CompTIA CS0-003 Practice Test 41
Question 400
At Transportation authority, the incident team supports fare settlement servers. A new security event is reported: destructive commands wipe recovery partitions on multiple hosts. The log clue is: process telemetry shows recovery deletion and scheduled task across fleet. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Remove the attack’s established access and persistence: remove malicious scheduled tasks and rebuild affected hosts from trusted media
- Use only the original firewall block and assume it has also removed all persistence behind destructive commands wipe recovery partitions on multiple hosts
- Restore fare settlement servers without first correcting the access and persistence cause addressed by remove malicious scheduled tasks and rebuild affected hosts from trusted media
- Rewrite the playbook for fare settlement servers but leave the confirmed malicious access mechanism active
Explanation
Correct Answer
A:Remove malicious scheduled tasks and rebuild affected hosts from trusted media targets the mechanism behind destructive commands wipe recovery partitions on multiple hosts, reducing recurrence when fare settlement servers returns to normal operations.
Incorrect Answers
B:Containment can stop communication without eliminating the root access that produced process telemetry shows recovery deletion and scheduled task across fleet.
C:Recovery before remove malicious scheduled tasks and rebuild affected hosts from trusted media could reintroduce the same compromise path.
D:Updated paperwork does not eradicate the mechanism behind destructive commands wipe recovery partitions on multiple hosts.
Question 401
At Transportation authority, the incident team supports fare settlement servers. A new security event is reported: destructive commands wipe recovery partitions on multiple hosts. The log clue is: process telemetry shows recovery deletion and scheduled task across fleet. Containment and eradication are complete. Which recovery acceptance test should precede release of fare settlement servers to normal users?
- Expose fare settlement servers to users before confirming that the conditions behind destructive commands wipe recovery partitions on multiple hosts are absent
- Approve recovery of fare settlement servers when it boots, without executing the test test financial reconciliation and backup restore before reopening settlement
- Perform controlled return-to-service validation: test financial reconciliation and backup restore before reopening settlement
- Delete preserved evidence including retain system-event copies, affected disk snapshots and image hashes as soon as the service restarts
Explanation
Correct Answer
C:Test financial reconciliation and backup restore before reopening settlement demonstrates that the compromised pathway is absent while fare settlement servers again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, fare settlement servers could immediately face the same exploit condition.
B:A boot event cannot prove test financial reconciliation and backup restore before reopening settlement or protect the service from recurrence of destructive commands wipe recovery partitions on multiple hosts.
D:Evidence retention obligations continue beyond restart; retain system-event copies, affected disk snapshots and image hashes may be required for subsequent review.
Question 402
At Transportation authority, the incident team supports fare settlement servers. A new security event is reported: destructive commands wipe recovery partitions on multiple hosts. The log clue is: process telemetry shows recovery deletion and scheduled task across fleet. The incident has been contained and normal service has resumed. A post-incident review identifies that admin script service account lacked command restrictions. Which improvement should be prioritized?
- Assign an owner and measurable corrective action addressing the root cause: admin script service account lacked command restrictions, with a future effectiveness test
- Write a lessons-learned memo about destructive commands wipe recovery partitions on multiple hosts with no due date, control owner or validation activity
- Discipline the whole on-duty response shift rather than examining the documented weakness admin script service account lacked command restrictions
- Close the follow-up for fare settlement servers merely because restoration completed, without addressing admin script service account lacked command restrictions
Explanation
Correct Answer
A:Admin script service account lacked command restrictions was the systemic weakness that enabled or worsened destructive commands wipe recovery partitions on multiple hosts. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
B:An unowned recommendation does not produce a verified control improvement for fare settlement servers.
C:A personnel-only response lacks support from the documented root cause: admin script service account lacked command restrictions.
D:Service restoration does not address admin script service account lacked command restrictions; ignoring it leaves the next incident likely to follow the same route.
Question 403
International media company is reviewing a security finding affecting subscriber account platform: ransomware disruption triggers customer questions and regulator interest. The current reporting problem is that communications draft mixes conjecture with forensic findings. What information should be delivered first to decision makers responsible for scope, service continuity and controlled release of facts matter?
- State that ransomware disruption triggers customer questions and regulator interest was eliminated because International media company distributed a dashboard on schedule
- Present a concise, evidence-qualified risk and impact summary based on verified outage timeline, restoration evidence and legal notification rules, with decisions and uncertainty stated
- Forward raw telemetry from verified outage timeline, restoration evidence and legal notification rules to executives without summarizing consequences for scope, service continuity and controlled release of facts matter
- Report only the number of tickets closed for subscriber account platform, concealing the unresolved exposure from ransomware disruption triggers customer questions and regulator interest
Explanation
Correct Answer
B:Verified outage timeline, restoration evidence and legal notification rules supports a decision-oriented picture of scope, service continuity and controlled release of facts matter while separating confirmed facts from unknowns. This corrects the reporting defect: communications draft mixes conjecture with forensic findings.
