CompTIA CS0-003 Practice Test 37
Question 360
Telecom carrier is reviewing a security finding affecting network firewall fleet: exception to security baseline expires next week while patch is delayed. The current reporting problem is that weekly dashboard does not show exception expiry. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Close exception to security baseline expires next week while patch is delayed based solely on a self-reported completion email from network security owner with no verification
- Discard the pre-change evidence exception approvals, tested compensating ACL and patch ETA so that only the improved numbers for expiry, residual risk and renewal decision authority remain
- Report retested exception approvals, tested compensating ACL and patch ETA, the outcome against expiry, residual risk and renewal decision authority, remaining exceptions, and owner confirmation
- Use the number of remediation meetings at Telecom carrier instead of observed change in expiry, residual risk and renewal decision authority as closeout proof
Explanation
Correct Answer
C:Exception approvals, tested compensating ACL and patch ETA provides source-linked closure proof. Showing expiry, residual risk and renewal decision authority and residual exceptions verifies whether network security owner actually reduced risk acceptance requires current evidence and delegated owner rather than merely marking a ticket closed.
Incorrect Answers
A:Self-declared completion does not demonstrate improved expiry, residual risk and renewal decision authority against documented exception approvals, tested compensating ACL and patch ETA.
B:Without historical expiry, residual risk and renewal decision authority inputs, leaders cannot validate the claimed improvement or identify recurrence.
D:Meetings do not confirm that exception to security baseline expires next week while patch is delayed was corrected or that remaining risk acceptance requires current evidence and delegated owner is acceptable.
Question 361
At Telecom provisioning team, analysts monitor Windows deployment domain. They observe that a low-privilege machine account accesses administrative shares on neighboring domain controllers. Evidence: domain logs show unexpected 4624 network logons and share enumeration. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of credential abuse for east-west privilege discovery and begin corroborating it with endpoint and network evidence
- Treat legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares as conclusive authorization for the current event without matching process or identity
- Announce that domain logs show unexpected 4624 network logons and share enumeration conclusively proves theft of subscriber service data before reviewing any sessions or file access
- Downgrade a low-privilege machine account accesses administrative shares on neighboring domain controllers solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
A:The combination of a low-privilege machine account accesses administrative shares on neighboring domain controllers and domain logs show unexpected 4624 network logons and share enumeration is suspicious for credential abuse for east-west privilege discovery. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting subscriber service data.
Incorrect Answers
B:The legitimate comparator is legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares; it does not establish that the current event came from the same approved identity or workflow.
C:domain logs show unexpected 4624 network logons and share enumeration is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
D:An intrusion can begin on one asset. The specific indicator on Windows deployment domain warrants its own validation before expanding or closing the investigation.
Question 362
At Telecom provisioning team, analysts monitor Windows deployment domain. They observe that a low-privilege machine account accesses administrative shares on neighboring domain controllers. Evidence: domain logs show unexpected 4624 network logons and share enumeration. A separate known-good explanation is: legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares. Which next analysis most reliably determines what caused the observed event?
- Suspend telemetry collection on Windows deployment domain while waiting for the connection pattern to stop
- Summarize domain logs show unexpected 4624 network logons and share enumeration into a ticket and discard underlying event identifiers before correlation
- Perform a scoped investigation: correlate logon IDs with authentication tickets, share names and executable lineage
- Accept a public reputation score for the destination as proof of the origin of domain logs show unexpected 4624 network logons and share enumeration, without using correlate logon IDs with authentication tickets, share names and executable lineage
Explanation
Correct Answer
C:Correlate logon IDs with authentication tickets, share names and executable lineage ties the evidence on Windows deployment domain to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares.
Incorrect Answers
A:Suppressing telemetry destroys the source needed to investigate credential abuse for east-west privilege discovery and may conceal further actions.
B:The original domain logs show unexpected 4624 network logons and share enumeration must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:A reputation score may inform triage but cannot establish the origin of domain logs show unexpected 4624 network logons and share enumeration or whether the activity matches legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares.
Question 363
Telecom provisioning team has a candidate alert for Windows deployment domain: domain logs show unexpected 4624 network logons and share enumeration. The team argues it is harmless because legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that a low-privilege machine account accesses administrative shares on neighboring domain controllers is benign
- Distinguish domain logs show unexpected 4624 network logons and share enumeration from the approved behavior (legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares) by validating process, identity and time attribution
- Automatically treat every event resembling domain logs show unexpected 4624 network logons and share enumeration as confirmed compromise of Windows deployment domain, without checking provenance
- Create a blanket suppression for domain logs show unexpected 4624 network logons and share enumeration because legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares can produce a superficially similar event
Explanation
Correct Answer
B:Legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares is a plausible alternative, but it must be proven to match the actual source of domain logs show unexpected 4624 network logons and share enumeration. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: a low-privilege machine account accesses administrative shares on neighboring domain controllers.
C:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting subscriber service data.
D:Similarity to legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares does not exclude an attacker from producing the same surface event on Windows deployment domain.
Question 364
At Telecom provisioning team, analysts monitor Windows deployment domain. They observe that a low-privilege machine account accesses administrative shares on neighboring domain controllers. Evidence: domain logs show unexpected 4624 network logons and share enumeration. The team confirms unauthorized behavior and must protect subscriber service data; legitimate service continuity remains necessary. Which containment decision is best?
- Erase domain logs show unexpected 4624 network logons and share enumeration from the evidence archive during the containment change to reduce repeated alerts
- Disable every production service at Telecom provisioning team without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: isolate compromised provisioning host and revoke its anomalous sessions while preserving domain continuity
- Leave the confirmed unauthorized activity on Windows deployment domain unrestricted until actual losses of subscriber service data can be measured
Explanation
Correct Answer
C:Isolate compromised provisioning host and revoke its anomalous sessions while preserving domain continuity constrains the observed threat while maintaining necessary service for subscriber service data. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Eliminating domain logs show unexpected 4624 network logons and share enumeration evidence does not contain credential abuse for east-west privilege discovery and impairs forensic reconstruction.
B:Global shutdown could disrupt subscriber service data without evidence that every system has been affected; scoped isolation is more proportionate.
D:Once unauthorized behavior is confirmed on Windows deployment domain, delaying containment could expand the exposure affecting subscriber service data.
Question 365
At Telecom provisioning team, analysts have investigated an initial alert involving Windows deployment domain and need to scope related activity. Original event: domain logs show unexpected 4624 network logons and share enumeration. Which threat-hunt pivot is best grounded in this observation?
- Pivot across the environment: search for machine accounts reaching DC admin shares outside baseline
- Use the previous month’s overall alert closure count instead of pivoting on domain logs show unexpected 4624 network logons and share enumeration across related identities and systems
- Stop scoping once the initial Windows deployment domain has been contained, even though search for machine accounts reaching DC admin shares outside baseline has not been attempted
- Mark every host adjacent to Windows deployment domain compromised by assumption without comparing activity-linked observables
Explanation
Correct Answer
A:Search for machine accounts reaching DC admin shares outside baseline extends the investigation from the specific clue, domain logs show unexpected 4624 network logons and share enumeration, to related activity while preserving host and user attribution. This estimates the scope of potential credential abuse for east-west privilege discovery.
Incorrect Answers
B:Historical alert volume does not trace the shared indicator or determine whether credential abuse for east-west privilege discovery spread beyond Windows deployment domain.
C:The initiating host may not be the only affected one; scoping requires examining the connected evidence domain logs show unexpected 4624 network logons and share enumeration.
D:Proximity to Windows deployment domain is not proof of exposure; use the activity-linked pivot to identify actual relationships.
Question 366
Telecom provisioning team has investigated credential abuse for east-west privilege discovery on Windows deployment domain. Detection operators report that legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Suppress every future event associated with domain logs show unexpected 4624 network logons and share enumeration, including events outside legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares
- Automate service shutdown on the first simple match to a low-privilege machine account accesses administrative shares on neighboring domain controllers, without validation or guardrails for subscriber service data
- Improve detection by requiring context-aware correlation: alert when machine identities access privileged shares across trust boundaries
- Assign critical severity to every routine activity on Windows deployment domain whether or not it matches alert when machine identities access privileged shares across trust boundaries
Explanation
Correct Answer
C:Alert when machine identities access privileged shares across trust boundaries retains the specific threat signal while discriminating against legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Suppressing all monitoring would also hide a recurrence of credential abuse for east-west privilege discovery, even where it threatens subscriber service data.
B:An untested, unqualified automation could interrupt subscriber service data and cannot distinguish the benign workflow from attacker behavior.
D:Alert severity without distinguishing legitimate patch orchestration uses dedicated signed service principals not machine-account admin shares from malicious conditions would increase noise and operational workload.
Question 367
At Healthcare scheduling, the security team assesses Java logging service. The current issue is known JNDI remote-code execution in logging component; assessment evidence states: software inventory confirms vulnerable Log4j version in public entrypoint. The service is internet-exposed application service. Operational constraints: hospital uptime needs staged deployment. Which assessment approach is most appropriate before recommending a fix?
