CompTIA CS0-003 Practice Test 38
Question 370
At Healthcare scheduling, the security team assesses Java logging service. The current issue is known JNDI remote-code execution in logging component; assessment evidence states: software inventory confirms vulnerable Log4j version in public entrypoint. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use WAF egress and request controls as temporary mitigation as permanent closure of the confirmed issue instead of deploying replace vulnerable logging component and disable risky lookups
- Implement and verify the root-cause fix: replace vulnerable logging component and disable risky lookups
- Sign an exception document but do not implement or test replace vulnerable logging component and disable risky lookups on Java logging service
- Leave known JNDI remote-code execution in logging component present indefinitely because no incident involving patient system compromise was recorded this week
Explanation
Correct Answer
B:Replace vulnerable logging component and disable risky lookups targets the mechanism known JNDI remote-code execution in logging component rather than only filtering symptoms. Verification must account for software inventory confirms vulnerable Log4j version in public entrypoint and continued protection of patient system compromise.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying known JNDI remote-code execution in logging component and should be time-limited with verification and owner oversight.
C:Risk acceptance paperwork does not itself remediate known JNDI remote-code execution in logging component on Java logging service; authorized, tested implementation is still required when the risk exceeds tolerance.
D:No observed attack does not correct the verified condition software inventory confirms vulnerable Log4j version in public entrypoint or eliminate its potential impact on patient system compromise.
Question 371
At Healthcare scheduling, the security team assesses Java logging service. The current issue is known JNDI remote-code execution in logging component; assessment evidence states: software inventory confirms vulnerable Log4j version in public entrypoint. A permanent correction cannot be deployed immediately because hospital uptime needs staged deployment. Which interim treatment is the safest governed option?
- Apply a time-bound compensating measure, WAF egress and request controls as temporary mitigation, record the residual risk owner and schedule the tested permanent fix
- Claim known JNDI remote-code execution in logging component is patched when the change ticket opens, without confirming WAF egress and request controls as temporary mitigation or a planned permanent change
- Accept continued exposure of patient system compromise without any owner, expiry or compensating verification because hospital uptime needs staged deployment
- Push replace vulnerable logging component and disable risky lookups immediately to all production systems with no safe change window despite hospital uptime needs staged deployment
Explanation
Correct Answer
A:WAF egress and request controls as temporary mitigation can reduce short-term exposure while hospital uptime needs staged deployment delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because patient system compromise remains at stake.
Incorrect Answers
B:A work item is not proof that known JNDI remote-code execution in logging component was corrected or even that WAF egress and request controls as temporary mitigation operates.
C:Business criticality increases the need for accountable decisions and review; it does not make patient system compromise irrelevant.
D:Ignoring hospital uptime needs staged deployment could cause avoidable service failure and is not a risk-aware remediation process.
Question 372
At Healthcare scheduling, the security team assesses Java logging service. The current issue is known JNDI remote-code execution in logging component; assessment evidence states: software inventory confirms vulnerable Log4j version in public entrypoint. The owner reports that replace vulnerable logging component and disable risky lookups has been deployed. What evidence should close the vulnerability item?
- Close software inventory confirms vulnerable Log4j version in public entrypoint after the deployment tool returns success, without verifying the current state of Java logging service
- Use an unrelated server’s clean findings to claim Java logging service is fixed without retesting the affected path
- Suppress future results for known JNDI remote-code execution in logging component so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using confirm runtime component and affected configuration without executing exploit, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by software inventory confirms vulnerable Log4j version in public entrypoint, plus regression impact on Java logging service. A change ticket alone is not proof of removal of known JNDI remote-code execution in logging component.
Incorrect Answers
A:Process completion is not evidence that software inventory confirms vulnerable Log4j version in public entrypoint no longer applies to Java logging service.
B:The result must be tied to Java logging service and the actual exposure: internet-exposed application service.
C:Suppression may hide a failed or incomplete fix, leaving patient system compromise exposed despite the administrative record.
Question 373
At Media subscription provider, the incident team supports content delivery API. A new security event is reported: data is sent to a new overseas endpoint shortly after app token escalation. The log clue is: API gateway and egress logs show high-volume encrypted uploads from one service principal. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Attribute data is sent to a new overseas endpoint shortly after app token escalation to a named foreign intelligence service using only API gateway and egress logs show high-volume encrypted uploads from one service principal
- Treat an ATT&CK label for data is sent to a new overseas endpoint shortly after app token escalation as a complete recovery instruction without checking evidence or impact
- Assign a final attack-chain stage to content delivery API without confirming what behavior actually occurred in API gateway and egress logs show high-volume encrypted uploads from one service principal
- Map the observed behavior in API gateway and egress logs show high-volume encrypted uploads from one service principal to a technique-level ATT&CK or kill-chain hypothesis and record confidence
Explanation
Correct Answer
D:Data is sent to a new overseas endpoint shortly after app token escalation and API gateway and egress logs show high-volume encrypted uploads from one service principal support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:Neither data is sent to a new overseas endpoint shortly after app token escalation nor API gateway and egress logs show high-volume encrypted uploads from one service principal establishes uniquely identifying actor evidence.
