CompTIA CS0-003 Practice Test 31
Question 300
At Telecommunications, the security team assesses internet VPN gateway. The current issue is published RCE in gateway firmware; assessment evidence states: asset scan reports vulnerable build and public admin interface. The owner reports that install verified patched gateway image with tested rollback has been deployed. What evidence should close the vulnerability item?
- Retest the originally affected configuration using verify firmware build, vendor advisory and actual interface exposure, confirm the vulnerability is gone and record change evidence
- Use an unrelated server’s clean findings to claim internet VPN gateway is fixed without retesting the affected path
- Close asset scan reports vulnerable build and public admin interface after the deployment tool returns success, without verifying the current state of internet VPN gateway
- Suppress future results for published RCE in gateway firmware so that the vulnerability dashboard shows a completed remediation
Explanation
Correct Answer
A:Closure requires checking the same affected path identified by asset scan reports vulnerable build and public admin interface, plus regression impact on internet VPN gateway. A change ticket alone is not proof of removal of published RCE in gateway firmware.
Incorrect Answers
B:The result must be tied to internet VPN gateway and the actual exposure: internet-facing privileged remote-access edge.
C:Process completion is not evidence that asset scan reports vulnerable build and public admin interface no longer applies to internet VPN gateway.
D:Suppression may hide a failed or incomplete fix, leaving corporate lateral access exposed despite the administrative record.
Question 301
At Public pension agency, analysts apply the Diamond Model to reports concerning treasury mailbox: fraudster changes beneficiary payment instructions through compromised email thread. Evidence includes mail transport and finance change records show new bank details with no verification call, but no adversary has been reliably identified. Which representation preserves the observed relationships without invented attribution?
- Assign a specific nation-state to fraudster changes beneficiary payment instructions through compromised email thread and consider all other Diamond Model elements established automatically
- Treat treasury mailbox as the attacker infrastructure and an unnamed public target as the only victim without analyzing the actual incident path
- Use the Diamond Model name as permission to delete raw mail transport and finance change records show new bank details with no verification call and replace it with a presumed actor narrative
- Record treasury mailbox as the observed victim, the technical action as the capability, any infrastructure evidenced by mail transport and finance change records show new bank details with no verification call, and adversary identity as unknown
Explanation
Correct Answer
D:The Diamond Model separates victim, capability, infrastructure and adversary. The logs support observed behavior at treasury mailbox but do not establish a named adversary.
Incorrect Answers
A:Neither mail transport and finance change records show new bank details with no verification call nor event type identifies a particular actor; attribution requires additional independent intelligence.
B:The provided evidence names treasury mailbox as the affected environment. Reversing roles obscures which entity is actually being victimized.
C:Modeling relates evidence; it does not replace source preservation or justify inventing a history of fraudster changes beneficiary payment instructions through compromised email thread.
Question 302
At Public pension agency, the incident team supports treasury mailbox. A new security event is reported: fraudster changes beneficiary payment instructions through compromised email thread. The log clue is: mail transport and finance change records show new bank details with no verification call. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Preserve and hash incident artifacts: preserve mailbox headers, payment-change ticket, audit metadata and external messages
- Rebuild treasury mailbox first and collect the volatile evidence for fraudster changes beneficiary payment instructions through compromised email thread afterward
- Keep only a screenshot of mail transport and finance change records show new bank details with no verification call, discarding original artifacts such as preserve mailbox headers, payment-change ticket, audit metadata and external messages
- Alter original mail transport and finance change records show new bank details with no verification call entries to remove irrelevant records before preserving the forensic timeline
Explanation
Correct Answer
A:Preserve mailbox headers, payment-change ticket, audit metadata and external messages retains relevant source context and integrity checks so the team can reconstruct fraudster changes beneficiary payment instructions through compromised email thread and support an auditable chain of custody.
Incorrect Answers
B:Volatile evidence relevant to fraudster changes beneficiary payment instructions through compromised email thread may disappear during remediation or reboot.
C:A screenshot cannot replace the underlying preserve mailbox headers, payment-change ticket, audit metadata and external messages needed to establish sequence and integrity.
D:Changing the original mail transport and finance change records show new bank details with no verification call compromises provenance and makes later findings harder to verify.
Question 303
At Public pension agency, the incident team supports treasury mailbox. A new security event is reported: fraudster changes beneficiary payment instructions through compromised email thread. The log clue is: mail transport and finance change records show new bank details with no verification call. The incident remains active, but treasury mailbox is operationally important. Which containment decision is most appropriate now?
- Erase mail transport and finance change records show new bank details with no verification call to reduce alert volume rather than isolating the observed attacker route
- Publish a speculative full-incident attribution notice before constraining the active behavior fraudster changes beneficiary payment instructions through compromised email thread
- Execute scoped containment: pause disputed payments and disable attacker mailbox sessions using authorized treasury procedure
- Disconnect every service at Public pension agency, regardless of whether it has a dependency on the affected treasury mailbox
Explanation
Correct Answer
C:Pause disputed payments and disable attacker mailbox sessions using authorized treasury procedure stops or limits the observed path while balancing continuity of treasury mailbox. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Erasing mail transport and finance change records show new bank details with no verification call neither blocks attacker access nor supports a reliable subsequent recovery decision.
