CompTIA CS0-003 Practice Test 35
Question 340
At Healthcare provider, analysts monitor patient scheduling SaaS. They observe that a newly consented OAuth app reads all calendars and mailbox metadata with offline access. Evidence: identity audit records broad OAuth scopes and grant by one non-admin user. The team confirms unauthorized behavior and must protect appointment privacy; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: revoke the unapproved app grant and invalidate its tokens while retaining clinical scheduling access
- Erase identity audit records broad OAuth scopes and grant by one non-admin user from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on patient scheduling SaaS unrestricted until actual losses of appointment privacy can be measured
- Disable every production service at Healthcare provider without measuring whether its dependencies share the observed malicious path
Explanation
Correct Answer
A:Revoke the unapproved app grant and invalidate its tokens while retaining clinical scheduling access constrains the observed threat while maintaining necessary service for appointment privacy. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Eliminating identity audit records broad OAuth scopes and grant by one non-admin user evidence does not contain malicious OAuth consent grant granting persistent data access and impairs forensic reconstruction.
C:Once unauthorized behavior is confirmed on patient scheduling SaaS, delaying containment could expand the exposure affecting appointment privacy.
D:Global shutdown could disrupt appointment privacy without evidence that every system has been affected; scoped isolation is more proportionate.
Question 341
Healthcare provider has correlated an alert involving patient scheduling SaaS; the key observation is identity audit records broad OAuth scopes and grant by one non-admin user. Another security organization requests a defensible, privacy-conscious indicator package to hunt for similar behavior. What should be shared?
- Share all raw appointment privacy records to prove the alert is important before stripping unnecessary personal or protected content
- Send only the statement that malicious OAuth consent grant granting persistent data access exists with no indicator, observation time or confidence
- Declare every system using patient scheduling SaaS technology compromised without proof beyond the single observation
- Share the validated technical observables and conditions from find same app ID and scope grants across other users, with timing, confidence, classification and minimal sensitive data
Explanation
Correct Answer
D:Find same app ID and scope grants across other users describes how other defenders can test the observation. Time, confidence and privacy handling preserve investigative value without disclosing unrelated appointment privacy data.
Incorrect Answers
A:Sharing investigative indicators does not authorize exposing appointment privacy; minimize records and follow approved intelligence-sharing rules.
B:A generic threat label cannot help a partner correlate identity audit records broad OAuth scopes and grant by one non-admin user to its own assets or distinguish it from routine activity.
C:The single finding identity audit records broad OAuth scopes and grant by one non-admin user on patient scheduling SaaS does not prove the same activity across organizations; share enough context for each partner to validate it.
Question 342
Healthcare provider has investigated malicious OAuth consent grant granting persistent data access on patient scheduling SaaS. Detection operators report that authorized calendar integrations have restricted scopes and a vetted app registration; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to a newly consented OAuth app reads all calendars and mailbox metadata with offline access, without validation or guardrails for appointment privacy
- Assign critical severity to every routine activity on patient scheduling SaaS whether or not it matches detect new third-party consent combining offline_access with organization-wide read scopes
- Suppress every future event associated with identity audit records broad OAuth scopes and grant by one non-admin user, including events outside authorized calendar integrations have restricted scopes and a vetted app registration
- Improve detection by requiring context-aware correlation: detect new third-party consent combining offline_access with organization-wide read scopes
Explanation
Correct Answer
D:Detect new third-party consent combining offline_access with organization-wide read scopes retains the specific threat signal while discriminating against authorized calendar integrations have restricted scopes and a vetted app registration. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt appointment privacy and cannot distinguish the benign workflow from attacker behavior.
B:Alert severity without distinguishing authorized calendar integrations have restricted scopes and a vetted app registration from malicious conditions would increase noise and operational workload.
C:Suppressing all monitoring would also hide a recurrence of malicious OAuth consent grant granting persistent data access, even where it threatens appointment privacy.
Question 343
At Shipping platform, the security team assesses container application image. The current issue is critical package CVE in deployed image; assessment evidence states: image scan identifies affected library within running digest. The service is public API pod with limited read permissions. Operational constraints: rolling deployment required for fleet booking. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across container application image during rolling deployment required for fleet booking instead of using a scoped test
- Accept the label critical package CVE in deployed image as confirmed without checking the reported evidence image scan identifies affected library within running digest or actual deployment
- Use only an anonymous outside-in scan of container application image even when public API pod with limited read permissions requires authenticated deployment context
- Use an authorized, scoped validation approach that considers service sensitivity: confirm reachable vulnerable code path and actual running image digest
Explanation
Correct Answer
D:The evidence image scan identifies affected library within running digest must be evaluated without violating the constraint rolling deployment required for fleet booking. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because rolling deployment required for fleet booking; authorization and scope are prerequisites.
