CompTIA CS0-003 Practice Test 4
Question 30
Regional hospital has investigated malicious document execution through a living-off-the-land interpreter on clinical scheduling desktop. Detection operators report that authorized administration scripts originate from signed management agents and approved task windows; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to a signed office application spawns PowerShell with encoded commands after a document opens, without validation or guardrails for patient appointment data
- Improve detection by requiring context-aware correlation: alert on office-to-shell parentage with encoded arguments while excluding approved management agent ancestry
- Assign critical severity to every routine activity on clinical scheduling desktop whether or not it matches alert on office-to-shell parentage with encoded arguments while excluding approved management agent ancestry
- Suppress every future event associated with EDR records WINWORD.EXE to powershell.exe with encoded payload and outbound HTTPS, including events outside authorized administration scripts originate from signed management agents and approved task windows
Explanation
Correct Answer
B:Alert on office-to-shell parentage with encoded arguments while excluding approved management agent ancestry retains the specific threat signal while discriminating against authorized administration scripts originate from signed management agents and approved task windows. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt patient appointment data and cannot distinguish the benign workflow from attacker behavior.
C:Alert severity without distinguishing authorized administration scripts originate from signed management agents and approved task windows from malicious conditions would increase noise and operational workload.
D:Suppressing all monitoring would also hide a recurrence of malicious document execution through a living-off-the-land interpreter, even where it threatens patient appointment data.
Question 31
At Regional university, the security team assesses student forum. The current issue is persistent cross-site scripting in profile bio; assessment evidence states: DAST reports injected script present on another user's page. The service is authenticated student portal across dorm networks. Operational constraints: course registration freeze limits release. Which assessment approach is most appropriate before recommending a fix?
- Use an authorized, scoped validation approach that considers service sensitivity: confirm rendered output in isolated test account and inspect encoding boundary
- Launch unapproved intrusive exploitation across student forum during course registration freeze limits release instead of using a scoped test
- Accept the label persistent cross-site scripting in profile bio as confirmed without checking the reported evidence DAST reports injected script present on another user's page or actual deployment
- Use only an anonymous outside-in scan of student forum even when authenticated student portal across dorm networks requires authenticated deployment context
Explanation
Correct Answer
A:The evidence DAST reports injected script present on another user's page must be evaluated without violating the constraint course registration freeze limits release. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
B:Uncontrolled testing may breach service safety, especially because course registration freeze limits release; authorization and scope are prerequisites.
C:The finding does not establish which live component is affected or whether the exposure authenticated student portal across dorm networks is real.
D:Asset configuration and the constraints of student forum matter; external findings alone may misstate or miss the exposed path.
Question 32
At Regional university, the security team assesses student forum. The current issue is persistent cross-site scripting in profile bio; assessment evidence states: DAST reports injected script present on another user's page. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against student forum, ignoring that course registration freeze limits release and a safer validation exist
- Mark DAST reports injected script present on another user's page resolved or confirmed solely from the scanner severity without confirm rendered output in isolated test account and inspect encoding boundary
- Confirm the reported condition in the relevant asset context: confirm rendered output in isolated test account and inspect encoding boundary
- Assume student forum is safe because another platform with similar software recently passed its own assessment
Explanation
Correct Answer
C:Confirm rendered output in isolated test account and inspect encoding boundary tests the reported condition DAST reports injected script present on another user's page against actual deployment context (authenticated student portal across dorm networks). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when confirm rendered output in isolated test account and inspect encoding boundary can provide authorized evidence and course registration freeze limits release constrains production testing.
B:DAST reports injected script present on another user's page may be accurate but its actual occurrence and configuration on student forum must be established before calling it validated.
D:Security of an unrelated host cannot establish the state of student forum, whose reported issue is persistent cross-site scripting in profile bio.
Question 33
At Regional university, the security team assesses student forum. The current issue is persistent cross-site scripting in profile bio; assessment evidence states: DAST reports injected script present on another user's page. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Give every vulnerability the same deadline despite persistent cross-site scripting in profile bio and business impact on student session integrity
- Choose the highest nominal scanner severity first while ignoring authenticated student portal across dorm networks and the consequence to student session integrity
- Prioritize the confirmed exposure of student forum, accounting for student session integrity and the real access path: authenticated student portal across dorm networks
- Choose whatever finding on student forum was logged most recently, regardless of actual exploit path or priority
Explanation
Correct Answer
C:Risk depends on practical reachability, threat activity and consequence. The issue persistent cross-site scripting in profile bio can affect student session integrity through authenticated student portal across dorm networks; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Uniform priority ignores authenticated student portal across dorm networks, operational harm and student session integrity; documented context makes triage defensible.