Incorrect Answers
A:Reporting timeliness is not evidence that verified outage timeline, restoration evidence and legal notification rules shows full risk elimination.
C:Raw telemetry may support analysts, but decision makers need the meaning for scope, service continuity and controlled release of facts matter and accountable options.
D:Ticket counts do not establish whether ransomware disruption triggers customer questions and regulator interest still threatens scope, service continuity and controlled release of facts matter.
Question 404
International media company is reviewing a security finding affecting subscriber account platform: ransomware disruption triggers customer questions and regulator interest. The current reporting problem is that communications draft mixes conjecture with forensic findings. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Provide the original relevant artifacts and validation method from verified outage timeline, restoration evidence and legal notification rules, tied to affected assets, owners and retest criteria
- Remove the timestamps and correlations from verified outage timeline, restoration evidence and legal notification rules so the technical report occupies fewer pages
- Give incident commander the same board overview rather than the reproducible records from verified outage timeline, restoration evidence and legal notification rules
- Accept an assertion that incident commander completed the correction with no retest against verified outage timeline, restoration evidence and legal notification rules
Explanation
Correct Answer
A:Verified outage timeline, restoration evidence and legal notification rules gives engineers traceable scope and a basis for confirming that incident commander has resolved the identified exposure on subscriber account platform.
Incorrect Answers
B:Such edits break reproducibility of ransomware disruption triggers customer questions and regulator interest and make scope or remediation errors harder to find.
C:A high-level board summary cannot identify the concrete verified outage timeline, restoration evidence and legal notification rules fields needed for technical validation.
D:Self-assessment without test artifacts is weaker than verifiable verified outage timeline, restoration evidence and legal notification rules and agreed acceptance conditions.
Question 405
International media company is reviewing a security finding affecting subscriber account platform: ransomware disruption triggers customer questions and regulator interest. The current reporting problem is that communications draft mixes conjecture with forensic findings. Stakeholders include public affairs, counsel, customers and authorities. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Coordinate fact-checked messages, recipients and timing with public affairs, counsel, customers and authorities, preserving applicable legal and incident approval paths
- Withhold notification of ransomware disruption triggers customer questions and regulator interest indefinitely even after verified verified outage timeline, restoration evidence and legal notification rules meets a binding disclosure threshold
- Give a technical engineer sole authority for every legal or public statement otherwise owned by public affairs, counsel, customers and authorities
- Release unconfirmed details about ransomware disruption triggers customer questions and regulator interest externally before evidence and approvals from public affairs, counsel, customers and authorities have been reconciled
Explanation
Correct Answer
A:The parties public affairs, counsel, customers and authorities have different responsibilities. Using verified verified outage timeline, restoration evidence and legal notification rules and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
B:If verified verified outage timeline, restoration evidence and legal notification rules triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
C:Technical diagnosis does not automatically confer the disclosure authority held by public affairs, counsel, customers and authorities.
D:Unconfirmed claims could misrepresent the impact of ransomware disruption triggers customer questions and regulator interest and breach communication obligations.
Question 406
International media company is reviewing a security finding affecting subscriber account platform: ransomware disruption triggers customer questions and regulator interest. The current reporting problem is that communications draft mixes conjecture with forensic findings. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Track a defined, evidence-based measure of verified service impact and next public update time, with trend, scope and accountable source
- Compare International media company teams only by tickets closed, ignoring which services are still exposed to ransomware disruption triggers customer questions and regulator interest
- Measure improvement in verified service impact and next public update time by how many slides were added to the board presentation
- Redefine verified service impact and next public update time every week until all dashboards appear positive
Explanation
Correct Answer
A:The measure verified service impact and next public update time connects reporting to a change in scope, service continuity and controlled release of facts matter, rather than the number of reports or raw alert volume. Trends must use consistent inputs from verified outage timeline, restoration evidence and legal notification rules.
Incorrect Answers
B:Tickets can hide unresolved scope, service continuity and controlled release of facts matter; a risk-weighted outcome metric is needed.
C:Presentation size does not establish verified service impact and next public update time or whether ransomware disruption triggers customer questions and regulator interest is managed.
D:Inconsistent measures cannot support a credible trend for verified service impact and next public update time.
Question 407
International media company is reviewing a security finding affecting subscriber account platform: ransomware disruption triggers customer questions and regulator interest. The current reporting problem is that communications draft mixes conjecture with forensic findings. An action plan is being negotiated, but investigation and recovery underway. What reporting recommendation best supports practical remediation?
- Set an immediate fix deadline for subscriber account platform without acknowledging that investigation and recovery underway
- Give incident commander an unlimited exception because investigation and recovery underway rather than reporting residual risk and expiry
- Copy a generic checklist for ransomware disruption triggers customer questions and regulator interest without accountable owners, asset scope or milestones
- Ask the incident commander to document mitigation choices for subscriber account platform, service constraints, milestones, approvers and time-bound risk acceptance if needed
Explanation
Correct Answer
D:Investigation and recovery underway creates a real implementation constraint. A plan owned by incident commander with measured risk and delegated approvals protects scope, service continuity and controlled release of facts matter better than an unrealistic generic deadline.
