CompTIA CS0-003 Practice Test 43
Question 420
At Regional bank, the security team assesses XML ingestion API. The current issue is XML external entity expansion enabled; assessment evidence states: test XML requests internal file path and parser attempts resolution. The owner reports that secure parser config and allowlisted schema has been deployed. What evidence should close the vulnerability item?
- Use an unrelated server’s clean findings to claim XML ingestion API is fixed without retesting the affected path
- Suppress future results for XML external entity expansion enabled so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using disable external entity resolution in isolated test and observe parser behavior, confirm the vulnerability is gone and record change evidence
- Close test XML requests internal file path and parser attempts resolution after the deployment tool returns success, without verifying the current state of XML ingestion API
Explanation
Correct Answer
C:Closure requires checking the same affected path identified by test XML requests internal file path and parser attempts resolution, plus regression impact on XML ingestion API. A change ticket alone is not proof of removal of XML external entity expansion enabled.
Incorrect Answers
A:The result must be tied to XML ingestion API and the actual exposure: partner-only API gateway but broad supplier authentication.
B:Suppression may hide a failed or incomplete fix, leaving internal file disclosure exposed despite the administrative record.
D:Process completion is not evidence that test XML requests internal file path and parser attempts resolution no longer applies to XML ingestion API.
Question 421
At Wildlife conservation office, the incident team supports field inspector phone. A new security event is reported: a managed phone is lost with offline access to sensitive patrol maps. The log clue is: mobile management reports unsynced local cache and last unlocked screen state. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Assign a final attack-chain stage to field inspector phone without confirming what behavior actually occurred in mobile management reports unsynced local cache and last unlocked screen state
- Attribute a managed phone is lost with offline access to sensitive patrol maps to a named foreign intelligence service using only mobile management reports unsynced local cache and last unlocked screen state
- Treat an ATT&CK label for a managed phone is lost with offline access to sensitive patrol maps as a complete recovery instruction without checking evidence or impact
- Map the observed behavior in mobile management reports unsynced local cache and last unlocked screen state to a technique-level ATT&CK or kill-chain hypothesis and record confidence
Explanation
Correct Answer
D:A managed phone is lost with offline access to sensitive patrol maps and mobile management reports unsynced local cache and last unlocked screen state support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:Attack frameworks describe observable stages and techniques; the mobile management reports unsynced local cache and last unlocked screen state must substantiate whichever stage is assigned.
B:Neither a managed phone is lost with offline access to sensitive patrol maps nor mobile management reports unsynced local cache and last unlocked screen state establishes uniquely identifying actor evidence.
C:A taxonomy is not an incident response plan for field inspector phone; scope and safety constraints still matter.
Question 422
At Wildlife conservation office, the incident team supports field inspector phone. A new security event is reported: a managed phone is lost with offline access to sensitive patrol maps. The log clue is: mobile management reports unsynced local cache and last unlocked screen state. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Preserve and hash incident artifacts: retain device compliance, sync history and key revocation logs
- Alter original mobile management reports unsynced local cache and last unlocked screen state entries to remove irrelevant records before preserving the forensic timeline
- Keep only a screenshot of mobile management reports unsynced local cache and last unlocked screen state, discarding original artifacts such as retain device compliance, sync history and key revocation logs
- Rebuild field inspector phone first and collect the volatile evidence for a managed phone is lost with offline access to sensitive patrol maps afterward
Explanation
Correct Answer
A:Retain device compliance, sync history and key revocation logs retains relevant source context and integrity checks so the team can reconstruct a managed phone is lost with offline access to sensitive patrol maps and support an auditable chain of custody.
Incorrect Answers
B:Changing the original mobile management reports unsynced local cache and last unlocked screen state compromises provenance and makes later findings harder to verify.
C:A screenshot cannot replace the underlying retain device compliance, sync history and key revocation logs needed to establish sequence and integrity.
D:Volatile evidence relevant to a managed phone is lost with offline access to sensitive patrol maps may disappear during remediation or reboot.
Question 423
At Wildlife conservation office, the incident team supports field inspector phone. A new security event is reported: a managed phone is lost with offline access to sensitive patrol maps. The log clue is: mobile management reports unsynced local cache and last unlocked screen state. The incident remains active, but field inspector phone is operationally important. Which containment decision is most appropriate now?
- Publish a speculative full-incident attribution notice before constraining the active behavior a managed phone is lost with offline access to sensitive patrol maps
- Disconnect every service at Wildlife conservation office, regardless of whether it has a dependency on the affected field inspector phone
- Erase mobile management reports unsynced local cache and last unlocked screen state to reduce alert volume rather than isolating the observed attacker route
- Execute scoped containment: revoke app tokens and deploy selective remote lock using MDM
Explanation
Correct Answer
D:Revoke app tokens and deploy selective remote lock using MDM stops or limits the observed path while balancing continuity of field inspector phone. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Communication matters, but active a managed phone is lost with offline access to sensitive patrol maps requires proportionate containment and evidence preservation first.
