CompTIA CS0-003 Practice Test 32
Question 310
National logistics company is reviewing a security finding affecting warehouse malware drill: tabletop exposes a slow contact chain for facility shutdown. The current reporting problem is that post-exercise memo congratulates team without documenting delays. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Track a defined, evidence-based measure of owner-assigned corrective actions and retest dates, with trend, scope and accountable source
- Compare National logistics company teams only by tickets closed, ignoring which services are still exposed to tabletop exposes a slow contact chain for facility shutdown
- Measure improvement in owner-assigned corrective actions and retest dates by how many slides were added to the board presentation
- Redefine owner-assigned corrective actions and retest dates every week until all dashboards appear positive
Explanation
Correct Answer
A:The measure owner-assigned corrective actions and retest dates connects reporting to a change in specific decisions and owners need measurable followup, rather than the number of reports or raw alert volume. Trends must use consistent inputs from tabletop timestamps, escalation call notes and missed approvals.
Incorrect Answers
B:Tickets can hide unresolved specific decisions and owners need measurable followup; a risk-weighted outcome metric is needed.
C:Presentation size does not establish owner-assigned corrective actions and retest dates or whether tabletop exposes a slow contact chain for facility shutdown is managed.
D:Inconsistent measures cannot support a credible trend for owner-assigned corrective actions and retest dates.
Question 311
National logistics company is reviewing a security finding affecting warehouse malware drill: tabletop exposes a slow contact chain for facility shutdown. The current reporting problem is that post-exercise memo congratulates team without documenting delays. An action plan is being negotiated, but facilities have different after-hours contacts. What reporting recommendation best supports practical remediation?
- Set an immediate fix deadline for warehouse malware drill without acknowledging that facilities have different after-hours contacts
- Copy a generic checklist for tabletop exposes a slow contact chain for facility shutdown without accountable owners, asset scope or milestones
- Ask the BC/IR program manager to document mitigation choices for warehouse malware drill, service constraints, milestones, approvers and time-bound risk acceptance if needed
- Give BC/IR program manager an unlimited exception because facilities have different after-hours contacts rather than reporting residual risk and expiry
Explanation
Correct Answer
C:Facilities have different after-hours contacts creates a real implementation constraint. A plan owned by BC/IR program manager with measured risk and delegated approvals protects specific decisions and owners need measurable followup better than an unrealistic generic deadline.
Incorrect Answers
A:Ignoring facilities have different after-hours contacts can turn a security fix into service disruption while failing to clarify remaining risk.
B:A non-accountable template cannot address facilities have different after-hours contacts or demonstrate progress on tabletop exposes a slow contact chain for facility shutdown.
D:Specific decisions and owners need measurable followup still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
Question 312
National logistics company is reviewing a security finding affecting warehouse malware drill: tabletop exposes a slow contact chain for facility shutdown. The current reporting problem is that post-exercise memo congratulates team without documenting delays. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Use the number of remediation meetings at National logistics company instead of observed change in owner-assigned corrective actions and retest dates as closeout proof
- Close tabletop exposes a slow contact chain for facility shutdown based solely on a self-reported completion email from BC/IR program manager with no verification
- Discard the pre-change evidence tabletop timestamps, escalation call notes and missed approvals so that only the improved numbers for owner-assigned corrective actions and retest dates remain
- Report retested tabletop timestamps, escalation call notes and missed approvals, the outcome against owner-assigned corrective actions and retest dates, remaining exceptions, and owner confirmation
Explanation
Correct Answer
D:Tabletop timestamps, escalation call notes and missed approvals provides source-linked closure proof. Showing owner-assigned corrective actions and retest dates and residual exceptions verifies whether BC/IR program manager actually reduced specific decisions and owners need measurable followup rather than merely marking a ticket closed.
Incorrect Answers
A:Meetings do not confirm that tabletop exposes a slow contact chain for facility shutdown was corrected or that remaining specific decisions and owners need measurable followup is acceptable.
B:Self-declared completion does not demonstrate improved owner-assigned corrective actions and retest dates against documented tabletop timestamps, escalation call notes and missed approvals.
C:Without historical owner-assigned corrective actions and retest dates inputs, leaders cannot validate the claimed improvement or identify recurrence.
Question 313
At Retail payment platform, analysts monitor container orchestration worker. They observe that one namespace suddenly saturates CPU while spawning an unfamiliar mining process. Evidence: runtime telemetry links new image digest to outbound mining-pool protocol. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of compromised container image running cryptomining workload and begin corroborating it with endpoint and network evidence
- Downgrade one namespace suddenly saturates CPU while spawning an unfamiliar mining process solely because the same symptom has not yet appeared on another endpoint
- Treat approved load tests run on designated namespaces with signed image manifests as conclusive authorization for the current event without matching process or identity
- Announce that runtime telemetry links new image digest to outbound mining-pool protocol conclusively proves theft of checkout availability before reviewing any sessions or file access
Explanation
Correct Answer
A:The combination of one namespace suddenly saturates CPU while spawning an unfamiliar mining process and runtime telemetry links new image digest to outbound mining-pool protocol is suspicious for compromised container image running cryptomining workload. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting checkout availability.