B:A taxonomy is not an incident response plan for content delivery API; scope and safety constraints still matter.
C:Attack frameworks describe observable stages and techniques; the API gateway and egress logs show high-volume encrypted uploads from one service principal must substantiate whichever stage is assigned.
Question 374
At Media subscription provider, the incident team supports content delivery API. A new security event is reported: data is sent to a new overseas endpoint shortly after app token escalation. The log clue is: API gateway and egress logs show high-volume encrypted uploads from one service principal. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Keep only a screenshot of API gateway and egress logs show high-volume encrypted uploads from one service principal, discarding original artifacts such as capture request metadata, token issuance history and data-access audit
- Alter original API gateway and egress logs show high-volume encrypted uploads from one service principal entries to remove irrelevant records before preserving the forensic timeline
- Rebuild content delivery API first and collect the volatile evidence for data is sent to a new overseas endpoint shortly after app token escalation afterward
- Preserve and hash incident artifacts: capture request metadata, token issuance history and data-access audit
Explanation
Correct Answer
D:Capture request metadata, token issuance history and data-access audit retains relevant source context and integrity checks so the team can reconstruct data is sent to a new overseas endpoint shortly after app token escalation and support an auditable chain of custody.
Incorrect Answers
A:A screenshot cannot replace the underlying capture request metadata, token issuance history and data-access audit needed to establish sequence and integrity.
B:Changing the original API gateway and egress logs show high-volume encrypted uploads from one service principal compromises provenance and makes later findings harder to verify.
C:Volatile evidence relevant to data is sent to a new overseas endpoint shortly after app token escalation may disappear during remediation or reboot.
Question 375
At Media subscription provider, the incident team supports content delivery API. A new security event is reported: data is sent to a new overseas endpoint shortly after app token escalation. The log clue is: API gateway and egress logs show high-volume encrypted uploads from one service principal. The incident remains active, but content delivery API is operationally important. Which containment decision is most appropriate now?
- Publish a speculative full-incident attribution notice before constraining the active behavior data is sent to a new overseas endpoint shortly after app token escalation
- Erase API gateway and egress logs show high-volume encrypted uploads from one service principal to reduce alert volume rather than isolating the observed attacker route
- Disconnect every service at Media subscription provider, regardless of whether it has a dependency on the affected content delivery API
- Execute scoped containment: block only unauthorized egress path and restrict service principal until analysis completes
Explanation
Correct Answer
D:Block only unauthorized egress path and restrict service principal until analysis completes stops or limits the observed path while balancing continuity of content delivery API. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Communication matters, but active data is sent to a new overseas endpoint shortly after app token escalation requires proportionate containment and evidence preservation first.
B:Erasing API gateway and egress logs show high-volume encrypted uploads from one service principal neither blocks attacker access nor supports a reliable subsequent recovery decision.
C:Broad interruption may unnecessarily affect content delivery API; containment should be scoped to evidenced systems and approved critical-service requirements.
Question 376
At Media subscription provider, the incident team supports content delivery API. A new security event is reported: data is sent to a new overseas endpoint shortly after app token escalation. The log clue is: API gateway and egress logs show high-volume encrypted uploads from one service principal. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Rewrite the playbook for content delivery API but leave the confirmed malicious access mechanism active
- Restore content delivery API without first correcting the access and persistence cause addressed by remove unauthorized integration, rotate credentials and fix service principal trust
- Remove the attack’s established access and persistence: remove unauthorized integration, rotate credentials and fix service principal trust
- Use only the original firewall block and assume it has also removed all persistence behind data is sent to a new overseas endpoint shortly after app token escalation
Explanation
Correct Answer
C:Remove unauthorized integration, rotate credentials and fix service principal trust targets the mechanism behind data is sent to a new overseas endpoint shortly after app token escalation, reducing recurrence when content delivery API returns to normal operations.
Incorrect Answers
A:Updated paperwork does not eradicate the mechanism behind data is sent to a new overseas endpoint shortly after app token escalation.
B:Recovery before remove unauthorized integration, rotate credentials and fix service principal trust could reintroduce the same compromise path.
D:Containment can stop communication without eliminating the root access that produced API gateway and egress logs show high-volume encrypted uploads from one service principal.
Question 377
At Media subscription provider, the incident team supports content delivery API. A new security event is reported: data is sent to a new overseas endpoint shortly after app token escalation. The log clue is: API gateway and egress logs show high-volume encrypted uploads from one service principal. Containment and eradication are complete. Which recovery acceptance test should precede release of content delivery API to normal users?
