CompTIA CS0-003 Practice Test 46
Question 450
Research university has investigated rogue IPv6 router bypassing intended segmentation on lab segmentation network. Detection operators report that approved layer-3 routers advertise only from infrastructure switch ports; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to an unmanaged IPv6 host sends router advertisements despite IPv4 access controls, without validation or guardrails for research access boundaries
- Suppress every future event associated with ICMPv6 capture shows unexpected RA with default-router lifetime, including events outside approved layer-3 routers advertise only from infrastructure switch ports
- Improve detection by requiring context-aware correlation: enforce RA guard on user-facing ports with verified router exemptions
- Assign critical severity to every routine activity on lab segmentation network whether or not it matches enforce RA guard on user-facing ports with verified router exemptions
Explanation
Correct Answer
C:Enforce RA guard on user-facing ports with verified router exemptions retains the specific threat signal while discriminating against approved layer-3 routers advertise only from infrastructure switch ports. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt research access boundaries and cannot distinguish the benign workflow from attacker behavior.
B:Suppressing all monitoring would also hide a recurrence of rogue IPv6 router bypassing intended segmentation, even where it threatens research access boundaries.
D:Alert severity without distinguishing approved layer-3 routers advertise only from infrastructure switch ports from malicious conditions would increase noise and operational workload.
Question 451
At Public safety dispatch, the security team assesses legacy desktop estate. The current issue is end-of-life OS with unpatched remote service; assessment evidence states: asset inventory shows unsupported OS and reachable RDP. The service is isolated dispatch VLAN with vendor support contract. Operational constraints: dispatch uptime requires phased migration. Which assessment approach is most appropriate before recommending a fix?
- Use only an anonymous outside-in scan of legacy desktop estate even when isolated dispatch VLAN with vendor support contract requires authenticated deployment context
- Launch unapproved intrusive exploitation across legacy desktop estate during dispatch uptime requires phased migration instead of using a scoped test
- Accept the label end-of-life OS with unpatched remote service as confirmed without checking the reported evidence asset inventory shows unsupported OS and reachable RDP or actual deployment
- Use an authorized, scoped validation approach that considers service sensitivity: confirm exact lifecycle and exposed management pathways
Explanation
Correct Answer
D:The evidence asset inventory shows unsupported OS and reachable RDP must be evaluated without violating the constraint dispatch uptime requires phased migration. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Asset configuration and the constraints of legacy desktop estate matter; external findings alone may misstate or miss the exposed path.
B:Uncontrolled testing may breach service safety, especially because dispatch uptime requires phased migration; authorization and scope are prerequisites.
C:The finding does not establish which live component is affected or whether the exposure isolated dispatch VLAN with vendor support contract is real.
Question 452
At Public safety dispatch, the security team assesses legacy desktop estate. The current issue is end-of-life OS with unpatched remote service; assessment evidence states: asset inventory shows unsupported OS and reachable RDP. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Mark asset inventory shows unsupported OS and reachable RDP resolved or confirmed solely from the scanner severity without confirm exact lifecycle and exposed management pathways
- Force a destructive proof-of-concept against legacy desktop estate, ignoring that dispatch uptime requires phased migration and a safer validation exist
- Confirm the reported condition in the relevant asset context: confirm exact lifecycle and exposed management pathways
- Assume legacy desktop estate is safe because another platform with similar software recently passed its own assessment
Explanation
Correct Answer
C:Confirm exact lifecycle and exposed management pathways tests the reported condition asset inventory shows unsupported OS and reachable RDP against actual deployment context (isolated dispatch VLAN with vendor support contract). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:asset inventory shows unsupported OS and reachable RDP may be accurate but its actual occurrence and configuration on legacy desktop estate must be established before calling it validated.
B:A destructive proof is unnecessary when confirm exact lifecycle and exposed management pathways can provide authorized evidence and dispatch uptime requires phased migration constrains production testing.
D:Security of an unrelated host cannot establish the state of legacy desktop estate, whose reported issue is end-of-life OS with unpatched remote service.
Question 453
At Public safety dispatch, the security team assesses legacy desktop estate. The current issue is end-of-life OS with unpatched remote service; assessment evidence states: asset inventory shows unsupported OS and reachable RDP. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Choose whatever finding on legacy desktop estate was logged most recently, regardless of actual exploit path or priority
- Choose the highest nominal scanner severity first while ignoring isolated dispatch VLAN with vendor support contract and the consequence to emergency call handling
- Prioritize the confirmed exposure of legacy desktop estate, accounting for emergency call handling and the real access path: isolated dispatch VLAN with vendor support contract
- Give every vulnerability the same deadline despite end-of-life OS with unpatched remote service and business impact on emergency call handling
Explanation
Correct Answer
C:Risk depends on practical reachability, threat activity and consequence. The issue end-of-life OS with unpatched remote service can affect emergency call handling through isolated dispatch VLAN with vendor support contract; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Discovery order is not evidence of urgency compared with the actual affected legacy desktop estate.
