CompTIA CS0-003 Practice Test 36
Question 350
At Healthcare analytics vendor, the incident team supports service API integration. A new security event is reported: integration key is published accidentally in a public CI log. The log clue is: public pipeline trace contains credential and cloud API shows fresh unauthorized calls. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Preserve and hash incident artifacts: preserve job run, access-key audit and relevant request IDs before log retention expires
- Keep only a screenshot of public pipeline trace contains credential and cloud API shows fresh unauthorized calls, discarding original artifacts such as preserve job run, access-key audit and relevant request IDs before log retention expires
- Alter original public pipeline trace contains credential and cloud API shows fresh unauthorized calls entries to remove irrelevant records before preserving the forensic timeline
- Rebuild service API integration first and collect the volatile evidence for integration key is published accidentally in a public CI log afterward
Explanation
Correct Answer
A:Preserve job run, access-key audit and relevant request IDs before log retention expires retains relevant source context and integrity checks so the team can reconstruct integration key is published accidentally in a public CI log and support an auditable chain of custody.
Incorrect Answers
B:A screenshot cannot replace the underlying preserve job run, access-key audit and relevant request IDs before log retention expires needed to establish sequence and integrity.
C:Changing the original public pipeline trace contains credential and cloud API shows fresh unauthorized calls compromises provenance and makes later findings harder to verify.
D:Volatile evidence relevant to integration key is published accidentally in a public CI log may disappear during remediation or reboot.
Question 351
At Healthcare analytics vendor, the incident team supports service API integration. A new security event is reported: integration key is published accidentally in a public CI log. The log clue is: public pipeline trace contains credential and cloud API shows fresh unauthorized calls. The incident remains active, but service API integration is operationally important. Which containment decision is most appropriate now?
- Execute scoped containment: revoke leaked key and restrict API scopes while providing service-owned replacement key
- Publish a speculative full-incident attribution notice before constraining the active behavior integration key is published accidentally in a public CI log
- Erase public pipeline trace contains credential and cloud API shows fresh unauthorized calls to reduce alert volume rather than isolating the observed attacker route
- Disconnect every service at Healthcare analytics vendor, regardless of whether it has a dependency on the affected service API integration
Explanation
Correct Answer
A:Revoke leaked key and restrict API scopes while providing service-owned replacement key stops or limits the observed path while balancing continuity of service API integration. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
B:Communication matters, but active integration key is published accidentally in a public CI log requires proportionate containment and evidence preservation first.
C:Erasing public pipeline trace contains credential and cloud API shows fresh unauthorized calls neither blocks attacker access nor supports a reliable subsequent recovery decision.
D:Broad interruption may unnecessarily affect service API integration; containment should be scoped to evidenced systems and approved critical-service requirements.
Question 352
At Healthcare analytics vendor, the incident team supports service API integration. A new security event is reported: integration key is published accidentally in a public CI log. The log clue is: public pipeline trace contains credential and cloud API shows fresh unauthorized calls. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Use only the original firewall block and assume it has also removed all persistence behind integration key is published accidentally in a public CI log
- Remove the attackās established access and persistence: remove exposed key from job configuration and use secret manager with redacted logs
- Rewrite the playbook for service API integration but leave the confirmed malicious access mechanism active
- Restore service API integration without first correcting the access and persistence cause addressed by remove exposed key from job configuration and use secret manager with redacted logs
Explanation
Correct Answer
B:Remove exposed key from job configuration and use secret manager with redacted logs targets the mechanism behind integration key is published accidentally in a public CI log, reducing recurrence when service API integration returns to normal operations.
Incorrect Answers
A:Containment can stop communication without eliminating the root access that produced public pipeline trace contains credential and cloud API shows fresh unauthorized calls.
C:Updated paperwork does not eradicate the mechanism behind integration key is published accidentally in a public CI log.
D:Recovery before remove exposed key from job configuration and use secret manager with redacted logs could reintroduce the same compromise path.
Question 353
At Healthcare analytics vendor, the incident team supports service API integration. A new security event is reported: integration key is published accidentally in a public CI log. The log clue is: public pipeline trace contains credential and cloud API shows fresh unauthorized calls. Containment and eradication are complete. Which recovery acceptance test should precede release of service API integration to normal users?
- Approve recovery of service API integration when it boots, without executing the test verify new key permissions, no residual unauthorized access and alerting
- Perform controlled return-to-service validation: verify new key permissions, no residual unauthorized access and alerting
- Expose service API integration to users before confirming that the conditions behind integration key is published accidentally in a public CI log are absent
- Delete preserved evidence including preserve job run, access-key audit and relevant request IDs before log retention expires as soon as the service restarts
Explanation
Correct Answer
B:Verify new key permissions, no residual unauthorized access and alerting demonstrates that the compromised pathway is absent while service API integration again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:A boot event cannot prove verify new key permissions, no residual unauthorized access and alerting or protect the service from recurrence of integration key is published accidentally in a public CI log.