B:The finding does not establish which live component is affected or whether the exposure public API pod with limited read permissions is real.
C:Asset configuration and the constraints of container application image matter; external findings alone may misstate or miss the exposed path.
Question 344
At Shipping platform, the security team assesses container application image. The current issue is critical package CVE in deployed image; assessment evidence states: image scan identifies affected library within running digest. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Confirm the reported condition in the relevant asset context: confirm reachable vulnerable code path and actual running image digest
- Mark image scan identifies affected library within running digest resolved or confirmed solely from the scanner severity without confirm reachable vulnerable code path and actual running image digest
- Force a destructive proof-of-concept against container application image, ignoring that rolling deployment required for fleet booking and a safer validation exist
- Assume container application image is safe because another platform with similar software recently passed its own assessment
Explanation
Correct Answer
A:Confirm reachable vulnerable code path and actual running image digest tests the reported condition image scan identifies affected library within running digest against actual deployment context (public API pod with limited read permissions). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
B:image scan identifies affected library within running digest may be accurate but its actual occurrence and configuration on container application image must be established before calling it validated.
C:A destructive proof is unnecessary when confirm reachable vulnerable code path and actual running image digest can provide authorized evidence and rolling deployment required for fleet booking constrains production testing.
D:Security of an unrelated host cannot establish the state of container application image, whose reported issue is critical package CVE in deployed image.
Question 345
At Shipping platform, the security team assesses container application image. The current issue is critical package CVE in deployed image; assessment evidence states: image scan identifies affected library within running digest. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Give every vulnerability the same deadline despite critical package CVE in deployed image and business impact on shipping reservations
- Choose whatever finding on container application image was logged most recently, regardless of actual exploit path or priority
- Prioritize the confirmed exposure of container application image, accounting for shipping reservations and the real access path: public API pod with limited read permissions
- Choose the highest nominal scanner severity first while ignoring public API pod with limited read permissions and the consequence to shipping reservations
Explanation
Correct Answer
C:Risk depends on practical reachability, threat activity and consequence. The issue critical package CVE in deployed image can affect shipping reservations through public API pod with limited read permissions; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Uniform priority ignores public API pod with limited read permissions, operational harm and shipping reservations; documented context makes triage defensible.
B:Discovery order is not evidence of urgency compared with the actual affected container application image.
D:CVSS describes technical characteristics, not the entirety of exposure and shipping reservations for this deployment.
Question 346
At Shipping platform, the security team assesses container application image. The current issue is critical package CVE in deployed image; assessment evidence states: image scan identifies affected library within running digest. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Implement and verify the root-cause fix: rebuild from fixed base, sign and deploy image
- Sign an exception document but do not implement or test rebuild from fixed base, sign and deploy image on container application image
- Leave critical package CVE in deployed image present indefinitely because no incident involving shipping reservations was recorded this week
- Use tighten egress and admission until rebuilt as permanent closure of the confirmed issue instead of deploying rebuild from fixed base, sign and deploy image
Explanation
Correct Answer
A:Rebuild from fixed base, sign and deploy image targets the mechanism critical package CVE in deployed image rather than only filtering symptoms. Verification must account for image scan identifies affected library within running digest and continued protection of shipping reservations.
Incorrect Answers
B:Risk acceptance paperwork does not itself remediate critical package CVE in deployed image on container application image; authorized, tested implementation is still required when the risk exceeds tolerance.
C:No observed attack does not correct the verified condition image scan identifies affected library within running digest or eliminate its potential impact on shipping reservations.
D:The interim control may reduce exposure, but it can leave the underlying critical package CVE in deployed image and should be time-limited with verification and owner oversight.
Question 347
At Shipping platform, the security team assesses container application image. The current issue is critical package CVE in deployed image; assessment evidence states: image scan identifies affected library within running digest. A permanent correction cannot be deployed immediately because rolling deployment required for fleet booking. Which interim treatment is the safest governed option?
