CompTIA CS0-003 Practice Test 40
Question 390
Financial exchange has investigated false ordering caused by log-clock drift rather than impossible causal flow on distributed SIEM pipeline. Detection operators report that properly synchronized agents share UTC timestamps with collector offsets under a second; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Improve detection by requiring context-aware correlation: monitor NTP drift and flag unsynchronized events prior to temporal correlation
- Assign critical severity to every routine activity on distributed SIEM pipeline whether or not it matches monitor NTP drift and flag unsynchronized events prior to temporal correlation
- Suppress every future event associated with collector NTP offset reports a 12-minute drift on one firewall, including events outside properly synchronized agents share UTC timestamps with collector offsets under a second
- Automate service shutdown on the first simple match to an alert timeline suggests remote access occurred before its authentication event, without validation or guardrails for trading audit integrity
Explanation
Correct Answer
A:Monitor NTP drift and flag unsynchronized events prior to temporal correlation retains the specific threat signal while discriminating against properly synchronized agents share UTC timestamps with collector offsets under a second. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
B:Alert severity without distinguishing properly synchronized agents share UTC timestamps with collector offsets under a second from malicious conditions would increase noise and operational workload.
C:Suppressing all monitoring would also hide a recurrence of false ordering caused by log-clock drift rather than impossible causal flow, even where it threatens trading audit integrity.
D:An untested, unqualified automation could interrupt trading audit integrity and cannot distinguish the benign workflow from attacker behavior.
Question 391
At E-learning provider, the security team assesses course import handler. The current issue is insecure deserialization of submitted job object; assessment evidence states: fuzzer reveals object type instantiation from untrusted payload. The service is authenticated instructor file imports. Operational constraints: term-end grading import must continue via safe CSV. Which assessment approach is most appropriate before recommending a fix?
- Accept the label insecure deserialization of submitted job object as confirmed without checking the reported evidence fuzzer reveals object type instantiation from untrusted payload or actual deployment
- Use only an anonymous outside-in scan of course import handler even when authenticated instructor file imports requires authenticated deployment context
- Launch unapproved intrusive exploitation across course import handler during term-end grading import must continue via safe CSV instead of using a scoped test
- Use an authorized, scoped validation approach that considers service sensitivity: trace deserialization allowlist and execution path in test environment
Explanation
Correct Answer
D:The evidence fuzzer reveals object type instantiation from untrusted payload must be evaluated without violating the constraint term-end grading import must continue via safe CSV. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:The finding does not establish which live component is affected or whether the exposure authenticated instructor file imports is real.
B:Asset configuration and the constraints of course import handler matter; external findings alone may misstate or miss the exposed path.
C:Uncontrolled testing may breach service safety, especially because term-end grading import must continue via safe CSV; authorization and scope are prerequisites.
Question 392
At E-learning provider, the security team assesses course import handler. The current issue is insecure deserialization of submitted job object; assessment evidence states: fuzzer reveals object type instantiation from untrusted payload. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against course import handler, ignoring that term-end grading import must continue via safe CSV and a safer validation exist
- Assume course import handler is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: trace deserialization allowlist and execution path in test environment
- Mark fuzzer reveals object type instantiation from untrusted payload resolved or confirmed solely from the scanner severity without trace deserialization allowlist and execution path in test environment
Explanation
Correct Answer
C:Trace deserialization allowlist and execution path in test environment tests the reported condition fuzzer reveals object type instantiation from untrusted payload against actual deployment context (authenticated instructor file imports). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when trace deserialization allowlist and execution path in test environment can provide authorized evidence and term-end grading import must continue via safe CSV constrains production testing.
B:Security of an unrelated host cannot establish the state of course import handler, whose reported issue is insecure deserialization of submitted job object.
D:fuzzer reveals object type instantiation from untrusted payload may be accurate but its actual occurrence and configuration on course import handler must be established before calling it validated.
Question 393
At E-learning provider, the security team assesses course import handler. The current issue is insecure deserialization of submitted job object; assessment evidence states: fuzzer reveals object type instantiation from untrusted payload. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Prioritize the confirmed exposure of course import handler, accounting for course integrity and the real access path: authenticated instructor file imports
- Choose the highest nominal scanner severity first while ignoring authenticated instructor file imports and the consequence to course integrity
- Give every vulnerability the same deadline despite insecure deserialization of submitted job object and business impact on course integrity
- Choose whatever finding on course import handler was logged most recently, regardless of actual exploit path or priority
Explanation
Correct Answer
A:Risk depends on practical reachability, threat activity and consequence. The issue insecure deserialization of submitted job object can affect course integrity through authenticated instructor file imports; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
B:CVSS describes technical characteristics, not the entirety of exposure and course integrity for this deployment.