C:Without a clean functional/security validation, service API integration could immediately face the same exploit condition.
D:Evidence retention obligations continue beyond restart; preserve job run, access-key audit and relevant request IDs before log retention expires may be required for subsequent review.
Question 354
At Healthcare analytics vendor, the incident team supports service API integration. A new security event is reported: integration key is published accidentally in a public CI log. The log clue is: public pipeline trace contains credential and cloud API shows fresh unauthorized calls. The incident has been contained and normal service has resumed. A post-incident review identifies that pipeline printed environment variables during failed build. Which improvement should be prioritized?
- Assign an owner and measurable corrective action addressing the root cause: pipeline printed environment variables during failed build, with a future effectiveness test
- Write a lessons-learned memo about integration key is published accidentally in a public CI log with no due date, control owner or validation activity
- Close the follow-up for service API integration merely because restoration completed, without addressing pipeline printed environment variables during failed build
- Discipline the whole on-duty response shift rather than examining the documented weakness pipeline printed environment variables during failed build
Explanation
Correct Answer
A:Pipeline printed environment variables during failed build was the systemic weakness that enabled or worsened integration key is published accidentally in a public CI log. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
B:An unowned recommendation does not produce a verified control improvement for service API integration.
C:Service restoration does not address pipeline printed environment variables during failed build; ignoring it leaves the next incident likely to follow the same route.
D:A personnel-only response lacks support from the documented root cause: pipeline printed environment variables during failed build.
Question 355
Telecom carrier is reviewing a security finding affecting network firewall fleet: exception to security baseline expires next week while patch is delayed. The current reporting problem is that weekly dashboard does not show exception expiry. What information should be delivered first to decision makers responsible for risk acceptance requires current evidence and delegated owner?
- Report only the number of tickets closed for network firewall fleet, concealing the unresolved exposure from exception to security baseline expires next week while patch is delayed
- Forward raw telemetry from exception approvals, tested compensating ACL and patch ETA to executives without summarizing consequences for risk acceptance requires current evidence and delegated owner
- Present a concise, evidence-qualified risk and impact summary based on exception approvals, tested compensating ACL and patch ETA, with decisions and uncertainty stated
- State that exception to security baseline expires next week while patch is delayed was eliminated because Telecom carrier distributed a dashboard on schedule
Explanation
Correct Answer
C:Exception approvals, tested compensating ACL and patch ETA supports a decision-oriented picture of risk acceptance requires current evidence and delegated owner while separating confirmed facts from unknowns. This corrects the reporting defect: weekly dashboard does not show exception expiry.
Incorrect Answers
A:Ticket counts do not establish whether exception to security baseline expires next week while patch is delayed still threatens risk acceptance requires current evidence and delegated owner.
B:Raw telemetry may support analysts, but decision makers need the meaning for risk acceptance requires current evidence and delegated owner and accountable options.
D:Reporting timeliness is not evidence that exception approvals, tested compensating ACL and patch ETA shows full risk elimination.
Question 356
Telecom carrier is reviewing a security finding affecting network firewall fleet: exception to security baseline expires next week while patch is delayed. The current reporting problem is that weekly dashboard does not show exception expiry. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Accept an assertion that network security owner completed the correction with no retest against exception approvals, tested compensating ACL and patch ETA
- Give network security owner the same board overview rather than the reproducible records from exception approvals, tested compensating ACL and patch ETA
- Provide the original relevant artifacts and validation method from exception approvals, tested compensating ACL and patch ETA, tied to affected assets, owners and retest criteria
- Remove the timestamps and correlations from exception approvals, tested compensating ACL and patch ETA so the technical report occupies fewer pages
Explanation
Correct Answer
C:Exception approvals, tested compensating ACL and patch ETA gives engineers traceable scope and a basis for confirming that network security owner has resolved the identified exposure on network firewall fleet.
Incorrect Answers
A:Self-assessment without test artifacts is weaker than verifiable exception approvals, tested compensating ACL and patch ETA and agreed acceptance conditions.
B:A high-level board summary cannot identify the concrete exception approvals, tested compensating ACL and patch ETA fields needed for technical validation.
D:Such edits break reproducibility of exception to security baseline expires next week while patch is delayed and make scope or remediation errors harder to find.