- Apply a time-bound compensating measure, tighten egress and admission until rebuilt, record the residual risk owner and schedule the tested permanent fix
- Accept continued exposure of shipping reservations without any owner, expiry or compensating verification because rolling deployment required for fleet booking
- Push rebuild from fixed base, sign and deploy image immediately to all production systems with no safe change window despite rolling deployment required for fleet booking
- Claim critical package CVE in deployed image is patched when the change ticket opens, without confirming tighten egress and admission until rebuilt or a planned permanent change
Explanation
Correct Answer
A:Tighten egress and admission until rebuilt can reduce short-term exposure while rolling deployment required for fleet booking delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because shipping reservations remains at stake.
Incorrect Answers
B:Business criticality increases the need for accountable decisions and review; it does not make shipping reservations irrelevant.
C:Ignoring rolling deployment required for fleet booking could cause avoidable service failure and is not a risk-aware remediation process.
D:A work item is not proof that critical package CVE in deployed image was corrected or even that tighten egress and admission until rebuilt operates.
Question 348
At Shipping platform, the security team assesses container application image. The current issue is critical package CVE in deployed image; assessment evidence states: image scan identifies affected library within running digest. The owner reports that rebuild from fixed base, sign and deploy image has been deployed. What evidence should close the vulnerability item?
- Use an unrelated server’s clean findings to claim container application image is fixed without retesting the affected path
- Suppress future results for critical package CVE in deployed image so that the vulnerability dashboard shows a completed remediation
- Close image scan identifies affected library within running digest after the deployment tool returns success, without verifying the current state of container application image
- Retest the originally affected configuration using confirm reachable vulnerable code path and actual running image digest, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by image scan identifies affected library within running digest, plus regression impact on container application image. A change ticket alone is not proof of removal of critical package CVE in deployed image.
Incorrect Answers
A:The result must be tied to container application image and the actual exposure: public API pod with limited read permissions.
B:Suppression may hide a failed or incomplete fix, leaving shipping reservations exposed despite the administrative record.
C:Process completion is not evidence that image scan identifies affected library within running digest no longer applies to container application image.
Question 349
At Healthcare analytics vendor, the incident team supports service API integration. A new security event is reported: integration key is published accidentally in a public CI log. The log clue is: public pipeline trace contains credential and cloud API shows fresh unauthorized calls. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Treat an ATT&CK label for integration key is published accidentally in a public CI log as a complete recovery instruction without checking evidence or impact
- Map the observed behavior in public pipeline trace contains credential and cloud API shows fresh unauthorized calls to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Assign a final attack-chain stage to service API integration without confirming what behavior actually occurred in public pipeline trace contains credential and cloud API shows fresh unauthorized calls
- Attribute integration key is published accidentally in a public CI log to a named foreign intelligence service using only public pipeline trace contains credential and cloud API shows fresh unauthorized calls
Explanation
Correct Answer
B:Integration key is published accidentally in a public CI log and public pipeline trace contains credential and cloud API shows fresh unauthorized calls support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:A taxonomy is not an incident response plan for service API integration; scope and safety constraints still matter.
C:Attack frameworks describe observable stages and techniques; the public pipeline trace contains credential and cloud API shows fresh unauthorized calls must substantiate whichever stage is assigned.
D:Neither integration key is published accidentally in a public CI log nor public pipeline trace contains credential and cloud API shows fresh unauthorized calls establishes uniquely identifying actor evidence.
Question 350
At Healthcare analytics vendor, the incident team supports service API integration. A new security event is reported: integration key is published accidentally in a public CI log. The log clue is: public pipeline trace contains credential and cloud API shows fresh unauthorized calls. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Preserve and hash incident artifacts: preserve job run, access-key audit and relevant request IDs before log retention expires
- Keep only a screenshot of public pipeline trace contains credential and cloud API shows fresh unauthorized calls, discarding original artifacts such as preserve job run, access-key audit and relevant request IDs before log retention expires
- Alter original public pipeline trace contains credential and cloud API shows fresh unauthorized calls entries to remove irrelevant records before preserving the forensic timeline
- Rebuild service API integration first and collect the volatile evidence for integration key is published accidentally in a public CI log afterward
Explanation
Correct Answer
A:Preserve job run, access-key audit and relevant request IDs before log retention expires retains relevant source context and integrity checks so the team can reconstruct integration key is published accidentally in a public CI log and support an auditable chain of custody.
Incorrect Answers
B:A screenshot cannot replace the underlying preserve job run, access-key audit and relevant request IDs before log retention expires needed to establish sequence and integrity.
C:Changing the original public pipeline trace contains credential and cloud API shows fresh unauthorized calls compromises provenance and makes later findings harder to verify.
D:Volatile evidence relevant to integration key is published accidentally in a public CI log may disappear during remediation or reboot.