B:CVSS describes technical characteristics, not the entirety of exposure and student session integrity for this deployment.
D:Discovery order is not evidence of urgency compared with the actual affected student forum.
Question 34
At Regional university, the security team assesses student forum. The current issue is persistent cross-site scripting in profile bio; assessment evidence states: DAST reports injected script present on another user's page. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Leave persistent cross-site scripting in profile bio present indefinitely because no incident involving student session integrity was recorded this week
- Use CSP and restrictive posting pending application update as permanent closure of the confirmed issue instead of deploying context-aware output encoding and safe HTML sanitization
- Sign an exception document but do not implement or test context-aware output encoding and safe HTML sanitization on student forum
- Implement and verify the root-cause fix: context-aware output encoding and safe HTML sanitization
Explanation
Correct Answer
D:Context-aware output encoding and safe HTML sanitization targets the mechanism persistent cross-site scripting in profile bio rather than only filtering symptoms. Verification must account for DAST reports injected script present on another user's page and continued protection of student session integrity.
Incorrect Answers
A:No observed attack does not correct the verified condition DAST reports injected script present on another user's page or eliminate its potential impact on student session integrity.
B:The interim control may reduce exposure, but it can leave the underlying persistent cross-site scripting in profile bio and should be time-limited with verification and owner oversight.
C:Risk acceptance paperwork does not itself remediate persistent cross-site scripting in profile bio on student forum; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 35
At Regional university, the security team assesses student forum. The current issue is persistent cross-site scripting in profile bio; assessment evidence states: DAST reports injected script present on another user's page. A permanent correction cannot be deployed immediately because course registration freeze limits release. Which interim treatment is the safest governed option?
- Apply a time-bound compensating measure, CSP and restrictive posting pending application update, record the residual risk owner and schedule the tested permanent fix
- Claim persistent cross-site scripting in profile bio is patched when the change ticket opens, without confirming CSP and restrictive posting pending application update or a planned permanent change
- Accept continued exposure of student session integrity without any owner, expiry or compensating verification because course registration freeze limits release
- Push context-aware output encoding and safe HTML sanitization immediately to all production systems with no safe change window despite course registration freeze limits release
Explanation
Correct Answer
A:CSP and restrictive posting pending application update can reduce short-term exposure while course registration freeze limits release delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because student session integrity remains at stake.
Incorrect Answers
B:A work item is not proof that persistent cross-site scripting in profile bio was corrected or even that CSP and restrictive posting pending application update operates.
C:Business criticality increases the need for accountable decisions and review; it does not make student session integrity irrelevant.
D:Ignoring course registration freeze limits release could cause avoidable service failure and is not a risk-aware remediation process.
Question 36
At Regional university, the security team assesses student forum. The current issue is persistent cross-site scripting in profile bio; assessment evidence states: DAST reports injected script present on another user's page. The owner reports that context-aware output encoding and safe HTML sanitization has been deployed. What evidence should close the vulnerability item?
- Suppress future results for persistent cross-site scripting in profile bio so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using confirm rendered output in isolated test account and inspect encoding boundary, confirm the vulnerability is gone and record change evidence
- Use an unrelated server’s clean findings to claim student forum is fixed without retesting the affected path
- Close DAST reports injected script present on another user's page after the deployment tool returns success, without verifying the current state of student forum
Explanation
Correct Answer
B:Closure requires checking the same affected path identified by DAST reports injected script present on another user's page, plus regression impact on student forum. A change ticket alone is not proof of removal of persistent cross-site scripting in profile bio.
Incorrect Answers
A:Suppression may hide a failed or incomplete fix, leaving student session integrity exposed despite the administrative record.
C:The result must be tied to student forum and the actual exposure: authenticated student portal across dorm networks.
D:Process completion is not evidence that DAST reports injected script present on another user's page no longer applies to student forum.
Question 37
At Wholesale marketplace, the incident team supports accounts payable mailbox. A new security event is reported: a supplier invoice phishing link captures a finance user password. The log clue is: mail audit records lookalike sender and new MFA token grant. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Map the observed behavior in mail audit records lookalike sender and new MFA token grant to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Treat an ATT&CK label for a supplier invoice phishing link captures a finance user password as a complete recovery instruction without checking evidence or impact
- Assign a final attack-chain stage to accounts payable mailbox without confirming what behavior actually occurred in mail audit records lookalike sender and new MFA token grant
- Attribute a supplier invoice phishing link captures a finance user password to a named foreign intelligence service using only mail audit records lookalike sender and new MFA token grant
Explanation
Correct Answer
A:A supplier invoice phishing link captures a finance user password and mail audit records lookalike sender and new MFA token grant support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
B:A taxonomy is not an incident response plan for accounts payable mailbox; scope and safety constraints still matter.