Question 357
Telecom carrier is reviewing a security finding affecting network firewall fleet: exception to security baseline expires next week while patch is delayed. The current reporting problem is that weekly dashboard does not show exception expiry. Stakeholders include network risk owner and security governance. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Give a technical engineer sole authority for every legal or public statement otherwise owned by network risk owner and security governance
- Release unconfirmed details about exception to security baseline expires next week while patch is delayed externally before evidence and approvals from network risk owner and security governance have been reconciled
- Coordinate fact-checked messages, recipients and timing with network risk owner and security governance, preserving applicable legal and incident approval paths
- Withhold notification of exception to security baseline expires next week while patch is delayed indefinitely even after verified exception approvals, tested compensating ACL and patch ETA meets a binding disclosure threshold
Explanation
Correct Answer
C:The parties network risk owner and security governance have different responsibilities. Using verified exception approvals, tested compensating ACL and patch ETA and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
A:Technical diagnosis does not automatically confer the disclosure authority held by network risk owner and security governance.
B:Unconfirmed claims could misrepresent the impact of exception to security baseline expires next week while patch is delayed and breach communication obligations.
D:If verified exception approvals, tested compensating ACL and patch ETA triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
Question 358
Telecom carrier is reviewing a security finding affecting network firewall fleet: exception to security baseline expires next week while patch is delayed. The current reporting problem is that weekly dashboard does not show exception expiry. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Redefine expiry, residual risk and renewal decision authority every week until all dashboards appear positive
- Track a defined, evidence-based measure of expiry, residual risk and renewal decision authority, with trend, scope and accountable source
- Compare Telecom carrier teams only by tickets closed, ignoring which services are still exposed to exception to security baseline expires next week while patch is delayed
- Measure improvement in expiry, residual risk and renewal decision authority by how many slides were added to the board presentation
Explanation
Correct Answer
B:The measure expiry, residual risk and renewal decision authority connects reporting to a change in risk acceptance requires current evidence and delegated owner, rather than the number of reports or raw alert volume. Trends must use consistent inputs from exception approvals, tested compensating ACL and patch ETA.
Incorrect Answers
A:Inconsistent measures cannot support a credible trend for expiry, residual risk and renewal decision authority.
C:Tickets can hide unresolved risk acceptance requires current evidence and delegated owner; a risk-weighted outcome metric is needed.
D:Presentation size does not establish expiry, residual risk and renewal decision authority or whether exception to security baseline expires next week while patch is delayed is managed.
Question 359
Telecom carrier is reviewing a security finding affecting network firewall fleet: exception to security baseline expires next week while patch is delayed. The current reporting problem is that weekly dashboard does not show exception expiry. An action plan is being negotiated, but customer traffic cannot move during contract freeze. What reporting recommendation best supports practical remediation?
- Set an immediate fix deadline for network firewall fleet without acknowledging that customer traffic cannot move during contract freeze
- Ask the network security owner to document mitigation choices for network firewall fleet, service constraints, milestones, approvers and time-bound risk acceptance if needed
- Give network security owner an unlimited exception because customer traffic cannot move during contract freeze rather than reporting residual risk and expiry
- Copy a generic checklist for exception to security baseline expires next week while patch is delayed without accountable owners, asset scope or milestones
Explanation
Correct Answer
B:Customer traffic cannot move during contract freeze creates a real implementation constraint. A plan owned by network security owner with measured risk and delegated approvals protects risk acceptance requires current evidence and delegated owner better than an unrealistic generic deadline.
Incorrect Answers
A:Ignoring customer traffic cannot move during contract freeze can turn a security fix into service disruption while failing to clarify remaining risk.
C:Risk acceptance requires current evidence and delegated owner still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
D:A non-accountable template cannot address customer traffic cannot move during contract freeze or demonstrate progress on exception to security baseline expires next week while patch is delayed.
Question 360
Telecom carrier is reviewing a security finding affecting network firewall fleet: exception to security baseline expires next week while patch is delayed. The current reporting problem is that weekly dashboard does not show exception expiry. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Close exception to security baseline expires next week while patch is delayed based solely on a self-reported completion email from network security owner with no verification
- Discard the pre-change evidence exception approvals, tested compensating ACL and patch ETA so that only the improved numbers for expiry, residual risk and renewal decision authority remain
- Report retested exception approvals, tested compensating ACL and patch ETA, the outcome against expiry, residual risk and renewal decision authority, remaining exceptions, and owner confirmation
- Use the number of remediation meetings at Telecom carrier instead of observed change in expiry, residual risk and renewal decision authority as closeout proof
Explanation
Correct Answer
C:Exception approvals, tested compensating ACL and patch ETA provides source-linked closure proof. Showing expiry, residual risk and renewal decision authority and residual exceptions verifies whether network security owner actually reduced risk acceptance requires current evidence and delegated owner rather than merely marking a ticket closed.
Incorrect Answers
A:Self-declared completion does not demonstrate improved expiry, residual risk and renewal decision authority against documented exception approvals, tested compensating ACL and patch ETA.
B:Without historical expiry, residual risk and renewal decision authority inputs, leaders cannot validate the claimed improvement or identify recurrence.
D:Meetings do not confirm that exception to security baseline expires next week while patch is delayed was corrected or that remaining risk acceptance requires current evidence and delegated owner is acceptable.