Incorrect Answers
B:An intrusion can begin on one asset. The specific indicator on container orchestration worker warrants its own validation before expanding or closing the investigation.
C:The legitimate comparator is approved load tests run on designated namespaces with signed image manifests; it does not establish that the current event came from the same approved identity or workflow.
D:runtime telemetry links new image digest to outbound mining-pool protocol is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
Question 314
At Retail payment platform, analysts monitor container orchestration worker. They observe that one namespace suddenly saturates CPU while spawning an unfamiliar mining process. Evidence: runtime telemetry links new image digest to outbound mining-pool protocol. A separate known-good explanation is: approved load tests run on designated namespaces with signed image manifests. Which next analysis most reliably determines what caused the observed event?
- Summarize runtime telemetry links new image digest to outbound mining-pool protocol into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on container orchestration worker while waiting for the connection pattern to stop
- Perform a scoped investigation: compare image digests, admission records and runtime processes
- Accept a public reputation score for the destination as proof of the origin of runtime telemetry links new image digest to outbound mining-pool protocol, without using compare image digests, admission records and runtime processes
Explanation
Correct Answer
C:Compare image digests, admission records and runtime processes ties the evidence on container orchestration worker to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved load tests run on designated namespaces with signed image manifests.
Incorrect Answers
A:The original runtime telemetry links new image digest to outbound mining-pool protocol must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
B:Suppressing telemetry destroys the source needed to investigate compromised container image running cryptomining workload and may conceal further actions.
D:A reputation score may inform triage but cannot establish the origin of runtime telemetry links new image digest to outbound mining-pool protocol or whether the activity matches approved load tests run on designated namespaces with signed image manifests.
Question 315
Retail payment platform has a candidate alert for container orchestration worker: runtime telemetry links new image digest to outbound mining-pool protocol. The team argues it is harmless because approved load tests run on designated namespaces with signed image manifests. What is the most defensible false-positive assessment?
- Distinguish runtime telemetry links new image digest to outbound mining-pool protocol from the approved behavior (approved load tests run on designated namespaces with signed image manifests) by validating process, identity and time attribution
- Automatically treat every event resembling runtime telemetry links new image digest to outbound mining-pool protocol as confirmed compromise of container orchestration worker, without checking provenance
- Create a blanket suppression for runtime telemetry links new image digest to outbound mining-pool protocol because approved load tests run on designated namespaces with signed image manifests can produce a superficially similar event
- Interpret an absence of existing vendor signatures as proof that one namespace suddenly saturates CPU while spawning an unfamiliar mining process is benign
Explanation
Correct Answer
A:Approved load tests run on designated namespaces with signed image manifests is a plausible alternative, but it must be proven to match the actual source of runtime telemetry links new image digest to outbound mining-pool protocol. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting checkout availability.
C:Similarity to approved load tests run on designated namespaces with signed image manifests does not exclude an attacker from producing the same surface event on container orchestration worker.
D:Absence of a signature does not refute the concrete behavior: one namespace suddenly saturates CPU while spawning an unfamiliar mining process.
Question 316
At Retail payment platform, analysts monitor container orchestration worker. They observe that one namespace suddenly saturates CPU while spawning an unfamiliar mining process. Evidence: runtime telemetry links new image digest to outbound mining-pool protocol. The team confirms unauthorized behavior and must protect checkout availability; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: quarantine the offending namespace and revoke its image registry token
- Erase runtime telemetry links new image digest to outbound mining-pool protocol from the evidence archive during the containment change to reduce repeated alerts
- Disable every production service at Retail payment platform without measuring whether its dependencies share the observed malicious path
- Leave the confirmed unauthorized activity on container orchestration worker unrestricted until actual losses of checkout availability can be measured
Explanation
Correct Answer
A:Quarantine the offending namespace and revoke its image registry token constrains the observed threat while maintaining necessary service for checkout availability. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Eliminating runtime telemetry links new image digest to outbound mining-pool protocol evidence does not contain compromised container image running cryptomining workload and impairs forensic reconstruction.
C:Global shutdown could disrupt checkout availability without evidence that every system has been affected; scoped isolation is more proportionate.
D:Once unauthorized behavior is confirmed on container orchestration worker, delaying containment could expand the exposure affecting checkout availability.
