CompTIA CS0-003 Practice Test 44
Question 430
At Regional airline, analysts monitor airport guest Wi-Fi. They observe that ARP entries for the default gateway oscillate between two unrecognized MACs. Evidence: packet capture shows unsolicited ARP replies claiming the gateway IP. The team confirms unauthorized behavior and must protect passenger portal sessions; legitimate service continuity remains necessary. Which containment decision is best?
- Disable every production service at Regional airline without measuring whether its dependencies share the observed malicious path
- Erase packet capture shows unsolicited ARP replies claiming the gateway IP from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on airport guest Wi-Fi unrestricted until actual losses of passenger portal sessions can be measured
- Apply targeted containment: quarantine the offending access port while maintaining the legitimate virtual gateway
Explanation
Correct Answer
D:Quarantine the offending access port while maintaining the legitimate virtual gateway constrains the observed threat while maintaining necessary service for passenger portal sessions. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Global shutdown could disrupt passenger portal sessions without evidence that every system has been affected; scoped isolation is more proportionate.
B:Eliminating packet capture shows unsolicited ARP replies claiming the gateway IP evidence does not contain ARP spoofing consistent with local traffic interception and impairs forensic reconstruction.
C:Once unauthorized behavior is confirmed on airport guest Wi-Fi, delaying containment could expand the exposure affecting passenger portal sessions.
Question 431
At Regional airline, analysts have investigated an initial alert involving airport guest Wi-Fi and need to scope related activity. Original event: packet capture shows unsolicited ARP replies claiming the gateway IP. Which threat-hunt pivot is best grounded in this observation?
- Stop scoping once the initial airport guest Wi-Fi has been contained, even though pivot on forged gateway ARP announcements at nearby access switches has not been attempted
- Mark every host adjacent to airport guest Wi-Fi compromised by assumption without comparing activity-linked observables
- Use the previous month’s overall alert closure count instead of pivoting on packet capture shows unsolicited ARP replies claiming the gateway IP across related identities and systems
- Pivot across the environment: pivot on forged gateway ARP announcements at nearby access switches
Explanation
Correct Answer
D:Pivot on forged gateway ARP announcements at nearby access switches extends the investigation from the specific clue, packet capture shows unsolicited ARP replies claiming the gateway IP, to related activity while preserving host and user attribution. This estimates the scope of potential ARP spoofing consistent with local traffic interception.
Incorrect Answers
A:The initiating host may not be the only affected one; scoping requires examining the connected evidence packet capture shows unsolicited ARP replies claiming the gateway IP.
B:Proximity to airport guest Wi-Fi is not proof of exposure; use the activity-linked pivot to identify actual relationships.
C:Historical alert volume does not trace the shared indicator or determine whether ARP spoofing consistent with local traffic interception spread beyond airport guest Wi-Fi.
Question 432
Regional airline has investigated ARP spoofing consistent with local traffic interception on airport guest Wi-Fi. Detection operators report that VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on airport guest Wi-Fi whether or not it matches detect gateway ARP claims from MACs outside the approved redundancy set
- Suppress every future event associated with packet capture shows unsolicited ARP replies claiming the gateway IP, including events outside VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses
- Automate service shutdown on the first simple match to ARP entries for the default gateway oscillate between two unrecognized MACs, without validation or guardrails for passenger portal sessions
- Improve detection by requiring context-aware correlation: detect gateway ARP claims from MACs outside the approved redundancy set
Explanation
Correct Answer
D:Detect gateway ARP claims from MACs outside the approved redundancy set retains the specific threat signal while discriminating against VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing VRRP or HSRP gateway redundancy uses preapproved virtual MAC addresses from malicious conditions would increase noise and operational workload.
B:Suppressing all monitoring would also hide a recurrence of ARP spoofing consistent with local traffic interception, even where it threatens passenger portal sessions.
C:An untested, unqualified automation could interrupt passenger portal sessions and cannot distinguish the benign workflow from attacker behavior.
Question 433
At Media studio, the security team assesses build dependency tree. The current issue is malicious transitive dependency with postinstall script; assessment evidence states: SBOM detects package version newly published under changed maintainer. The service is CI runner has artifact-signing token. Operational constraints: release schedule lacks alternative signing runner. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across build dependency tree during release schedule lacks alternative signing runner instead of using a scoped test
- Accept the label malicious transitive dependency with postinstall script as confirmed without checking the reported evidence SBOM detects package version newly published under changed maintainer or actual deployment
- Use an authorized, scoped validation approach that considers service sensitivity: inspect provenance, lockfile diff and sandboxed install behavior
- Use only an anonymous outside-in scan of build dependency tree even when CI runner has artifact-signing token requires authenticated deployment context
Explanation
Correct Answer
C:The evidence SBOM detects package version newly published under changed maintainer must be evaluated without violating the constraint release schedule lacks alternative signing runner. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because release schedule lacks alternative signing runner; authorization and scope are prerequisites.