C:Uniform priority ignores authenticated instructor file imports, operational harm and course integrity; documented context makes triage defensible.
D:Discovery order is not evidence of urgency compared with the actual affected course import handler.
Question 394
At E-learning provider, the security team assesses course import handler. The current issue is insecure deserialization of submitted job object; assessment evidence states: fuzzer reveals object type instantiation from untrusted payload. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use disable risky import mode temporarily as permanent closure of the confirmed issue instead of deploying reject untrusted object types and use safe serialization format
- Implement and verify the root-cause fix: reject untrusted object types and use safe serialization format
- Sign an exception document but do not implement or test reject untrusted object types and use safe serialization format on course import handler
- Leave insecure deserialization of submitted job object present indefinitely because no incident involving course integrity was recorded this week
Explanation
Correct Answer
B:Reject untrusted object types and use safe serialization format targets the mechanism insecure deserialization of submitted job object rather than only filtering symptoms. Verification must account for fuzzer reveals object type instantiation from untrusted payload and continued protection of course integrity.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying insecure deserialization of submitted job object and should be time-limited with verification and owner oversight.
C:Risk acceptance paperwork does not itself remediate insecure deserialization of submitted job object on course import handler; authorized, tested implementation is still required when the risk exceeds tolerance.
D:No observed attack does not correct the verified condition fuzzer reveals object type instantiation from untrusted payload or eliminate its potential impact on course integrity.
Question 395
At E-learning provider, the security team assesses course import handler. The current issue is insecure deserialization of submitted job object; assessment evidence states: fuzzer reveals object type instantiation from untrusted payload. A permanent correction cannot be deployed immediately because term-end grading import must continue via safe CSV. Which interim treatment is the safest governed option?
- Claim insecure deserialization of submitted job object is patched when the change ticket opens, without confirming disable risky import mode temporarily or a planned permanent change
- Push reject untrusted object types and use safe serialization format immediately to all production systems with no safe change window despite term-end grading import must continue via safe CSV
- Apply a time-bound compensating measure, disable risky import mode temporarily, record the residual risk owner and schedule the tested permanent fix
- Accept continued exposure of course integrity without any owner, expiry or compensating verification because term-end grading import must continue via safe CSV
Explanation
Correct Answer
C:Disable risky import mode temporarily can reduce short-term exposure while term-end grading import must continue via safe CSV delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because course integrity remains at stake.
Incorrect Answers
A:A work item is not proof that insecure deserialization of submitted job object was corrected or even that disable risky import mode temporarily operates.
B:Ignoring term-end grading import must continue via safe CSV could cause avoidable service failure and is not a risk-aware remediation process.
D:Business criticality increases the need for accountable decisions and review; it does not make course integrity irrelevant.
Question 396
At E-learning provider, the security team assesses course import handler. The current issue is insecure deserialization of submitted job object; assessment evidence states: fuzzer reveals object type instantiation from untrusted payload. The owner reports that reject untrusted object types and use safe serialization format has been deployed. What evidence should close the vulnerability item?
- Close fuzzer reveals object type instantiation from untrusted payload after the deployment tool returns success, without verifying the current state of course import handler
- Suppress future results for insecure deserialization of submitted job object so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using trace deserialization allowlist and execution path in test environment, confirm the vulnerability is gone and record change evidence
- Use an unrelated server’s clean findings to claim course import handler is fixed without retesting the affected path
Explanation
Correct Answer
C:Closure requires checking the same affected path identified by fuzzer reveals object type instantiation from untrusted payload, plus regression impact on course import handler. A change ticket alone is not proof of removal of insecure deserialization of submitted job object.
Incorrect Answers
A:Process completion is not evidence that fuzzer reveals object type instantiation from untrusted payload no longer applies to course import handler.
B:Suppression may hide a failed or incomplete fix, leaving course integrity exposed despite the administrative record.
D:The result must be tied to course import handler and the actual exposure: authenticated instructor file imports.
Question 397
At Transportation authority, analysts apply the Diamond Model to reports concerning fare settlement servers: destructive commands wipe recovery partitions on multiple hosts. Evidence includes process telemetry shows recovery deletion and scheduled task across fleet, but no adversary has been reliably identified. Which representation preserves the observed relationships without invented attribution?
- Record fare settlement servers as the observed victim, the technical action as the capability, any infrastructure evidenced by process telemetry shows recovery deletion and scheduled task across fleet, and adversary identity as unknown
- Assign a specific nation-state to destructive commands wipe recovery partitions on multiple hosts and consider all other Diamond Model elements established automatically
- Treat fare settlement servers as the attacker infrastructure and an unnamed public target as the only victim without analyzing the actual incident path
- Use the Diamond Model name as permission to delete raw process telemetry shows recovery deletion and scheduled task across fleet and replace it with a presumed actor narrative
Explanation
Correct Answer
A:The Diamond Model separates victim, capability, infrastructure and adversary. The logs support observed behavior at fare settlement servers but do not establish a named adversary.