Question 317
Retail payment platform receives a three-month-old threat-intelligence bulletin associating an observable with compromised container image running cryptomining workload. On container orchestration worker, local telemetry reports: runtime telemetry links new image digest to outbound mining-pool protocol. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions compromised container image running cryptomining workload, without checking whether its observable is present on container orchestration worker
- Assess bulletin timeliness and provenance, then corroborate its observables against runtime telemetry links new image digest to outbound mining-pool protocol and affected container orchestration worker
- Dismiss the bulletin solely because Retail payment platform has not named the attacker associated with runtime telemetry links new image digest to outbound mining-pool protocol
- Forward the bulletin about compromised container image running cryptomining workload as a confirmed breach of container orchestration worker without hosts, timestamps or confidence caveats
Explanation
Correct Answer
B:An old feed with unknown confidence is not automatic proof of activity at Retail payment platform. Comparing its timestamps and provenance with runtime telemetry links new image digest to outbound mining-pool protocol reveals whether the indicator is still relevant to container orchestration worker and checkout availability.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual runtime telemetry links new image digest to outbound mining-pool protocol.
C:Actor attribution is not required to assess a supported technique, source confidence or relevance to container orchestration worker.
D:Converting the unverified feed into confirmed activity on container orchestration worker may mislead investigators and prompt harmful response for checkout availability.
Question 318
Retail payment platform has investigated compromised container image running cryptomining workload on container orchestration worker. Detection operators report that approved load tests run on designated namespaces with signed image manifests; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Improve detection by requiring context-aware correlation: alert on unsigned image digest plus coin-miner process in production namespaces
- Automate service shutdown on the first simple match to one namespace suddenly saturates CPU while spawning an unfamiliar mining process, without validation or guardrails for checkout availability
- Assign critical severity to every routine activity on container orchestration worker whether or not it matches alert on unsigned image digest plus coin-miner process in production namespaces
- Suppress every future event associated with runtime telemetry links new image digest to outbound mining-pool protocol, including events outside approved load tests run on designated namespaces with signed image manifests
Explanation
Correct Answer
A:Alert on unsigned image digest plus coin-miner process in production namespaces retains the specific threat signal while discriminating against approved load tests run on designated namespaces with signed image manifests. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
B:An untested, unqualified automation could interrupt checkout availability and cannot distinguish the benign workflow from attacker behavior.
C:Alert severity without distinguishing approved load tests run on designated namespaces with signed image manifests from malicious conditions would increase noise and operational workload.
D:Suppressing all monitoring would also hide a recurrence of compromised container image running cryptomining workload, even where it threatens checkout availability.
Question 319
At Water utility, the security team assesses SCADA controller. The current issue is unpatched PLC service but active probes cause faults; assessment evidence states: passive inventory reports vulnerable model and old firmware. The service is isolated OT cell bridged through historian. Operational constraints: 24/7 treatment operation forbids intrusive scanning. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across SCADA controller during 24/7 treatment operation forbids intrusive scanning instead of using a scoped test
- Use only an anonymous outside-in scan of SCADA controller even when isolated OT cell bridged through historian requires authenticated deployment context
- Use an authorized, scoped validation approach that considers service sensitivity: verify with vendor advisory, passive version collection and maintenance engineers
- Accept the label unpatched PLC service but active probes cause faults as confirmed without checking the reported evidence passive inventory reports vulnerable model and old firmware or actual deployment
Explanation
Correct Answer
C:The evidence passive inventory reports vulnerable model and old firmware must be evaluated without violating the constraint 24/7 treatment operation forbids intrusive scanning. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because 24/7 treatment operation forbids intrusive scanning; authorization and scope are prerequisites.
B:Asset configuration and the constraints of SCADA controller matter; external findings alone may misstate or miss the exposed path.
D:The finding does not establish which live component is affected or whether the exposure isolated OT cell bridged through historian is real.
Question 320
At Water utility, the security team assesses SCADA controller. The current issue is unpatched PLC service but active probes cause faults; assessment evidence states: passive inventory reports vulnerable model and old firmware. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Assume SCADA controller is safe because another platform with similar software recently passed its own assessment
- Force a destructive proof-of-concept against SCADA controller, ignoring that 24/7 treatment operation forbids intrusive scanning and a safer validation exist
- Mark passive inventory reports vulnerable model and old firmware resolved or confirmed solely from the scanner severity without verify with vendor advisory, passive version collection and maintenance engineers
- Confirm the reported condition in the relevant asset context: verify with vendor advisory, passive version collection and maintenance engineers
Explanation
Correct Answer
D:Verify with vendor advisory, passive version collection and maintenance engineers tests the reported condition passive inventory reports vulnerable model and old firmware against actual deployment context (isolated OT cell bridged through historian). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:Security of an unrelated host cannot establish the state of SCADA controller, whose reported issue is unpatched PLC service but active probes cause faults.
B:A destructive proof is unnecessary when verify with vendor advisory, passive version collection and maintenance engineers can provide authorized evidence and 24/7 treatment operation forbids intrusive scanning constrains production testing.
C:passive inventory reports vulnerable model and old firmware may be accurate but its actual occurrence and configuration on SCADA controller must be established before calling it validated.