- Expose content delivery API to users before confirming that the conditions behind data is sent to a new overseas endpoint shortly after app token escalation are absent
- Perform controlled return-to-service validation: verify content access and egress allowlist in a clean redeployment
- Approve recovery of content delivery API when it boots, without executing the test verify content access and egress allowlist in a clean redeployment
- Delete preserved evidence including capture request metadata, token issuance history and data-access audit as soon as the service restarts
Explanation
Correct Answer
B:Verify content access and egress allowlist in a clean redeployment demonstrates that the compromised pathway is absent while content delivery API again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, content delivery API could immediately face the same exploit condition.
C:A boot event cannot prove verify content access and egress allowlist in a clean redeployment or protect the service from recurrence of data is sent to a new overseas endpoint shortly after app token escalation.
D:Evidence retention obligations continue beyond restart; capture request metadata, token issuance history and data-access audit may be required for subsequent review.
Question 378
At Media subscription provider, the incident team supports content delivery API. A new security event is reported: data is sent to a new overseas endpoint shortly after app token escalation. The log clue is: API gateway and egress logs show high-volume encrypted uploads from one service principal. The incident has been contained and normal service has resumed. A post-incident review identifies that service-account token had broad write scope and no destination policy. Which improvement should be prioritized?
- Write a lessons-learned memo about data is sent to a new overseas endpoint shortly after app token escalation with no due date, control owner or validation activity
- Assign an owner and measurable corrective action addressing the root cause: service-account token had broad write scope and no destination policy, with a future effectiveness test
- Discipline the whole on-duty response shift rather than examining the documented weakness service-account token had broad write scope and no destination policy
- Close the follow-up for content delivery API merely because restoration completed, without addressing service-account token had broad write scope and no destination policy
Explanation
Correct Answer
B:Service-account token had broad write scope and no destination policy was the systemic weakness that enabled or worsened data is sent to a new overseas endpoint shortly after app token escalation. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:An unowned recommendation does not produce a verified control improvement for content delivery API.
C:A personnel-only response lacks support from the documented root cause: service-account token had broad write scope and no destination policy.
D:Service restoration does not address service-account token had broad write scope and no destination policy; ignoring it leaves the next incident likely to follow the same route.
Question 379
Municipal water services is reviewing a security finding affecting approved vulnerability scanner: frequent 'critical' alerts are actually vendor test signatures on lab systems. The current reporting problem is that board report counts raw unvalidated detections as incidents. What information should be delivered first to decision makers responsible for false-positive rate undermines confidence and shifts remediation capacity?
- Report only the number of tickets closed for approved vulnerability scanner, concealing the unresolved exposure from frequent 'critical' alerts are actually vendor test signatures on lab systems
- State that frequent 'critical' alerts are actually vendor test signatures on lab systems was eliminated because Municipal water services distributed a dashboard on schedule
- Forward raw telemetry from validated finding samples, scanner signatures and asset context to executives without summarizing consequences for false-positive rate undermines confidence and shifts remediation capacity
- Present a concise, evidence-qualified risk and impact summary based on validated finding samples, scanner signatures and asset context, with decisions and uncertainty stated
Explanation
Correct Answer
D:Validated finding samples, scanner signatures and asset context supports a decision-oriented picture of false-positive rate undermines confidence and shifts remediation capacity while separating confirmed facts from unknowns. This corrects the reporting defect: board report counts raw unvalidated detections as incidents.
Incorrect Answers
A:Ticket counts do not establish whether frequent 'critical' alerts are actually vendor test signatures on lab systems still threatens false-positive rate undermines confidence and shifts remediation capacity.
B:Reporting timeliness is not evidence that validated finding samples, scanner signatures and asset context shows full risk elimination.
C:Raw telemetry may support analysts, but decision makers need the meaning for false-positive rate undermines confidence and shifts remediation capacity and accountable options.
Question 380
Municipal water services is reviewing a security finding affecting approved vulnerability scanner: frequent 'critical' alerts are actually vendor test signatures on lab systems. The current reporting problem is that board report counts raw unvalidated detections as incidents. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Remove the timestamps and correlations from validated finding samples, scanner signatures and asset context so the technical report occupies fewer pages
- Provide the original relevant artifacts and validation method from validated finding samples, scanner signatures and asset context, tied to affected assets, owners and retest criteria
- Give vulnerability assessment lead the same board overview rather than the reproducible records from validated finding samples, scanner signatures and asset context
- Accept an assertion that vulnerability assessment lead completed the correction with no retest against validated finding samples, scanner signatures and asset context
Explanation
Correct Answer
B:Validated finding samples, scanner signatures and asset context gives engineers traceable scope and a basis for confirming that vulnerability assessment lead has resolved the identified exposure on approved vulnerability scanner.
Incorrect Answers
A:Such edits break reproducibility of frequent 'critical' alerts are actually vendor test signatures on lab systems and make scope or remediation errors harder to find.
C:A high-level board summary cannot identify the concrete validated finding samples, scanner signatures and asset context fields needed for technical validation.
D:Self-assessment without test artifacts is weaker than verifiable validated finding samples, scanner signatures and asset context and agreed acceptance conditions.
