CompTIA CS0-003 Practice Test 42
Question 410
At Public library system, analysts monitor branch wireless LAN. They observe that a device advertises DHCP replies with a gateway outside the managed subnet. Evidence: SPAN capture shows DHCP Offer packets from an unregistered switch port. A separate known-good explanation is: authorized DHCP relay replies originate from managed server interfaces with documented IP ranges. Which next analysis most reliably determines what caused the observed event?
- Summarize SPAN capture shows DHCP Offer packets from an unregistered switch port into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on branch wireless LAN while waiting for the connection pattern to stop
- Accept a public reputation score for the destination as proof of the origin of SPAN capture shows DHCP Offer packets from an unregistered switch port, without using match DHCP server identifiers to switch MAC address tables and network-controller inventory
- Perform a scoped investigation: match DHCP server identifiers to switch MAC address tables and network-controller inventory
Explanation
Correct Answer
D:Match DHCP server identifiers to switch MAC address tables and network-controller inventory ties the evidence on branch wireless LAN to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: authorized DHCP relay replies originate from managed server interfaces with documented IP ranges.
Incorrect Answers
A:The original SPAN capture shows DHCP Offer packets from an unregistered switch port must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
B:Suppressing telemetry destroys the source needed to investigate rogue DHCP service attempting traffic redirection and may conceal further actions.
C:A reputation score may inform triage but cannot establish the origin of SPAN capture shows DHCP Offer packets from an unregistered switch port or whether the activity matches authorized DHCP relay replies originate from managed server interfaces with documented IP ranges.
Question 411
Public library system has a candidate alert for branch wireless LAN: SPAN capture shows DHCP Offer packets from an unregistered switch port. The team argues it is harmless because authorized DHCP relay replies originate from managed server interfaces with documented IP ranges. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that a device advertises DHCP replies with a gateway outside the managed subnet is benign
- Automatically treat every event resembling SPAN capture shows DHCP Offer packets from an unregistered switch port as confirmed compromise of branch wireless LAN, without checking provenance
- Distinguish SPAN capture shows DHCP Offer packets from an unregistered switch port from the approved behavior (authorized DHCP relay replies originate from managed server interfaces with documented IP ranges) by validating process, identity and time attribution
- Create a blanket suppression for SPAN capture shows DHCP Offer packets from an unregistered switch port because authorized DHCP relay replies originate from managed server interfaces with documented IP ranges can produce a superficially similar event
Explanation
Correct Answer
C:Authorized DHCP relay replies originate from managed server interfaces with documented IP ranges is a plausible alternative, but it must be proven to match the actual source of SPAN capture shows DHCP Offer packets from an unregistered switch port. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: a device advertises DHCP replies with a gateway outside the managed subnet.
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting patron device privacy.
D:Similarity to authorized DHCP relay replies originate from managed server interfaces with documented IP ranges does not exclude an attacker from producing the same surface event on branch wireless LAN.
Question 412
At Public library system, analysts monitor branch wireless LAN. They observe that a device advertises DHCP replies with a gateway outside the managed subnet. Evidence: SPAN capture shows DHCP Offer packets from an unregistered switch port. The team confirms unauthorized behavior and must protect patron device privacy; legitimate service continuity remains necessary. Which containment decision is best?
- Erase SPAN capture shows DHCP Offer packets from an unregistered switch port from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on branch wireless LAN unrestricted until actual losses of patron device privacy can be measured
- Disable every production service at Public library system without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: disable only the rogue switch port and renew affected clients via approved DHCP
Explanation
Correct Answer
D:Disable only the rogue switch port and renew affected clients via approved DHCP constrains the observed threat while maintaining necessary service for patron device privacy. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Eliminating SPAN capture shows DHCP Offer packets from an unregistered switch port evidence does not contain rogue DHCP service attempting traffic redirection and impairs forensic reconstruction.
B:Once unauthorized behavior is confirmed on branch wireless LAN, delaying containment could expand the exposure affecting patron device privacy.
C:Global shutdown could disrupt patron device privacy without evidence that every system has been affected; scoped isolation is more proportionate.
Question 413
Public library system has correlated an alert involving branch wireless LAN; the key observation is SPAN capture shows DHCP Offer packets from an unregistered switch port. Another security organization requests a defensible, privacy-conscious indicator package to hunt for similar behavior. What should be shared?
- Share all raw patron device privacy records to prove the alert is important before stripping unnecessary personal or protected content
- Send only the statement that rogue DHCP service attempting traffic redirection exists with no indicator, observation time or confidence
- Share the validated technical observables and conditions from hunt for the unexpected server ID and anomalous default gateway in branch leases, with timing, confidence, classification and minimal sensitive data
- Declare every system using branch wireless LAN technology compromised without proof beyond the single observation
Explanation
Correct Answer
C:Hunt for the unexpected server ID and anomalous default gateway in branch leases describes how other defenders can test the observation. Time, confidence and privacy handling preserve investigative value without disclosing unrelated patron device privacy data.