C:Attack frameworks describe observable stages and techniques; the mail audit records lookalike sender and new MFA token grant must substantiate whichever stage is assigned.
D:Neither a supplier invoice phishing link captures a finance user password nor mail audit records lookalike sender and new MFA token grant establishes uniquely identifying actor evidence.
Question 38
At Wholesale marketplace, the incident team supports accounts payable mailbox. A new security event is reported: a supplier invoice phishing link captures a finance user password. The log clue is: mail audit records lookalike sender and new MFA token grant. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Rebuild accounts payable mailbox first and collect the volatile evidence for a supplier invoice phishing link captures a finance user password afterward
- Preserve and hash incident artifacts: original email headers, URL redirect chain and IdP token logs preserved under case ID
- Keep only a screenshot of mail audit records lookalike sender and new MFA token grant, discarding original artifacts such as original email headers, URL redirect chain and IdP token logs preserved under case ID
- Alter original mail audit records lookalike sender and new MFA token grant entries to remove irrelevant records before preserving the forensic timeline
Explanation
Correct Answer
B:Original email headers, URL redirect chain and IdP token logs preserved under case ID retains relevant source context and integrity checks so the team can reconstruct a supplier invoice phishing link captures a finance user password and support an auditable chain of custody.
Incorrect Answers
A:Volatile evidence relevant to a supplier invoice phishing link captures a finance user password may disappear during remediation or reboot.
C:A screenshot cannot replace the underlying original email headers, URL redirect chain and IdP token logs preserved under case ID needed to establish sequence and integrity.
D:Changing the original mail audit records lookalike sender and new MFA token grant compromises provenance and makes later findings harder to verify.
Question 39
At Wholesale marketplace, the incident team supports accounts payable mailbox. A new security event is reported: a supplier invoice phishing link captures a finance user password. The log clue is: mail audit records lookalike sender and new MFA token grant. The incident remains active, but accounts payable mailbox is operationally important. Which containment decision is most appropriate now?
- Publish a speculative full-incident attribution notice before constraining the active behavior a supplier invoice phishing link captures a finance user password
- Erase mail audit records lookalike sender and new MFA token grant to reduce alert volume rather than isolating the observed attacker route
- Disconnect every service at Wholesale marketplace, regardless of whether it has a dependency on the affected accounts payable mailbox
- Execute scoped containment: revoke suspect tokens and block attacker sessions while keeping vendor payment validation manual
Explanation
Correct Answer
D:Revoke suspect tokens and block attacker sessions while keeping vendor payment validation manual stops or limits the observed path while balancing continuity of accounts payable mailbox. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Communication matters, but active a supplier invoice phishing link captures a finance user password requires proportionate containment and evidence preservation first.
B:Erasing mail audit records lookalike sender and new MFA token grant neither blocks attacker access nor supports a reliable subsequent recovery decision.
C:Broad interruption may unnecessarily affect accounts payable mailbox; containment should be scoped to evidenced systems and approved critical-service requirements.
Question 40
At Wholesale marketplace, the incident team supports accounts payable mailbox. A new security event is reported: a supplier invoice phishing link captures a finance user password. The log clue is: mail audit records lookalike sender and new MFA token grant. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Restore accounts payable mailbox without first correcting the access and persistence cause addressed by remove malicious inbox rules and reset authenticated factors and compromised credentials
- Rewrite the playbook for accounts payable mailbox but leave the confirmed malicious access mechanism active
- Remove the attack’s established access and persistence: remove malicious inbox rules and reset authenticated factors and compromised credentials
- Use only the original firewall block and assume it has also removed all persistence behind a supplier invoice phishing link captures a finance user password
Explanation
Correct Answer
C:Remove malicious inbox rules and reset authenticated factors and compromised credentials targets the mechanism behind a supplier invoice phishing link captures a finance user password, reducing recurrence when accounts payable mailbox returns to normal operations.
Incorrect Answers
A:Recovery before remove malicious inbox rules and reset authenticated factors and compromised credentials could reintroduce the same compromise path.
B:Updated paperwork does not eradicate the mechanism behind a supplier invoice phishing link captures a finance user password.
D:Containment can stop communication without eliminating the root access that produced mail audit records lookalike sender and new MFA token grant.
