CompTIA CS0-003 Practice Test 45
Question 440
At Regional broadcaster, the incident team supports corporate DNS registrar. A new security event is reported: web traffic routes to a cloned portal after unauthorized nameserver change. The log clue is: DNS authoritative history records modified NS records from unusual registrar login. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Alter original DNS authoritative history records modified NS records from unusual registrar login entries to remove irrelevant records before preserving the forensic timeline
- Keep only a screenshot of DNS authoritative history records modified NS records from unusual registrar login, discarding original artifacts such as preserve registrar audit, DNS change trail and TLS observations
- Preserve and hash incident artifacts: preserve registrar audit, DNS change trail and TLS observations
- Rebuild corporate DNS registrar first and collect the volatile evidence for web traffic routes to a cloned portal after unauthorized nameserver change afterward
Explanation
Correct Answer
C:Preserve registrar audit, DNS change trail and TLS observations retains relevant source context and integrity checks so the team can reconstruct web traffic routes to a cloned portal after unauthorized nameserver change and support an auditable chain of custody.
Incorrect Answers
A:Changing the original DNS authoritative history records modified NS records from unusual registrar login compromises provenance and makes later findings harder to verify.
B:A screenshot cannot replace the underlying preserve registrar audit, DNS change trail and TLS observations needed to establish sequence and integrity.
D:Volatile evidence relevant to web traffic routes to a cloned portal after unauthorized nameserver change may disappear during remediation or reboot.
Question 441
At Regional broadcaster, the incident team supports corporate DNS registrar. A new security event is reported: web traffic routes to a cloned portal after unauthorized nameserver change. The log clue is: DNS authoritative history records modified NS records from unusual registrar login. The incident remains active, but corporate DNS registrar is operationally important. Which containment decision is most appropriate now?
- Publish a speculative full-incident attribution notice before constraining the active behavior web traffic routes to a cloned portal after unauthorized nameserver change
- Disconnect every service at Regional broadcaster, regardless of whether it has a dependency on the affected corporate DNS registrar
- Execute scoped containment: restore approved nameservers with registrar lock and protect authentication account
- Erase DNS authoritative history records modified NS records from unusual registrar login to reduce alert volume rather than isolating the observed attacker route
Explanation
Correct Answer
C:Restore approved nameservers with registrar lock and protect authentication account stops or limits the observed path while balancing continuity of corporate DNS registrar. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Communication matters, but active web traffic routes to a cloned portal after unauthorized nameserver change requires proportionate containment and evidence preservation first.
B:Broad interruption may unnecessarily affect corporate DNS registrar; containment should be scoped to evidenced systems and approved critical-service requirements.
D:Erasing DNS authoritative history records modified NS records from unusual registrar login neither blocks attacker access nor supports a reliable subsequent recovery decision.
Question 442
At Regional broadcaster, the incident team supports corporate DNS registrar. A new security event is reported: web traffic routes to a cloned portal after unauthorized nameserver change. The log clue is: DNS authoritative history records modified NS records from unusual registrar login. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Use only the original firewall block and assume it has also removed all persistence behind web traffic routes to a cloned portal after unauthorized nameserver change
- Remove the attack’s established access and persistence: remove rogue delegation, rotate registrar credentials and enforce strong MFA
- Rewrite the playbook for corporate DNS registrar but leave the confirmed malicious access mechanism active
- Restore corporate DNS registrar without first correcting the access and persistence cause addressed by remove rogue delegation, rotate registrar credentials and enforce strong MFA
Explanation
Correct Answer
B:Remove rogue delegation, rotate registrar credentials and enforce strong MFA targets the mechanism behind web traffic routes to a cloned portal after unauthorized nameserver change, reducing recurrence when corporate DNS registrar returns to normal operations.
Incorrect Answers
A:Containment can stop communication without eliminating the root access that produced DNS authoritative history records modified NS records from unusual registrar login.
C:Updated paperwork does not eradicate the mechanism behind web traffic routes to a cloned portal after unauthorized nameserver change.
D:Recovery before remove rogue delegation, rotate registrar credentials and enforce strong MFA could reintroduce the same compromise path.
Question 443
At Regional broadcaster, the incident team supports corporate DNS registrar. A new security event is reported: web traffic routes to a cloned portal after unauthorized nameserver change. The log clue is: DNS authoritative history records modified NS records from unusual registrar login. Containment and eradication are complete. Which recovery acceptance test should precede release of corporate DNS registrar to normal users?
- Expose corporate DNS registrar to users before confirming that the conditions behind web traffic routes to a cloned portal after unauthorized nameserver change are absent
- Approve recovery of corporate DNS registrar when it boots, without executing the test validate authoritative responses across resolvers after TTL and secure admin access
- Perform controlled return-to-service validation: validate authoritative responses across resolvers after TTL and secure admin access
- Delete preserved evidence including preserve registrar audit, DNS change trail and TLS observations as soon as the service restarts
Explanation
Correct Answer
C:Validate authoritative responses across resolvers after TTL and secure admin access demonstrates that the compromised pathway is absent while corporate DNS registrar again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, corporate DNS registrar could immediately face the same exploit condition.