B:CVSS describes technical characteristics, not the entirety of exposure and emergency call handling for this deployment.
D:Uniform priority ignores isolated dispatch VLAN with vendor support contract, operational harm and emergency call handling; documented context makes triage defensible.
Question 454
At Public safety dispatch, the security team assesses legacy desktop estate. The current issue is end-of-life OS with unpatched remote service; assessment evidence states: asset inventory shows unsupported OS and reachable RDP. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Leave end-of-life OS with unpatched remote service present indefinitely because no incident involving emergency call handling was recorded this week
- Use jump-host isolation and MFA as compensating controls as permanent closure of the confirmed issue instead of deploying migrate to supported OS and remove unsupported service
- Implement and verify the root-cause fix: migrate to supported OS and remove unsupported service
- Sign an exception document but do not implement or test migrate to supported OS and remove unsupported service on legacy desktop estate
Explanation
Correct Answer
C:Migrate to supported OS and remove unsupported service targets the mechanism end-of-life OS with unpatched remote service rather than only filtering symptoms. Verification must account for asset inventory shows unsupported OS and reachable RDP and continued protection of emergency call handling.
Incorrect Answers
A:No observed attack does not correct the verified condition asset inventory shows unsupported OS and reachable RDP or eliminate its potential impact on emergency call handling.
B:The interim control may reduce exposure, but it can leave the underlying end-of-life OS with unpatched remote service and should be time-limited with verification and owner oversight.
D:Risk acceptance paperwork does not itself remediate end-of-life OS with unpatched remote service on legacy desktop estate; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 455
At Public safety dispatch, the security team assesses legacy desktop estate. The current issue is end-of-life OS with unpatched remote service; assessment evidence states: asset inventory shows unsupported OS and reachable RDP. A permanent correction cannot be deployed immediately because dispatch uptime requires phased migration. Which interim treatment is the safest governed option?
- Claim end-of-life OS with unpatched remote service is patched when the change ticket opens, without confirming jump-host isolation and MFA as compensating controls or a planned permanent change
- Accept continued exposure of emergency call handling without any owner, expiry or compensating verification because dispatch uptime requires phased migration
- Apply a time-bound compensating measure, jump-host isolation and MFA as compensating controls, record the residual risk owner and schedule the tested permanent fix
- Push migrate to supported OS and remove unsupported service immediately to all production systems with no safe change window despite dispatch uptime requires phased migration
Explanation
Correct Answer
C:Jump-host isolation and MFA as compensating controls can reduce short-term exposure while dispatch uptime requires phased migration delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because emergency call handling remains at stake.
Incorrect Answers
A:A work item is not proof that end-of-life OS with unpatched remote service was corrected or even that jump-host isolation and MFA as compensating controls operates.
B:Business criticality increases the need for accountable decisions and review; it does not make emergency call handling irrelevant.
D:Ignoring dispatch uptime requires phased migration could cause avoidable service failure and is not a risk-aware remediation process.
Question 456
At Public safety dispatch, the security team assesses legacy desktop estate. The current issue is end-of-life OS with unpatched remote service; assessment evidence states: asset inventory shows unsupported OS and reachable RDP. The owner reports that migrate to supported OS and remove unsupported service has been deployed. What evidence should close the vulnerability item?
- Close asset inventory shows unsupported OS and reachable RDP after the deployment tool returns success, without verifying the current state of legacy desktop estate
- Use an unrelated server’s clean findings to claim legacy desktop estate is fixed without retesting the affected path
- Retest the originally affected configuration using confirm exact lifecycle and exposed management pathways, confirm the vulnerability is gone and record change evidence
- Suppress future results for end-of-life OS with unpatched remote service so that the vulnerability dashboard shows a completed remediation
Explanation
Correct Answer
C:Closure requires checking the same affected path identified by asset inventory shows unsupported OS and reachable RDP, plus regression impact on legacy desktop estate. A change ticket alone is not proof of removal of end-of-life OS with unpatched remote service.
Incorrect Answers
A:Process completion is not evidence that asset inventory shows unsupported OS and reachable RDP no longer applies to legacy desktop estate.
B:The result must be tied to legacy desktop estate and the actual exposure: isolated dispatch VLAN with vendor support contract.
D:Suppression may hide a failed or incomplete fix, leaving emergency call handling exposed despite the administrative record.