B:Communication matters, but active fraudster changes beneficiary payment instructions through compromised email thread requires proportionate containment and evidence preservation first.
D:Broad interruption may unnecessarily affect treasury mailbox; containment should be scoped to evidenced systems and approved critical-service requirements.
Question 304
At Public pension agency, the incident team supports treasury mailbox. A new security event is reported: fraudster changes beneficiary payment instructions through compromised email thread. The log clue is: mail transport and finance change records show new bank details with no verification call. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Rewrite the playbook for treasury mailbox but leave the confirmed malicious access mechanism active
- Restore treasury mailbox without first correcting the access and persistence cause addressed by remove forwarding rules, reset credentials and enforce independent bank-change verification
- Remove the attack’s established access and persistence: remove forwarding rules, reset credentials and enforce independent bank-change verification
- Use only the original firewall block and assume it has also removed all persistence behind fraudster changes beneficiary payment instructions through compromised email thread
Explanation
Correct Answer
C:Remove forwarding rules, reset credentials and enforce independent bank-change verification targets the mechanism behind fraudster changes beneficiary payment instructions through compromised email thread, reducing recurrence when treasury mailbox returns to normal operations.
Incorrect Answers
A:Updated paperwork does not eradicate the mechanism behind fraudster changes beneficiary payment instructions through compromised email thread.
B:Recovery before remove forwarding rules, reset credentials and enforce independent bank-change verification could reintroduce the same compromise path.
D:Containment can stop communication without eliminating the root access that produced mail transport and finance change records show new bank details with no verification call.
Question 305
At Public pension agency, the incident team supports treasury mailbox. A new security event is reported: fraudster changes beneficiary payment instructions through compromised email thread. The log clue is: mail transport and finance change records show new bank details with no verification call. Containment and eradication are complete. Which recovery acceptance test should precede release of treasury mailbox to normal users?
- Perform controlled return-to-service validation: reconcile pending payments and test authorization workflow before release
- Approve recovery of treasury mailbox when it boots, without executing the test reconcile pending payments and test authorization workflow before release
- Expose treasury mailbox to users before confirming that the conditions behind fraudster changes beneficiary payment instructions through compromised email thread are absent
- Delete preserved evidence including preserve mailbox headers, payment-change ticket, audit metadata and external messages as soon as the service restarts
Explanation
Correct Answer
A:Reconcile pending payments and test authorization workflow before release demonstrates that the compromised pathway is absent while treasury mailbox again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
B:A boot event cannot prove reconcile pending payments and test authorization workflow before release or protect the service from recurrence of fraudster changes beneficiary payment instructions through compromised email thread.
C:Without a clean functional/security validation, treasury mailbox could immediately face the same exploit condition.
D:Evidence retention obligations continue beyond restart; preserve mailbox headers, payment-change ticket, audit metadata and external messages may be required for subsequent review.
Question 306
At Public pension agency, the incident team supports treasury mailbox. A new security event is reported: fraudster changes beneficiary payment instructions through compromised email thread. The log clue is: mail transport and finance change records show new bank details with no verification call. The incident has been contained and normal service has resumed. A post-incident review identifies that payment update procedures trusted email alone without second channel. Which improvement should be prioritized?
- Close the follow-up for treasury mailbox merely because restoration completed, without addressing payment update procedures trusted email alone without second channel
- Discipline the whole on-duty response shift rather than examining the documented weakness payment update procedures trusted email alone without second channel
- Write a lessons-learned memo about fraudster changes beneficiary payment instructions through compromised email thread with no due date, control owner or validation activity
- Assign an owner and measurable corrective action addressing the root cause: payment update procedures trusted email alone without second channel, with a future effectiveness test
Explanation
Correct Answer
D:Payment update procedures trusted email alone without second channel was the systemic weakness that enabled or worsened fraudster changes beneficiary payment instructions through compromised email thread. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:Service restoration does not address payment update procedures trusted email alone without second channel; ignoring it leaves the next incident likely to follow the same route.
B:A personnel-only response lacks support from the documented root cause: payment update procedures trusted email alone without second channel.
C:An unowned recommendation does not produce a verified control improvement for treasury mailbox.
Question 307
National logistics company is reviewing a security finding affecting warehouse malware drill: tabletop exposes a slow contact chain for facility shutdown. The current reporting problem is that post-exercise memo congratulates team without documenting delays. What information should be delivered first to decision makers responsible for specific decisions and owners need measurable followup?