Incorrect Answers
A:Sharing investigative indicators does not authorize exposing patron device privacy; minimize records and follow approved intelligence-sharing rules.
B:A generic threat label cannot help a partner correlate SPAN capture shows DHCP Offer packets from an unregistered switch port to its own assets or distinguish it from routine activity.
D:The single finding SPAN capture shows DHCP Offer packets from an unregistered switch port on branch wireless LAN does not prove the same activity across organizations; share enough context for each partner to validate it.
Question 414
Public library system has investigated rogue DHCP service attempting traffic redirection on branch wireless LAN. Detection operators report that authorized DHCP relay replies originate from managed server interfaces with documented IP ranges; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Suppress every future event associated with SPAN capture shows DHCP Offer packets from an unregistered switch port, including events outside authorized DHCP relay replies originate from managed server interfaces with documented IP ranges
- Assign critical severity to every routine activity on branch wireless LAN whether or not it matches flag DHCP Offers from nonapproved ports rather than all lease changes
- Automate service shutdown on the first simple match to a device advertises DHCP replies with a gateway outside the managed subnet, without validation or guardrails for patron device privacy
- Improve detection by requiring context-aware correlation: flag DHCP Offers from nonapproved ports rather than all lease changes
Explanation
Correct Answer
D:Flag DHCP Offers from nonapproved ports rather than all lease changes retains the specific threat signal while discriminating against authorized DHCP relay replies originate from managed server interfaces with documented IP ranges. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Suppressing all monitoring would also hide a recurrence of rogue DHCP service attempting traffic redirection, even where it threatens patron device privacy.
B:Alert severity without distinguishing authorized DHCP relay replies originate from managed server interfaces with documented IP ranges from malicious conditions would increase noise and operational workload.
C:An untested, unqualified automation could interrupt patron device privacy and cannot distinguish the benign workflow from attacker behavior.
Question 415
At Regional bank, the security team assesses XML ingestion API. The current issue is XML external entity expansion enabled; assessment evidence states: test XML requests internal file path and parser attempts resolution. The service is partner-only API gateway but broad supplier authentication. Operational constraints: partner messages require backward-compatible schema. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across XML ingestion API during partner messages require backward-compatible schema instead of using a scoped test
- Use an authorized, scoped validation approach that considers service sensitivity: disable external entity resolution in isolated test and observe parser behavior
- Use only an anonymous outside-in scan of XML ingestion API even when partner-only API gateway but broad supplier authentication requires authenticated deployment context
- Accept the label XML external entity expansion enabled as confirmed without checking the reported evidence test XML requests internal file path and parser attempts resolution or actual deployment
Explanation
Correct Answer
B:The evidence test XML requests internal file path and parser attempts resolution must be evaluated without violating the constraint partner messages require backward-compatible schema. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because partner messages require backward-compatible schema; authorization and scope are prerequisites.
C:Asset configuration and the constraints of XML ingestion API matter; external findings alone may misstate or miss the exposed path.
D:The finding does not establish which live component is affected or whether the exposure partner-only API gateway but broad supplier authentication is real.
Question 416
At Regional bank, the security team assesses XML ingestion API. The current issue is XML external entity expansion enabled; assessment evidence states: test XML requests internal file path and parser attempts resolution. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against XML ingestion API, ignoring that partner messages require backward-compatible schema and a safer validation exist
- Confirm the reported condition in the relevant asset context: disable external entity resolution in isolated test and observe parser behavior
- Mark test XML requests internal file path and parser attempts resolution resolved or confirmed solely from the scanner severity without disable external entity resolution in isolated test and observe parser behavior
- Assume XML ingestion API is safe because another platform with similar software recently passed its own assessment
Explanation
Correct Answer
B:Disable external entity resolution in isolated test and observe parser behavior tests the reported condition test XML requests internal file path and parser attempts resolution against actual deployment context (partner-only API gateway but broad supplier authentication). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when disable external entity resolution in isolated test and observe parser behavior can provide authorized evidence and partner messages require backward-compatible schema constrains production testing.
C:test XML requests internal file path and parser attempts resolution may be accurate but its actual occurrence and configuration on XML ingestion API must be established before calling it validated.
D:Security of an unrelated host cannot establish the state of XML ingestion API, whose reported issue is XML external entity expansion enabled.