B:The finding does not establish which live component is affected or whether the exposure CI runner has artifact-signing token is real.
D:Asset configuration and the constraints of build dependency tree matter; external findings alone may misstate or miss the exposed path.
Question 434
At Media studio, the security team assesses build dependency tree. The current issue is malicious transitive dependency with postinstall script; assessment evidence states: SBOM detects package version newly published under changed maintainer. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against build dependency tree, ignoring that release schedule lacks alternative signing runner and a safer validation exist
- Confirm the reported condition in the relevant asset context: inspect provenance, lockfile diff and sandboxed install behavior
- Assume build dependency tree is safe because another platform with similar software recently passed its own assessment
- Mark SBOM detects package version newly published under changed maintainer resolved or confirmed solely from the scanner severity without inspect provenance, lockfile diff and sandboxed install behavior
Explanation
Correct Answer
B:Inspect provenance, lockfile diff and sandboxed install behavior tests the reported condition SBOM detects package version newly published under changed maintainer against actual deployment context (CI runner has artifact-signing token). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when inspect provenance, lockfile diff and sandboxed install behavior can provide authorized evidence and release schedule lacks alternative signing runner constrains production testing.
C:Security of an unrelated host cannot establish the state of build dependency tree, whose reported issue is malicious transitive dependency with postinstall script.
D:SBOM detects package version newly published under changed maintainer may be accurate but its actual occurrence and configuration on build dependency tree must be established before calling it validated.
Question 435
At Media studio, the security team assesses build dependency tree. The current issue is malicious transitive dependency with postinstall script; assessment evidence states: SBOM detects package version newly published under changed maintainer. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Give every vulnerability the same deadline despite malicious transitive dependency with postinstall script and business impact on software supply-chain integrity
- Choose the highest nominal scanner severity first while ignoring CI runner has artifact-signing token and the consequence to software supply-chain integrity
- Choose whatever finding on build dependency tree was logged most recently, regardless of actual exploit path or priority
- Prioritize the confirmed exposure of build dependency tree, accounting for software supply-chain integrity and the real access path: CI runner has artifact-signing token
Explanation
Correct Answer
D:Risk depends on practical reachability, threat activity and consequence. The issue malicious transitive dependency with postinstall script can affect software supply-chain integrity through CI runner has artifact-signing token; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Uniform priority ignores CI runner has artifact-signing token, operational harm and software supply-chain integrity; documented context makes triage defensible.
B:CVSS describes technical characteristics, not the entirety of exposure and software supply-chain integrity for this deployment.
C:Discovery order is not evidence of urgency compared with the actual affected build dependency tree.
Question 436
At Media studio, the security team assesses build dependency tree. The current issue is malicious transitive dependency with postinstall script; assessment evidence states: SBOM detects package version newly published under changed maintainer. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Leave malicious transitive dependency with postinstall script present indefinitely because no incident involving software supply-chain integrity was recorded this week
- Sign an exception document but do not implement or test pin trusted digest and require reviewed dependency updates on build dependency tree
- Implement and verify the root-cause fix: pin trusted digest and require reviewed dependency updates
- Use pause affected build pipeline and rotate runner token as permanent closure of the confirmed issue instead of deploying pin trusted digest and require reviewed dependency updates
Explanation
Correct Answer
C:Pin trusted digest and require reviewed dependency updates targets the mechanism malicious transitive dependency with postinstall script rather than only filtering symptoms. Verification must account for SBOM detects package version newly published under changed maintainer and continued protection of software supply-chain integrity.
Incorrect Answers
A:No observed attack does not correct the verified condition SBOM detects package version newly published under changed maintainer or eliminate its potential impact on software supply-chain integrity.
B:Risk acceptance paperwork does not itself remediate malicious transitive dependency with postinstall script on build dependency tree; authorized, tested implementation is still required when the risk exceeds tolerance.
D:The interim control may reduce exposure, but it can leave the underlying malicious transitive dependency with postinstall script and should be time-limited with verification and owner oversight.
Question 437
At Media studio, the security team assesses build dependency tree. The current issue is malicious transitive dependency with postinstall script; assessment evidence states: SBOM detects package version newly published under changed maintainer. A permanent correction cannot be deployed immediately because release schedule lacks alternative signing runner. Which interim treatment is the safest governed option?