Incorrect Answers
A:Ignoring investigation and recovery underway can turn a security fix into service disruption while failing to clarify remaining risk.
B:Scope, service continuity and controlled release of facts matter still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
C:A non-accountable template cannot address investigation and recovery underway or demonstrate progress on ransomware disruption triggers customer questions and regulator interest.
Question 408
International media company is reviewing a security finding affecting subscriber account platform: ransomware disruption triggers customer questions and regulator interest. The current reporting problem is that communications draft mixes conjecture with forensic findings. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Use the number of remediation meetings at International media company instead of observed change in verified service impact and next public update time as closeout proof
- Close ransomware disruption triggers customer questions and regulator interest based solely on a self-reported completion email from incident commander with no verification
- Report retested verified outage timeline, restoration evidence and legal notification rules, the outcome against verified service impact and next public update time, remaining exceptions, and owner confirmation
- Discard the pre-change evidence verified outage timeline, restoration evidence and legal notification rules so that only the improved numbers for verified service impact and next public update time remain
Explanation
Correct Answer
C:Verified outage timeline, restoration evidence and legal notification rules provides source-linked closure proof. Showing verified service impact and next public update time and residual exceptions verifies whether incident commander actually reduced scope, service continuity and controlled release of facts matter rather than merely marking a ticket closed.
Incorrect Answers
A:Meetings do not confirm that ransomware disruption triggers customer questions and regulator interest was corrected or that remaining scope, service continuity and controlled release of facts matter is acceptable.
B:Self-declared completion does not demonstrate improved verified service impact and next public update time against documented verified outage timeline, restoration evidence and legal notification rules.
D:Without historical verified service impact and next public update time inputs, leaders cannot validate the claimed improvement or identify recurrence.
Question 409
At Public library system, analysts monitor branch wireless LAN. They observe that a device advertises DHCP replies with a gateway outside the managed subnet. Evidence: SPAN capture shows DHCP Offer packets from an unregistered switch port. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat authorized DHCP relay replies originate from managed server interfaces with documented IP ranges as conclusive authorization for the current event without matching process or identity
- Treat the pattern as a hypothesis of rogue DHCP service attempting traffic redirection and begin corroborating it with endpoint and network evidence
- Announce that SPAN capture shows DHCP Offer packets from an unregistered switch port conclusively proves theft of patron device privacy before reviewing any sessions or file access
- Downgrade a device advertises DHCP replies with a gateway outside the managed subnet solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
B:The combination of a device advertises DHCP replies with a gateway outside the managed subnet and SPAN capture shows DHCP Offer packets from an unregistered switch port is suspicious for rogue DHCP service attempting traffic redirection. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting patron device privacy.
Incorrect Answers
A:The legitimate comparator is authorized DHCP relay replies originate from managed server interfaces with documented IP ranges; it does not establish that the current event came from the same approved identity or workflow.
C:SPAN capture shows DHCP Offer packets from an unregistered switch port is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
D:An intrusion can begin on one asset. The specific indicator on branch wireless LAN warrants its own validation before expanding or closing the investigation.
Question 410
At Public library system, analysts monitor branch wireless LAN. They observe that a device advertises DHCP replies with a gateway outside the managed subnet. Evidence: SPAN capture shows DHCP Offer packets from an unregistered switch port. A separate known-good explanation is: authorized DHCP relay replies originate from managed server interfaces with documented IP ranges. Which next analysis most reliably determines what caused the observed event?
- Summarize SPAN capture shows DHCP Offer packets from an unregistered switch port into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on branch wireless LAN while waiting for the connection pattern to stop
- Accept a public reputation score for the destination as proof of the origin of SPAN capture shows DHCP Offer packets from an unregistered switch port, without using match DHCP server identifiers to switch MAC address tables and network-controller inventory
- Perform a scoped investigation: match DHCP server identifiers to switch MAC address tables and network-controller inventory
Explanation
Correct Answer
D:Match DHCP server identifiers to switch MAC address tables and network-controller inventory ties the evidence on branch wireless LAN to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: authorized DHCP relay replies originate from managed server interfaces with documented IP ranges.
Incorrect Answers
A:The original SPAN capture shows DHCP Offer packets from an unregistered switch port must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
B:Suppressing telemetry destroys the source needed to investigate rogue DHCP service attempting traffic redirection and may conceal further actions.
C:A reputation score may inform triage but cannot establish the origin of SPAN capture shows DHCP Offer packets from an unregistered switch port or whether the activity matches authorized DHCP relay replies originate from managed server interfaces with documented IP ranges.