Question 417
At Regional bank, the security team assesses XML ingestion API. The current issue is XML external entity expansion enabled; assessment evidence states: test XML requests internal file path and parser attempts resolution. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Prioritize the confirmed exposure of XML ingestion API, accounting for internal file disclosure and the real access path: partner-only API gateway but broad supplier authentication
- Give every vulnerability the same deadline despite XML external entity expansion enabled and business impact on internal file disclosure
- Choose whatever finding on XML ingestion API was logged most recently, regardless of actual exploit path or priority
- Choose the highest nominal scanner severity first while ignoring partner-only API gateway but broad supplier authentication and the consequence to internal file disclosure
Explanation
Correct Answer
A:Risk depends on practical reachability, threat activity and consequence. The issue XML external entity expansion enabled can affect internal file disclosure through partner-only API gateway but broad supplier authentication; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
B:Uniform priority ignores partner-only API gateway but broad supplier authentication, operational harm and internal file disclosure; documented context makes triage defensible.
C:Discovery order is not evidence of urgency compared with the actual affected XML ingestion API.
D:CVSS describes technical characteristics, not the entirety of exposure and internal file disclosure for this deployment.
Question 418
At Regional bank, the security team assesses XML ingestion API. The current issue is XML external entity expansion enabled; assessment evidence states: test XML requests internal file path and parser attempts resolution. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use reject DOCTYPE at gateway until library fix as permanent closure of the confirmed issue instead of deploying secure parser config and allowlisted schema
- Leave XML external entity expansion enabled present indefinitely because no incident involving internal file disclosure was recorded this week
- Sign an exception document but do not implement or test secure parser config and allowlisted schema on XML ingestion API
- Implement and verify the root-cause fix: secure parser config and allowlisted schema
Explanation
Correct Answer
D:Secure parser config and allowlisted schema targets the mechanism XML external entity expansion enabled rather than only filtering symptoms. Verification must account for test XML requests internal file path and parser attempts resolution and continued protection of internal file disclosure.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying XML external entity expansion enabled and should be time-limited with verification and owner oversight.
B:No observed attack does not correct the verified condition test XML requests internal file path and parser attempts resolution or eliminate its potential impact on internal file disclosure.
C:Risk acceptance paperwork does not itself remediate XML external entity expansion enabled on XML ingestion API; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 419
At Regional bank, the security team assesses XML ingestion API. The current issue is XML external entity expansion enabled; assessment evidence states: test XML requests internal file path and parser attempts resolution. A permanent correction cannot be deployed immediately because partner messages require backward-compatible schema. Which interim treatment is the safest governed option?
- Claim XML external entity expansion enabled is patched when the change ticket opens, without confirming reject DOCTYPE at gateway until library fix or a planned permanent change
- Apply a time-bound compensating measure, reject DOCTYPE at gateway until library fix, record the residual risk owner and schedule the tested permanent fix
- Accept continued exposure of internal file disclosure without any owner, expiry or compensating verification because partner messages require backward-compatible schema
- Push secure parser config and allowlisted schema immediately to all production systems with no safe change window despite partner messages require backward-compatible schema
Explanation
Correct Answer
B:Reject DOCTYPE at gateway until library fix can reduce short-term exposure while partner messages require backward-compatible schema delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because internal file disclosure remains at stake.
Incorrect Answers
A:A work item is not proof that XML external entity expansion enabled was corrected or even that reject DOCTYPE at gateway until library fix operates.
C:Business criticality increases the need for accountable decisions and review; it does not make internal file disclosure irrelevant.
D:Ignoring partner messages require backward-compatible schema could cause avoidable service failure and is not a risk-aware remediation process.
Question 420
At Regional bank, the security team assesses XML ingestion API. The current issue is XML external entity expansion enabled; assessment evidence states: test XML requests internal file path and parser attempts resolution. The owner reports that secure parser config and allowlisted schema has been deployed. What evidence should close the vulnerability item?
- Use an unrelated server’s clean findings to claim XML ingestion API is fixed without retesting the affected path
- Suppress future results for XML external entity expansion enabled so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using disable external entity resolution in isolated test and observe parser behavior, confirm the vulnerability is gone and record change evidence
- Close test XML requests internal file path and parser attempts resolution after the deployment tool returns success, without verifying the current state of XML ingestion API
Explanation
Correct Answer
C:Closure requires checking the same affected path identified by test XML requests internal file path and parser attempts resolution, plus regression impact on XML ingestion API. A change ticket alone is not proof of removal of XML external entity expansion enabled.
Incorrect Answers
A:The result must be tied to XML ingestion API and the actual exposure: partner-only API gateway but broad supplier authentication.
B:Suppression may hide a failed or incomplete fix, leaving internal file disclosure exposed despite the administrative record.
D:Process completion is not evidence that test XML requests internal file path and parser attempts resolution no longer applies to XML ingestion API.
