytes leaving a server with no approved remote maintenance session, including events outside authorized vendor SSH sessions use a bastion and fixed service port
- Assign critical severity to every routine activity on crew scheduling server whether or not it matches alert on post-maintenance SSH egress lacking bastion session attribution
- Automate service shutdown on the first simple match to outbound SSH traffic to port 2222 spikes after a maintenance window ends, without validation or guardrails for driver rosters
- Improve detection by requiring context-aware correlation: alert on post-maintenance SSH egress lacking bastion session attribution
Explanation
Correct Answer
D:Alert on post-maintenance SSH egress lacking bastion session attribution retains the specific threat signal while discriminating against authorized vendor SSH sessions use a bastion and fixed service port. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Suppressing all monitoring would also hide a recurrence of unauthorized remote channel or data transfer over alternate SSH port, even where it threatens driver rosters.
B:Alert severity without distinguishing authorized vendor SSH sessions use a bastion and fixed service port from malicious conditions would increase noise and operational workload.
C:An untested, unqualified automation could interrupt driver rosters and cannot distinguish the benign workflow from attacker behavior.
Question 295
At Telecommunications, the security team assesses internet VPN gateway. The current issue is published RCE in gateway firmware; assessment evidence states: asset scan reports vulnerable build and public admin interface. The service is internet-facing privileged remote-access edge. Operational constraints: remote field engineers depend on gateway at night. Which assessment approach is most appropriate before recommending a fix?
- Use an authorized, scoped validation approach that considers service sensitivity: verify firmware build, vendor advisory and actual interface exposure
- Use only an anonymous outside-in scan of internet VPN gateway even when internet-facing privileged remote-access edge requires authenticated deployment context
- Accept the label published RCE in gateway firmware as confirmed without checking the reported evidence asset scan reports vulnerable build and public admin interface or actual deployment
- Launch unapproved intrusive exploitation across internet VPN gateway during remote field engineers depend on gateway at night instead of using a scoped test
Explanation
Correct Answer
A:The evidence asset scan reports vulnerable build and public admin interface must be evaluated without violating the constraint remote field engineers depend on gateway at night. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
B:Asset configuration and the constraints of internet VPN gateway matter; external findings alone may misstate or miss the exposed path.
C:The finding does not establish which live component is affected or whether the exposure internet-facing privileged remote-access edge is real.
D:Uncontrolled testing may breach service safety, especially because remote field engineers depend on gateway at night; authorization and scope are prerequisites.
Question 296
At Telecommunications, the security team assesses internet VPN gateway. The current issue is published RCE in gateway firmware; assessment evidence states: asset scan reports vulnerable build and public admin interface. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against internet VPN gateway, ignoring that remote field engineers depend on gateway at night and a safer validation exist
- Confirm the reported condition in the relevant asset context: verify firmware build, vendor advisory and actual interface exposure
- Assume internet VPN gateway is safe because another platform with similar software recently passed its own assessment
- Mark asset scan reports vulnerable build and public admin interface resolved or confirmed solely from the scanner severity without verify firmware build, vendor advisory and actual interface exposure
Explanation
Correct Answer
B:Verify firmware build, vendor advisory and actual interface exposure tests the reported condition asset scan reports vulnerable build and public admin interface against actual deployment context (internet-facing privileged remote-access edge). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when verify firmware build, vendor advisory and actual interface exposure can provide authorized evidence and remote field engineers depend on gateway at night constrains production testing.
C:Security of an unrelated host cannot establish the state of internet VPN gateway, whose reported issue is published RCE in gateway firmware.
D:asset scan reports vulnerable build and public admin interface may be accurate but its actual occurrence and configuration on internet VPN gateway must be established before calling it validated.
Question 297
At Telecommunications, the security team assesses internet VPN gateway. The current issue is published RCE in gateway firmware; assessment evidence states: asset scan reports vulnerable build and public admin interface. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Choose the highest nominal scanner severity first while ignoring internet-facing privileged remote-access edge and the consequence to corporate lateral access
- Give every vulnerability the same deadline despite published RCE in gateway firmware and business impact on corporate lateral access
- Choose whatever finding on internet VPN gateway was logged most recently, regardless of actual exploit path or priority
- Prioritize the confirmed exposure of internet VPN gateway, accounting for corporate lateral access and the real access path: internet-facing privileged remote-access edge
Explanation
Correct Answer
D:Risk depends on practical reachability, threat activity and consequence. The issue published RCE in gateway firmware can affect corporate lateral access through internet-facing privileged remote-access edge; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:CVSS describes technical characteristics, not the entirety of exposure and corporate lateral access for this deployment.