B:A boot event cannot prove validate authoritative responses across resolvers after TTL and secure admin access or protect the service from recurrence of web traffic routes to a cloned portal after unauthorized nameserver change.
D:Evidence retention obligations continue beyond restart; preserve registrar audit, DNS change trail and TLS observations may be required for subsequent review.
Question 444
At Regional broadcaster, the incident team supports corporate DNS registrar. A new security event is reported: web traffic routes to a cloned portal after unauthorized nameserver change. The log clue is: DNS authoritative history records modified NS records from unusual registrar login. The incident has been contained and normal service has resumed. A post-incident review identifies that shared registrar admin credentials and no out-of-band change approval. Which improvement should be prioritized?
- Close the follow-up for corporate DNS registrar merely because restoration completed, without addressing shared registrar admin credentials and no out-of-band change approval
- Discipline the whole on-duty response shift rather than examining the documented weakness shared registrar admin credentials and no out-of-band change approval
- Assign an owner and measurable corrective action addressing the root cause: shared registrar admin credentials and no out-of-band change approval, with a future effectiveness test
- Write a lessons-learned memo about web traffic routes to a cloned portal after unauthorized nameserver change with no due date, control owner or validation activity
Explanation
Correct Answer
C:Shared registrar admin credentials and no out-of-band change approval was the systemic weakness that enabled or worsened web traffic routes to a cloned portal after unauthorized nameserver change. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:Service restoration does not address shared registrar admin credentials and no out-of-band change approval; ignoring it leaves the next incident likely to follow the same route.
B:A personnel-only response lacks support from the documented root cause: shared registrar admin credentials and no out-of-band change approval.
D:An unowned recommendation does not produce a verified control improvement for corporate DNS registrar.
Question 445
At Research university, analysts monitor lab segmentation network. They observe that an unmanaged IPv6 host sends router advertisements despite IPv4 access controls. Evidence: ICMPv6 capture shows unexpected RA with default-router lifetime. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat approved layer-3 routers advertise only from infrastructure switch ports as conclusive authorization for the current event without matching process or identity
- Downgrade an unmanaged IPv6 host sends router advertisements despite IPv4 access controls solely because the same symptom has not yet appeared on another endpoint
- Announce that ICMPv6 capture shows unexpected RA with default-router lifetime conclusively proves theft of research access boundaries before reviewing any sessions or file access
- Treat the pattern as a hypothesis of rogue IPv6 router bypassing intended segmentation and begin corroborating it with endpoint and network evidence
Explanation
Correct Answer
D:The combination of an unmanaged IPv6 host sends router advertisements despite IPv4 access controls and ICMPv6 capture shows unexpected RA with default-router lifetime is suspicious for rogue IPv6 router bypassing intended segmentation. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting research access boundaries.
Incorrect Answers
A:The legitimate comparator is approved layer-3 routers advertise only from infrastructure switch ports; it does not establish that the current event came from the same approved identity or workflow.
B:An intrusion can begin on one asset. The specific indicator on lab segmentation network warrants its own validation before expanding or closing the investigation.
C:ICMPv6 capture shows unexpected RA with default-router lifetime is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
Question 446
At Research university, analysts monitor lab segmentation network. They observe that an unmanaged IPv6 host sends router advertisements despite IPv4 access controls. Evidence: ICMPv6 capture shows unexpected RA with default-router lifetime. A separate known-good explanation is: approved layer-3 routers advertise only from infrastructure switch ports. Which next analysis most reliably determines what caused the observed event?
- Perform a scoped investigation: compare RA source MAC and switch port with infrastructure inventory
- Accept a public reputation score for the destination as proof of the origin of ICMPv6 capture shows unexpected RA with default-router lifetime, without using compare RA source MAC and switch port with infrastructure inventory
- Suspend telemetry collection on lab segmentation network while waiting for the connection pattern to stop
- Summarize ICMPv6 capture shows unexpected RA with default-router lifetime into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
A:Compare RA source MAC and switch port with infrastructure inventory ties the evidence on lab segmentation network to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved layer-3 routers advertise only from infrastructure switch ports.
Incorrect Answers
B:A reputation score may inform triage but cannot establish the origin of ICMPv6 capture shows unexpected RA with default-router lifetime or whether the activity matches approved layer-3 routers advertise only from infrastructure switch ports.
C:Suppressing telemetry destroys the source needed to investigate rogue IPv6 router bypassing intended segmentation and may conceal further actions.