B:Broad interruption may unnecessarily affect field inspector phone; containment should be scoped to evidenced systems and approved critical-service requirements.
C:Erasing mobile management reports unsynced local cache and last unlocked screen state neither blocks attacker access nor supports a reliable subsequent recovery decision.
Question 424
At Wildlife conservation office, the incident team supports field inspector phone. A new security event is reported: a managed phone is lost with offline access to sensitive patrol maps. The log clue is: mobile management reports unsynced local cache and last unlocked screen state. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Rewrite the playbook for field inspector phone but leave the confirmed malicious access mechanism active
- Remove the attack’s established access and persistence: remove persistent offline map entitlement and tighten caching policy
- Use only the original firewall block and assume it has also removed all persistence behind a managed phone is lost with offline access to sensitive patrol maps
- Restore field inspector phone without first correcting the access and persistence cause addressed by remove persistent offline map entitlement and tighten caching policy
Explanation
Correct Answer
B:Remove persistent offline map entitlement and tighten caching policy targets the mechanism behind a managed phone is lost with offline access to sensitive patrol maps, reducing recurrence when field inspector phone returns to normal operations.
Incorrect Answers
A:Updated paperwork does not eradicate the mechanism behind a managed phone is lost with offline access to sensitive patrol maps.
C:Containment can stop communication without eliminating the root access that produced mobile management reports unsynced local cache and last unlocked screen state.
D:Recovery before remove persistent offline map entitlement and tighten caching policy could reintroduce the same compromise path.
Question 425
At Wildlife conservation office, the incident team supports field inspector phone. A new security event is reported: a managed phone is lost with offline access to sensitive patrol maps. The log clue is: mobile management reports unsynced local cache and last unlocked screen state. Containment and eradication are complete. Which recovery acceptance test should precede release of field inspector phone to normal users?
- Perform controlled return-to-service validation: verify replacement device policy and absence of suspicious account access
- Delete preserved evidence including retain device compliance, sync history and key revocation logs as soon as the service restarts
- Expose field inspector phone to users before confirming that the conditions behind a managed phone is lost with offline access to sensitive patrol maps are absent
- Approve recovery of field inspector phone when it boots, without executing the test verify replacement device policy and absence of suspicious account access
Explanation
Correct Answer
A:Verify replacement device policy and absence of suspicious account access demonstrates that the compromised pathway is absent while field inspector phone again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
B:Evidence retention obligations continue beyond restart; retain device compliance, sync history and key revocation logs may be required for subsequent review.
C:Without a clean functional/security validation, field inspector phone could immediately face the same exploit condition.
D:A boot event cannot prove verify replacement device policy and absence of suspicious account access or protect the service from recurrence of a managed phone is lost with offline access to sensitive patrol maps.
Question 426
At Wildlife conservation office, the incident team supports field inspector phone. A new security event is reported: a managed phone is lost with offline access to sensitive patrol maps. The log clue is: mobile management reports unsynced local cache and last unlocked screen state. The incident has been contained and normal service has resumed. A post-incident review identifies that offline cache retention exceeded operational need after patrols. Which improvement should be prioritized?
- Assign an owner and measurable corrective action addressing the root cause: offline cache retention exceeded operational need after patrols, with a future effectiveness test
- Write a lessons-learned memo about a managed phone is lost with offline access to sensitive patrol maps with no due date, control owner or validation activity
- Discipline the whole on-duty response shift rather than examining the documented weakness offline cache retention exceeded operational need after patrols
- Close the follow-up for field inspector phone merely because restoration completed, without addressing offline cache retention exceeded operational need after patrols
Explanation
Correct Answer
A:Offline cache retention exceeded operational need after patrols was the systemic weakness that enabled or worsened a managed phone is lost with offline access to sensitive patrol maps. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
B:An unowned recommendation does not produce a verified control improvement for field inspector phone.
C:A personnel-only response lacks support from the documented root cause: offline cache retention exceeded operational need after patrols.
D:Service restoration does not address offline cache retention exceeded operational need after patrols; ignoring it leaves the next incident likely to follow the same route.