Question 457
At Telemedicine provider, the incident team supports remote-support service. A new security event is reported: local privilege escalation is exploited after a helpdesk tool runs as system. The log clue is: EDR finds user child process with SYSTEM token and newly planted service. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Map the observed behavior in EDR finds user child process with SYSTEM token and newly planted service to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Assign a final attack-chain stage to remote-support service without confirming what behavior actually occurred in EDR finds user child process with SYSTEM token and newly planted service
- Attribute local privilege escalation is exploited after a helpdesk tool runs as system to a named foreign intelligence service using only EDR finds user child process with SYSTEM token and newly planted service
- Treat an ATT&CK label for local privilege escalation is exploited after a helpdesk tool runs as system as a complete recovery instruction without checking evidence or impact
Explanation
Correct Answer
A:Local privilege escalation is exploited after a helpdesk tool runs as system and EDR finds user child process with SYSTEM token and newly planted service support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
B:Attack frameworks describe observable stages and techniques; the EDR finds user child process with SYSTEM token and newly planted service must substantiate whichever stage is assigned.
C:Neither local privilege escalation is exploited after a helpdesk tool runs as system nor EDR finds user child process with SYSTEM token and newly planted service establishes uniquely identifying actor evidence.
D:A taxonomy is not an incident response plan for remote-support service; scope and safety constraints still matter.
Question 458
At Telemedicine provider, the incident team supports remote-support service. A new security event is reported: local privilege escalation is exploited after a helpdesk tool runs as system. The log clue is: EDR finds user child process with SYSTEM token and newly planted service. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Keep only a screenshot of EDR finds user child process with SYSTEM token and newly planted service, discarding original artifacts such as capture token events, service changes and affected host disk image before cleanup
- Alter original EDR finds user child process with SYSTEM token and newly planted service entries to remove irrelevant records before preserving the forensic timeline
- Rebuild remote-support service first and collect the volatile evidence for local privilege escalation is exploited after a helpdesk tool runs as system afterward
- Preserve and hash incident artifacts: capture token events, service changes and affected host disk image before cleanup
Explanation
Correct Answer
D:Capture token events, service changes and affected host disk image before cleanup retains relevant source context and integrity checks so the team can reconstruct local privilege escalation is exploited after a helpdesk tool runs as system and support an auditable chain of custody.
Incorrect Answers
A:A screenshot cannot replace the underlying capture token events, service changes and affected host disk image before cleanup needed to establish sequence and integrity.
B:Changing the original EDR finds user child process with SYSTEM token and newly planted service compromises provenance and makes later findings harder to verify.
C:Volatile evidence relevant to local privilege escalation is exploited after a helpdesk tool runs as system may disappear during remediation or reboot.
Question 459
At Telemedicine provider, the incident team supports remote-support service. A new security event is reported: local privilege escalation is exploited after a helpdesk tool runs as system. The log clue is: EDR finds user child process with SYSTEM token and newly planted service. The incident remains active, but remote-support service is operationally important. Which containment decision is most appropriate now?
- Execute scoped containment: isolate affected support host and constrain privileged session credentials
- Erase EDR finds user child process with SYSTEM token and newly planted service to reduce alert volume rather than isolating the observed attacker route
- Disconnect every service at Telemedicine provider, regardless of whether it has a dependency on the affected remote-support service
- Publish a speculative full-incident attribution notice before constraining the active behavior local privilege escalation is exploited after a helpdesk tool runs as system
Explanation
Correct Answer
A:Isolate affected support host and constrain privileged session credentials stops or limits the observed path while balancing continuity of remote-support service. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
B:Erasing EDR finds user child process with SYSTEM token and newly planted service neither blocks attacker access nor supports a reliable subsequent recovery decision.
C:Broad interruption may unnecessarily affect remote-support service; containment should be scoped to evidenced systems and approved critical-service requirements.
D:Communication matters, but active local privilege escalation is exploited after a helpdesk tool runs as system requires proportionate containment and evidence preservation first.
Question 460
At Telemedicine provider, the incident team supports remote-support service. A new security event is reported: local privilege escalation is exploited after a helpdesk tool runs as system. The log clue is: EDR finds user child process with SYSTEM token and newly planted service. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Rewrite the playbook for remote-support service but leave the confirmed malicious access mechanism active
- Restore remote-support service without first correcting the access and persistence cause addressed by patch vulnerable support tool and revoke compromised local/service identities
- Use only the original firewall block and assume it has also removed all persistence behind local privilege escalation is exploited after a helpdesk tool runs as system
- Remove the attack’s established access and persistence: patch vulnerable support tool and revoke compromised local/service identities
Explanation
Correct Answer
D:Patch vulnerable support tool and revoke compromised local/service identities targets the mechanism behind local privilege escalation is exploited after a helpdesk tool runs as system, reducing recurrence when remote-support service returns to normal operations.
Incorrect Answers
A:Updated paperwork does not eradicate the mechanism behind local privilege escalation is exploited after a helpdesk tool runs as system.
B:Recovery before patch vulnerable support tool and revoke compromised local/service identities could reintroduce the same compromise path.
C:Containment can stop communication without eliminating the root access that produced EDR finds user child process with SYSTEM token and newly planted service.