D:The original ICMPv6 capture shows unexpected RA with default-router lifetime must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 447
Research university has a candidate alert for lab segmentation network: ICMPv6 capture shows unexpected RA with default-router lifetime. The team argues it is harmless because approved layer-3 routers advertise only from infrastructure switch ports. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that an unmanaged IPv6 host sends router advertisements despite IPv4 access controls is benign
- Distinguish ICMPv6 capture shows unexpected RA with default-router lifetime from the approved behavior (approved layer-3 routers advertise only from infrastructure switch ports) by validating process, identity and time attribution
- Create a blanket suppression for ICMPv6 capture shows unexpected RA with default-router lifetime because approved layer-3 routers advertise only from infrastructure switch ports can produce a superficially similar event
- Automatically treat every event resembling ICMPv6 capture shows unexpected RA with default-router lifetime as confirmed compromise of lab segmentation network, without checking provenance
Explanation
Correct Answer
B:Approved layer-3 routers advertise only from infrastructure switch ports is a plausible alternative, but it must be proven to match the actual source of ICMPv6 capture shows unexpected RA with default-router lifetime. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: an unmanaged IPv6 host sends router advertisements despite IPv4 access controls.
C:Similarity to approved layer-3 routers advertise only from infrastructure switch ports does not exclude an attacker from producing the same surface event on lab segmentation network.
D:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting research access boundaries.
Question 448
At Research university, analysts monitor lab segmentation network. They observe that an unmanaged IPv6 host sends router advertisements despite IPv4 access controls. Evidence: ICMPv6 capture shows unexpected RA with default-router lifetime. The team confirms unauthorized behavior and must protect research access boundaries; legitimate service continuity remains necessary. Which containment decision is best?
- Erase ICMPv6 capture shows unexpected RA with default-router lifetime from the evidence archive during the containment change to reduce repeated alerts
- Apply targeted containment: block unauthorized router advertisements at access ports without disabling approved IPv6
- Leave the confirmed unauthorized activity on lab segmentation network unrestricted until actual losses of research access boundaries can be measured
- Disable every production service at Research university without measuring whether its dependencies share the observed malicious path
Explanation
Correct Answer
B:Block unauthorized router advertisements at access ports without disabling approved IPv6 constrains the observed threat while maintaining necessary service for research access boundaries. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Eliminating ICMPv6 capture shows unexpected RA with default-router lifetime evidence does not contain rogue IPv6 router bypassing intended segmentation and impairs forensic reconstruction.
C:Once unauthorized behavior is confirmed on lab segmentation network, delaying containment could expand the exposure affecting research access boundaries.
D:Global shutdown could disrupt research access boundaries without evidence that every system has been affected; scoped isolation is more proportionate.
Question 449
Research university receives a three-month-old threat-intelligence bulletin associating an observable with rogue IPv6 router bypassing intended segmentation. On lab segmentation network, local telemetry reports: ICMPv6 capture shows unexpected RA with default-router lifetime. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions rogue IPv6 router bypassing intended segmentation, without checking whether its observable is present on lab segmentation network
- Assess bulletin timeliness and provenance, then corroborate its observables against ICMPv6 capture shows unexpected RA with default-router lifetime and affected lab segmentation network
- Dismiss the bulletin solely because Research university has not named the attacker associated with ICMPv6 capture shows unexpected RA with default-router lifetime
- Forward the bulletin about rogue IPv6 router bypassing intended segmentation as a confirmed breach of lab segmentation network without hosts, timestamps or confidence caveats
Explanation
Correct Answer
B:An old feed with unknown confidence is not automatic proof of activity at Research university. Comparing its timestamps and provenance with ICMPv6 capture shows unexpected RA with default-router lifetime reveals whether the indicator is still relevant to lab segmentation network and research access boundaries.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual ICMPv6 capture shows unexpected RA with default-router lifetime.
C:Actor attribution is not required to assess a supported technique, source confidence or relevance to lab segmentation network.
D:Converting the unverified feed into confirmed activity on lab segmentation network may mislead investigators and prompt harmful response for research access boundaries.
Question 450
Research university has investigated rogue IPv6 router bypassing intended segmentation on lab segmentation network. Detection operators report that approved layer-3 routers advertise only from infrastructure switch ports; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to an unmanaged IPv6 host sends router advertisements despite IPv4 access controls, without validation or guardrails for research access boundaries
- Suppress every future event associated with ICMPv6 capture shows unexpected RA with default-router lifetime, including events outside approved layer-3 routers advertise only from infrastructure switch ports
- Improve detection by requiring context-aware correlation: enforce RA guard on user-facing ports with verified router exemptions
- Assign critical severity to every routine activity on lab segmentation network whether or not it matches enforce RA guard on user-facing ports with verified router exemptions
Explanation
Correct Answer
C:Enforce RA guard on user-facing ports with verified router exemptions retains the specific threat signal while discriminating against approved layer-3 routers advertise only from infrastructure switch ports. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt research access boundaries and cannot distinguish the benign workflow from attacker behavior.
B:Suppressing all monitoring would also hide a recurrence of rogue IPv6 router bypassing intended segmentation, even where it threatens research access boundaries.
D:Alert severity without distinguishing approved layer-3 routers advertise only from infrastructure switch ports from malicious conditions would increase noise and operational workload.