Question 427
At Regional airline, analysts monitor airport guest Wi-Fi. They observe that ARP entries for the default gateway oscillate between two unrecognized MACs. Evidence: packet capture shows unsolicited ARP replies claiming the gateway IP. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Announce that packet capture shows unsolicited ARP replies claiming the gateway IP conclusively proves theft of passenger portal sessions before reviewing any sessions or file access
- Treat the pattern as a hypothesis of ARP spoofing consistent with local traffic interception and begin corroborating it with endpoint and network evidence
- Treat VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses as conclusive authorization for the current event without matching process or identity
- Downgrade ARP entries for the default gateway oscillate between two unrecognized MACs solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
B:The combination of ARP entries for the default gateway oscillate between two unrecognized MACs and packet capture shows unsolicited ARP replies claiming the gateway IP is suspicious for ARP spoofing consistent with local traffic interception. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting passenger portal sessions.
Incorrect Answers
A:packet capture shows unsolicited ARP replies claiming the gateway IP is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
C:The legitimate comparator is VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses; it does not establish that the current event came from the same approved identity or workflow.
D:An intrusion can begin on one asset. The specific indicator on airport guest Wi-Fi warrants its own validation before expanding or closing the investigation.
Question 428
At Regional airline, analysts monitor airport guest Wi-Fi. They observe that ARP entries for the default gateway oscillate between two unrecognized MACs. Evidence: packet capture shows unsolicited ARP replies claiming the gateway IP. A separate known-good explanation is: VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses. Which next analysis most reliably determines what caused the observed event?
- Suspend telemetry collection on airport guest Wi-Fi while waiting for the connection pattern to stop
- Summarize packet capture shows unsolicited ARP replies claiming the gateway IP into a ticket and discard underlying event identifiers before correlation
- Perform a scoped investigation: compare ARP sender MAC, gateway redundancy configuration and switch port membership
- Accept a public reputation score for the destination as proof of the origin of packet capture shows unsolicited ARP replies claiming the gateway IP, without using compare ARP sender MAC, gateway redundancy configuration and switch port membership
Explanation
Correct Answer
C:Compare ARP sender MAC, gateway redundancy configuration and switch port membership ties the evidence on airport guest Wi-Fi to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses.
Incorrect Answers
A:Suppressing telemetry destroys the source needed to investigate ARP spoofing consistent with local traffic interception and may conceal further actions.
B:The original packet capture shows unsolicited ARP replies claiming the gateway IP must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:A reputation score may inform triage but cannot establish the origin of packet capture shows unsolicited ARP replies claiming the gateway IP or whether the activity matches VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses.
Question 429
Regional airline has a candidate alert for airport guest Wi-Fi: packet capture shows unsolicited ARP replies claiming the gateway IP. The team argues it is harmless because VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses. What is the most defensible false-positive assessment?
- Distinguish packet capture shows unsolicited ARP replies claiming the gateway IP from the approved behavior (VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses) by validating process, identity and time attribution
- Automatically treat every event resembling packet capture shows unsolicited ARP replies claiming the gateway IP as confirmed compromise of airport guest Wi-Fi, without checking provenance
- Interpret an absence of existing vendor signatures as proof that ARP entries for the default gateway oscillate between two unrecognized MACs is benign
- Create a blanket suppression for packet capture shows unsolicited ARP replies claiming the gateway IP because VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses can produce a superficially similar event
Explanation
Correct Answer
A:VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses is a plausible alternative, but it must be proven to match the actual source of packet capture shows unsolicited ARP replies claiming the gateway IP. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting passenger portal sessions.
C:Absence of a signature does not refute the concrete behavior: ARP entries for the default gateway oscillate between two unrecognized MACs.
D:Similarity to VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses does not exclude an attacker from producing the same surface event on airport guest Wi-Fi.
Question 430
At Regional airline, analysts monitor airport guest Wi-Fi. They observe that ARP entries for the default gateway oscillate between two unrecognized MACs. Evidence: packet capture shows unsolicited ARP replies claiming the gateway IP. The team confirms unauthorized behavior and must protect passenger portal sessions; legitimate service continuity remains necessary. Which containment decision is best?
- Disable every production service at Regional airline without measuring whether its dependencies share the observed malicious path
- Erase packet capture shows unsolicited ARP replies claiming the gateway IP from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on airport guest Wi-Fi unrestricted until actual losses of passenger portal sessions can be measured
- Apply targeted containment: quarantine the offending access port while maintaining the legitimate virtual gateway
Explanation
Correct Answer
D:Quarantine the offending access port while maintaining the legitimate virtual gateway constrains the observed threat while maintaining necessary service for passenger portal sessions. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Global shutdown could disrupt passenger portal sessions without evidence that every system has been affected; scoped isolation is more proportionate.
B:Eliminating packet capture shows unsolicited ARP replies claiming the gateway IP evidence does not contain ARP spoofing consistent with local traffic interception and impairs forensic reconstruction.
C:Once unauthorized behavior is confirmed on airport guest Wi-Fi, delaying containment could expand the exposure affecting passenger portal sessions.