Incorrect Answers
B:Neither process telemetry shows recovery deletion and scheduled task across fleet nor event type identifies a particular actor; attribution requires additional independent intelligence.
C:The provided evidence names fare settlement servers as the affected environment. Reversing roles obscures which entity is actually being victimized.
D:Modeling relates evidence; it does not replace source preservation or justify inventing a history of destructive commands wipe recovery partitions on multiple hosts.
Question 398
At Transportation authority, the incident team supports fare settlement servers. A new security event is reported: destructive commands wipe recovery partitions on multiple hosts. The log clue is: process telemetry shows recovery deletion and scheduled task across fleet. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Rebuild fare settlement servers first and collect the volatile evidence for destructive commands wipe recovery partitions on multiple hosts afterward
- Preserve and hash incident artifacts: retain system-event copies, affected disk snapshots and image hashes
- Keep only a screenshot of process telemetry shows recovery deletion and scheduled task across fleet, discarding original artifacts such as retain system-event copies, affected disk snapshots and image hashes
- Alter original process telemetry shows recovery deletion and scheduled task across fleet entries to remove irrelevant records before preserving the forensic timeline
Explanation
Correct Answer
B:Retain system-event copies, affected disk snapshots and image hashes retains relevant source context and integrity checks so the team can reconstruct destructive commands wipe recovery partitions on multiple hosts and support an auditable chain of custody.
Incorrect Answers
A:Volatile evidence relevant to destructive commands wipe recovery partitions on multiple hosts may disappear during remediation or reboot.
C:A screenshot cannot replace the underlying retain system-event copies, affected disk snapshots and image hashes needed to establish sequence and integrity.
D:Changing the original process telemetry shows recovery deletion and scheduled task across fleet compromises provenance and makes later findings harder to verify.
Question 399
At Transportation authority, the incident team supports fare settlement servers. A new security event is reported: destructive commands wipe recovery partitions on multiple hosts. The log clue is: process telemetry shows recovery deletion and scheduled task across fleet. The incident remains active, but fare settlement servers is operationally important. Which containment decision is most appropriate now?
- Erase process telemetry shows recovery deletion and scheduled task across fleet to reduce alert volume rather than isolating the observed attacker route
- Disconnect every service at Transportation authority, regardless of whether it has a dependency on the affected fare settlement servers
- Execute scoped containment: disconnect destructive management channel and protect standby settlement node
- Publish a speculative full-incident attribution notice before constraining the active behavior destructive commands wipe recovery partitions on multiple hosts
Explanation
Correct Answer
C:Disconnect destructive management channel and protect standby settlement node stops or limits the observed path while balancing continuity of fare settlement servers. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Erasing process telemetry shows recovery deletion and scheduled task across fleet neither blocks attacker access nor supports a reliable subsequent recovery decision.
B:Broad interruption may unnecessarily affect fare settlement servers; containment should be scoped to evidenced systems and approved critical-service requirements.
D:Communication matters, but active destructive commands wipe recovery partitions on multiple hosts requires proportionate containment and evidence preservation first.
Question 400
At Transportation authority, the incident team supports fare settlement servers. A new security event is reported: destructive commands wipe recovery partitions on multiple hosts. The log clue is: process telemetry shows recovery deletion and scheduled task across fleet. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Remove the attack’s established access and persistence: remove malicious scheduled tasks and rebuild affected hosts from trusted media
- Use only the original firewall block and assume it has also removed all persistence behind destructive commands wipe recovery partitions on multiple hosts
- Restore fare settlement servers without first correcting the access and persistence cause addressed by remove malicious scheduled tasks and rebuild affected hosts from trusted media
- Rewrite the playbook for fare settlement servers but leave the confirmed malicious access mechanism active
Explanation
Correct Answer
A:Remove malicious scheduled tasks and rebuild affected hosts from trusted media targets the mechanism behind destructive commands wipe recovery partitions on multiple hosts, reducing recurrence when fare settlement servers returns to normal operations.
Incorrect Answers
B:Containment can stop communication without eliminating the root access that produced process telemetry shows recovery deletion and scheduled task across fleet.
C:Recovery before remove malicious scheduled tasks and rebuild affected hosts from trusted media could reintroduce the same compromise path.
D:Updated paperwork does not eradicate the mechanism behind destructive commands wipe recovery partitions on multiple hosts.