- State that tabletop exposes a slow contact chain for facility shutdown was eliminated because National logistics company distributed a dashboard on schedule
- Report only the number of tickets closed for warehouse malware drill, concealing the unresolved exposure from tabletop exposes a slow contact chain for facility shutdown
- Forward raw telemetry from tabletop timestamps, escalation call notes and missed approvals to executives without summarizing consequences for specific decisions and owners need measurable followup
- Present a concise, evidence-qualified risk and impact summary based on tabletop timestamps, escalation call notes and missed approvals, with decisions and uncertainty stated
Explanation
Correct Answer
D:Tabletop timestamps, escalation call notes and missed approvals supports a decision-oriented picture of specific decisions and owners need measurable followup while separating confirmed facts from unknowns. This corrects the reporting defect: post-exercise memo congratulates team without documenting delays.
Incorrect Answers
A:Reporting timeliness is not evidence that tabletop timestamps, escalation call notes and missed approvals shows full risk elimination.
B:Ticket counts do not establish whether tabletop exposes a slow contact chain for facility shutdown still threatens specific decisions and owners need measurable followup.
C:Raw telemetry may support analysts, but decision makers need the meaning for specific decisions and owners need measurable followup and accountable options.
Question 308
National logistics company is reviewing a security finding affecting warehouse malware drill: tabletop exposes a slow contact chain for facility shutdown. The current reporting problem is that post-exercise memo congratulates team without documenting delays. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Give BC/IR program manager the same board overview rather than the reproducible records from tabletop timestamps, escalation call notes and missed approvals
- Provide the original relevant artifacts and validation method from tabletop timestamps, escalation call notes and missed approvals, tied to affected assets, owners and retest criteria
- Accept an assertion that BC/IR program manager completed the correction with no retest against tabletop timestamps, escalation call notes and missed approvals
- Remove the timestamps and correlations from tabletop timestamps, escalation call notes and missed approvals so the technical report occupies fewer pages
Explanation
Correct Answer
B:Tabletop timestamps, escalation call notes and missed approvals gives engineers traceable scope and a basis for confirming that BC/IR program manager has resolved the identified exposure on warehouse malware drill.
Incorrect Answers
A:A high-level board summary cannot identify the concrete tabletop timestamps, escalation call notes and missed approvals fields needed for technical validation.
C:Self-assessment without test artifacts is weaker than verifiable tabletop timestamps, escalation call notes and missed approvals and agreed acceptance conditions.
D:Such edits break reproducibility of tabletop exposes a slow contact chain for facility shutdown and make scope or remediation errors harder to find.
Question 309
National logistics company is reviewing a security finding affecting warehouse malware drill: tabletop exposes a slow contact chain for facility shutdown. The current reporting problem is that post-exercise memo congratulates team without documenting delays. Stakeholders include business continuity leader and SOC. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Release unconfirmed details about tabletop exposes a slow contact chain for facility shutdown externally before evidence and approvals from business continuity leader and SOC have been reconciled
- Give a technical engineer sole authority for every legal or public statement otherwise owned by business continuity leader and SOC
- Withhold notification of tabletop exposes a slow contact chain for facility shutdown indefinitely even after verified tabletop timestamps, escalation call notes and missed approvals meets a binding disclosure threshold
- Coordinate fact-checked messages, recipients and timing with business continuity leader and SOC, preserving applicable legal and incident approval paths
Explanation
Correct Answer
D:The parties business continuity leader and SOC have different responsibilities. Using verified tabletop timestamps, escalation call notes and missed approvals and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
A:Unconfirmed claims could misrepresent the impact of tabletop exposes a slow contact chain for facility shutdown and breach communication obligations.
B:Technical diagnosis does not automatically confer the disclosure authority held by business continuity leader and SOC.
C:If verified tabletop timestamps, escalation call notes and missed approvals triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
Question 310
National logistics company is reviewing a security finding affecting warehouse malware drill: tabletop exposes a slow contact chain for facility shutdown. The current reporting problem is that post-exercise memo congratulates team without documenting delays. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Track a defined, evidence-based measure of owner-assigned corrective actions and retest dates, with trend, scope and accountable source
- Compare National logistics company teams only by tickets closed, ignoring which services are still exposed to tabletop exposes a slow contact chain for facility shutdown
- Measure improvement in owner-assigned corrective actions and retest dates by how many slides were added to the board presentation
- Redefine owner-assigned corrective actions and retest dates every week until all dashboards appear positive
Explanation
Correct Answer
A:The measure owner-assigned corrective actions and retest dates connects reporting to a change in specific decisions and owners need measurable followup, rather than the number of reports or raw alert volume. Trends must use consistent inputs from tabletop timestamps, escalation call notes and missed approvals.
Incorrect Answers
B:Tickets can hide unresolved specific decisions and owners need measurable followup; a risk-weighted outcome metric is needed.
C:Presentation size does not establish owner-assigned corrective actions and retest dates or whether tabletop exposes a slow contact chain for facility shutdown is managed.
D:Inconsistent measures cannot support a credible trend for owner-assigned corrective actions and retest dates.