- Accept the label known JNDI remote-code execution in logging component as confirmed without checking the reported evidence software inventory confirms vulnerable Log4j version in public entrypoint or actual deployment
- Use only an anonymous outside-in scan of Java logging service even when internet-exposed application service requires authenticated deployment context
- Use an authorized, scoped validation approach that considers service sensitivity: confirm runtime component and affected configuration without executing exploit
- Launch unapproved intrusive exploitation across Java logging service during hospital uptime needs staged deployment instead of using a scoped test
Explanation
Correct Answer
C:The evidence software inventory confirms vulnerable Log4j version in public entrypoint must be evaluated without violating the constraint hospital uptime needs staged deployment. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:The finding does not establish which live component is affected or whether the exposure internet-exposed application service is real.
B:Asset configuration and the constraints of Java logging service matter; external findings alone may misstate or miss the exposed path.
D:Uncontrolled testing may breach service safety, especially because hospital uptime needs staged deployment; authorization and scope are prerequisites.
Question 368
At Healthcare scheduling, the security team assesses Java logging service. The current issue is known JNDI remote-code execution in logging component; assessment evidence states: software inventory confirms vulnerable Log4j version in public entrypoint. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Mark software inventory confirms vulnerable Log4j version in public entrypoint resolved or confirmed solely from the scanner severity without confirm runtime component and affected configuration without executing exploit
- Force a destructive proof-of-concept against Java logging service, ignoring that hospital uptime needs staged deployment and a safer validation exist
- Assume Java logging service is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: confirm runtime component and affected configuration without executing exploit
Explanation
Correct Answer
D:Confirm runtime component and affected configuration without executing exploit tests the reported condition software inventory confirms vulnerable Log4j version in public entrypoint against actual deployment context (internet-exposed application service). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:software inventory confirms vulnerable Log4j version in public entrypoint may be accurate but its actual occurrence and configuration on Java logging service must be established before calling it validated.
B:A destructive proof is unnecessary when confirm runtime component and affected configuration without executing exploit can provide authorized evidence and hospital uptime needs staged deployment constrains production testing.
C:Security of an unrelated host cannot establish the state of Java logging service, whose reported issue is known JNDI remote-code execution in logging component.
Question 369
At Healthcare scheduling, the security team assesses Java logging service. The current issue is known JNDI remote-code execution in logging component; assessment evidence states: software inventory confirms vulnerable Log4j version in public entrypoint. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Give every vulnerability the same deadline despite known JNDI remote-code execution in logging component and business impact on patient system compromise
- Choose whatever finding on Java logging service was logged most recently, regardless of actual exploit path or priority
- Prioritize the confirmed exposure of Java logging service, accounting for patient system compromise and the real access path: internet-exposed application service
- Choose the highest nominal scanner severity first while ignoring internet-exposed application service and the consequence to patient system compromise
Explanation
Correct Answer
C:Risk depends on practical reachability, threat activity and consequence. The issue known JNDI remote-code execution in logging component can affect patient system compromise through internet-exposed application service; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Uniform priority ignores internet-exposed application service, operational harm and patient system compromise; documented context makes triage defensible.
B:Discovery order is not evidence of urgency compared with the actual affected Java logging service.
D:CVSS describes technical characteristics, not the entirety of exposure and patient system compromise for this deployment.
Question 370
At Healthcare scheduling, the security team assesses Java logging service. The current issue is known JNDI remote-code execution in logging component; assessment evidence states: software inventory confirms vulnerable Log4j version in public entrypoint. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use WAF egress and request controls as temporary mitigation as permanent closure of the confirmed issue instead of deploying replace vulnerable logging component and disable risky lookups
- Implement and verify the root-cause fix: replace vulnerable logging component and disable risky lookups
- Sign an exception document but do not implement or test replace vulnerable logging component and disable risky lookups on Java logging service
- Leave known JNDI remote-code execution in logging component present indefinitely because no incident involving patient system compromise was recorded this week
Explanation
Correct Answer
B:Replace vulnerable logging component and disable risky lookups targets the mechanism known JNDI remote-code execution in logging component rather than only filtering symptoms. Verification must account for software inventory confirms vulnerable Log4j version in public entrypoint and continued protection of patient system compromise.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying known JNDI remote-code execution in logging component and should be time-limited with verification and owner oversight.
C:Risk acceptance paperwork does not itself remediate known JNDI remote-code execution in logging component on Java logging service; authorized, tested implementation is still required when the risk exceeds tolerance.
D:No observed attack does not correct the verified condition software inventory confirms vulnerable Log4j version in public entrypoint or eliminate its potential impact on patient system compromise.