- Claim malicious transitive dependency with postinstall script is patched when the change ticket opens, without confirming pause affected build pipeline and rotate runner token or a planned permanent change
- Apply a time-bound compensating measure, pause affected build pipeline and rotate runner token, record the residual risk owner and schedule the tested permanent fix
- Accept continued exposure of software supply-chain integrity without any owner, expiry or compensating verification because release schedule lacks alternative signing runner
- Push pin trusted digest and require reviewed dependency updates immediately to all production systems with no safe change window despite release schedule lacks alternative signing runner
Explanation
Correct Answer
B:Pause affected build pipeline and rotate runner token can reduce short-term exposure while release schedule lacks alternative signing runner delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because software supply-chain integrity remains at stake.
Incorrect Answers
A:A work item is not proof that malicious transitive dependency with postinstall script was corrected or even that pause affected build pipeline and rotate runner token operates.
C:Business criticality increases the need for accountable decisions and review; it does not make software supply-chain integrity irrelevant.
D:Ignoring release schedule lacks alternative signing runner could cause avoidable service failure and is not a risk-aware remediation process.
Question 438
At Media studio, the security team assesses build dependency tree. The current issue is malicious transitive dependency with postinstall script; assessment evidence states: SBOM detects package version newly published under changed maintainer. The owner reports that pin trusted digest and require reviewed dependency updates has been deployed. What evidence should close the vulnerability item?
- Use an unrelated server’s clean findings to claim build dependency tree is fixed without retesting the affected path
- Suppress future results for malicious transitive dependency with postinstall script so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using inspect provenance, lockfile diff and sandboxed install behavior, confirm the vulnerability is gone and record change evidence
- Close SBOM detects package version newly published under changed maintainer after the deployment tool returns success, without verifying the current state of build dependency tree
Explanation
Correct Answer
C:Closure requires checking the same affected path identified by SBOM detects package version newly published under changed maintainer, plus regression impact on build dependency tree. A change ticket alone is not proof of removal of malicious transitive dependency with postinstall script.
Incorrect Answers
A:The result must be tied to build dependency tree and the actual exposure: CI runner has artifact-signing token.
B:Suppression may hide a failed or incomplete fix, leaving software supply-chain integrity exposed despite the administrative record.
D:Process completion is not evidence that SBOM detects package version newly published under changed maintainer no longer applies to build dependency tree.
Question 439
At Regional broadcaster, the incident team supports corporate DNS registrar. A new security event is reported: web traffic routes to a cloned portal after unauthorized nameserver change. The log clue is: DNS authoritative history records modified NS records from unusual registrar login. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Treat an ATT&CK label for web traffic routes to a cloned portal after unauthorized nameserver change as a complete recovery instruction without checking evidence or impact
- Map the observed behavior in DNS authoritative history records modified NS records from unusual registrar login to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Attribute web traffic routes to a cloned portal after unauthorized nameserver change to a named foreign intelligence service using only DNS authoritative history records modified NS records from unusual registrar login
- Assign a final attack-chain stage to corporate DNS registrar without confirming what behavior actually occurred in DNS authoritative history records modified NS records from unusual registrar login
Explanation
Correct Answer
B:Web traffic routes to a cloned portal after unauthorized nameserver change and DNS authoritative history records modified NS records from unusual registrar login support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:A taxonomy is not an incident response plan for corporate DNS registrar; scope and safety constraints still matter.
C:Neither web traffic routes to a cloned portal after unauthorized nameserver change nor DNS authoritative history records modified NS records from unusual registrar login establishes uniquely identifying actor evidence.
D:Attack frameworks describe observable stages and techniques; the DNS authoritative history records modified NS records from unusual registrar login must substantiate whichever stage is assigned.
Question 440
At Regional broadcaster, the incident team supports corporate DNS registrar. A new security event is reported: web traffic routes to a cloned portal after unauthorized nameserver change. The log clue is: DNS authoritative history records modified NS records from unusual registrar login. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Alter original DNS authoritative history records modified NS records from unusual registrar login entries to remove irrelevant records before preserving the forensic timeline
- Keep only a screenshot of DNS authoritative history records modified NS records from unusual registrar login, discarding original artifacts such as preserve registrar audit, DNS change trail and TLS observations
- Preserve and hash incident artifacts: preserve registrar audit, DNS change trail and TLS observations
- Rebuild corporate DNS registrar first and collect the volatile evidence for web traffic routes to a cloned portal after unauthorized nameserver change afterward
Explanation
Correct Answer
C:Preserve registrar audit, DNS change trail and TLS observations retains relevant source context and integrity checks so the team can reconstruct web traffic routes to a cloned portal after unauthorized nameserver change and support an auditable chain of custody.
Incorrect Answers
A:Changing the original DNS authoritative history records modified NS records from unusual registrar login compromises provenance and makes later findings harder to verify.
B:A screenshot cannot replace the underlying preserve registrar audit, DNS change trail and TLS observations needed to establish sequence and integrity.
D:Volatile evidence relevant to web traffic routes to a cloned portal after unauthorized nameserver change may disappear during remediation or reboot.