B:Uniform priority ignores internet-facing privileged remote-access edge, operational harm and corporate lateral access; documented context makes triage defensible.
C:Discovery order is not evidence of urgency compared with the actual affected internet VPN gateway.
Question 298
At Telecommunications, the security team assesses internet VPN gateway. The current issue is published RCE in gateway firmware; assessment evidence states: asset scan reports vulnerable build and public admin interface. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use restrict management interface to bastion and enable enhanced monitoring as permanent closure of the confirmed issue instead of deploying install verified patched gateway image with tested rollback
- Sign an exception document but do not implement or test install verified patched gateway image with tested rollback on internet VPN gateway
- Leave published RCE in gateway firmware present indefinitely because no incident involving corporate lateral access was recorded this week
- Implement and verify the root-cause fix: install verified patched gateway image with tested rollback
Explanation
Correct Answer
D:Install verified patched gateway image with tested rollback targets the mechanism published RCE in gateway firmware rather than only filtering symptoms. Verification must account for asset scan reports vulnerable build and public admin interface and continued protection of corporate lateral access.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying published RCE in gateway firmware and should be time-limited with verification and owner oversight.
B:Risk acceptance paperwork does not itself remediate published RCE in gateway firmware on internet VPN gateway; authorized, tested implementation is still required when the risk exceeds tolerance.
C:No observed attack does not correct the verified condition asset scan reports vulnerable build and public admin interface or eliminate its potential impact on corporate lateral access.
Question 299
At Telecommunications, the security team assesses internet VPN gateway. The current issue is published RCE in gateway firmware; assessment evidence states: asset scan reports vulnerable build and public admin interface. A permanent correction cannot be deployed immediately because remote field engineers depend on gateway at night. Which interim treatment is the safest governed option?
- Claim published RCE in gateway firmware is patched when the change ticket opens, without confirming restrict management interface to bastion and enable enhanced monitoring or a planned permanent change
- Accept continued exposure of corporate lateral access without any owner, expiry or compensating verification because remote field engineers depend on gateway at night
- Apply a time-bound compensating measure, restrict management interface to bastion and enable enhanced monitoring, record the residual risk owner and schedule the tested permanent fix
- Push install verified patched gateway image with tested rollback immediately to all production systems with no safe change window despite remote field engineers depend on gateway at night
Explanation
Correct Answer
C:Restrict management interface to bastion and enable enhanced monitoring can reduce short-term exposure while remote field engineers depend on gateway at night delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because corporate lateral access remains at stake.
Incorrect Answers
A:A work item is not proof that published RCE in gateway firmware was corrected or even that restrict management interface to bastion and enable enhanced monitoring operates.
B:Business criticality increases the need for accountable decisions and review; it does not make corporate lateral access irrelevant.
D:Ignoring remote field engineers depend on gateway at night could cause avoidable service failure and is not a risk-aware remediation process.
Question 300
At Telecommunications, the security team assesses internet VPN gateway. The current issue is published RCE in gateway firmware; assessment evidence states: asset scan reports vulnerable build and public admin interface. The owner reports that install verified patched gateway image with tested rollback has been deployed. What evidence should close the vulnerability item?
- Retest the originally affected configuration using verify firmware build, vendor advisory and actual interface exposure, confirm the vulnerability is gone and record change evidence
- Use an unrelated server’s clean findings to claim internet VPN gateway is fixed without retesting the affected path
- Close asset scan reports vulnerable build and public admin interface after the deployment tool returns success, without verifying the current state of internet VPN gateway
- Suppress future results for published RCE in gateway firmware so that the vulnerability dashboard shows a completed remediation
Explanation
Correct Answer
A:Closure requires checking the same affected path identified by asset scan reports vulnerable build and public admin interface, plus regression impact on internet VPN gateway. A change ticket alone is not proof of removal of published RCE in gateway firmware.
Incorrect Answers
B:The result must be tied to internet VPN gateway and the actual exposure: internet-facing privileged remote-access edge.
C:Process completion is not evidence that asset scan reports vulnerable build and public admin interface no longer applies to internet VPN gateway.
D:Suppression may hide a failed or incomplete fix, leaving corporate lateral access exposed despite the administrative record.
