CompTIA CS0-003 Practice Test 47
Question 460
At Telemedicine provider, the incident team supports remote-support service. A new security event is reported: local privilege escalation is exploited after a helpdesk tool runs as system. The log clue is: EDR finds user child process with SYSTEM token and newly planted service. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Rewrite the playbook for remote-support service but leave the confirmed malicious access mechanism active
- Restore remote-support service without first correcting the access and persistence cause addressed by patch vulnerable support tool and revoke compromised local/service identities
- Use only the original firewall block and assume it has also removed all persistence behind local privilege escalation is exploited after a helpdesk tool runs as system
- Remove the attack’s established access and persistence: patch vulnerable support tool and revoke compromised local/service identities
Explanation
Correct Answer
D:Patch vulnerable support tool and revoke compromised local/service identities targets the mechanism behind local privilege escalation is exploited after a helpdesk tool runs as system, reducing recurrence when remote-support service returns to normal operations.
Incorrect Answers
A:Updated paperwork does not eradicate the mechanism behind local privilege escalation is exploited after a helpdesk tool runs as system.
B:Recovery before patch vulnerable support tool and revoke compromised local/service identities could reintroduce the same compromise path.
C:Containment can stop communication without eliminating the root access that produced EDR finds user child process with SYSTEM token and newly planted service.
Question 461
At Telemedicine provider, the incident team supports remote-support service. A new security event is reported: local privilege escalation is exploited after a helpdesk tool runs as system. The log clue is: EDR finds user child process with SYSTEM token and newly planted service. Containment and eradication are complete. Which recovery acceptance test should precede release of remote-support service to normal users?
- Expose remote-support service to users before confirming that the conditions behind local privilege escalation is exploited after a helpdesk tool runs as system are absent
- Delete preserved evidence including capture token events, service changes and affected host disk image before cleanup as soon as the service restarts
- Perform controlled return-to-service validation: test repaired elevation boundaries and resumed patient remote sessions
- Approve recovery of remote-support service when it boots, without executing the test test repaired elevation boundaries and resumed patient remote sessions
Explanation
Correct Answer
C:Test repaired elevation boundaries and resumed patient remote sessions demonstrates that the compromised pathway is absent while remote-support service again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, remote-support service could immediately face the same exploit condition.
B:Evidence retention obligations continue beyond restart; capture token events, service changes and affected host disk image before cleanup may be required for subsequent review.
D:A boot event cannot prove test repaired elevation boundaries and resumed patient remote sessions or protect the service from recurrence of local privilege escalation is exploited after a helpdesk tool runs as system.
Question 462
At Telemedicine provider, the incident team supports remote-support service. A new security event is reported: local privilege escalation is exploited after a helpdesk tool runs as system. The log clue is: EDR finds user child process with SYSTEM token and newly planted service. The incident has been contained and normal service has resumed. A post-incident review identifies that support tool updates bypassed privileged-code review. Which improvement should be prioritized?
- Discipline the whole on-duty response shift rather than examining the documented weakness support tool updates bypassed privileged-code review
- Close the follow-up for remote-support service merely because restoration completed, without addressing support tool updates bypassed privileged-code review
- Write a lessons-learned memo about local privilege escalation is exploited after a helpdesk tool runs as system with no due date, control owner or validation activity
- Assign an owner and measurable corrective action addressing the root cause: support tool updates bypassed privileged-code review, with a future effectiveness test
Explanation
Correct Answer
D:Support tool updates bypassed privileged-code review was the systemic weakness that enabled or worsened local privilege escalation is exploited after a helpdesk tool runs as system. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:A personnel-only response lacks support from the documented root cause: support tool updates bypassed privileged-code review.
B:Service restoration does not address support tool updates bypassed privileged-code review; ignoring it leaves the next incident likely to follow the same route.
C:An unowned recommendation does not produce a verified control improvement for remote-support service.
Question 463
At County benefits portal, analysts monitor public web application. They observe that crafted URL paths containing dot-dot segments repeatedly request confidential configuration files. Evidence: reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of directory traversal exploitation attempt against web resources and begin corroborating it with endpoint and network evidence
- Treat standard scanners produce marked test User-Agents and tickets during approved windows as conclusive authorization for the current event without matching process or identity
- Announce that reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses conclusively proves theft of citizen benefit records before reviewing any sessions or file access
- Downgrade crafted URL paths containing dot-dot segments repeatedly request confidential configuration files solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
A:The combination of crafted URL paths containing dot-dot segments repeatedly request confidential configuration files and reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses is suspicious for directory traversal exploitation attempt against web resources. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting citizen benefit records.
Incorrect Answers
B:The legitimate comparator is standard scanners produce marked test User-Agents and tickets during approved windows; it does not establish that the current event came from the same approved identity or workflow.
C:reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
D:An intrusion can begin on one asset. The specific indicator on public web application warrants its own validation before expanding or closing the investigation.
Question 464
At County benefits portal, analysts monitor public web application. They observe that crafted URL paths containing dot-dot segments repeatedly request confidential configuration files. Evidence: reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses. A separate known-good explanation is: standard scanners produce marked test User-Agents and tickets during approved windows. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses, without using decode normalized paths and verify response content and backend process access
- Suspend telemetry collection on public web application while waiting for the connection pattern to stop
- Summarize reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses into a ticket and discard underlying event identifiers before correlation
- Perform a scoped investigation: decode normalized paths and verify response content and backend process access
Explanation
Correct Answer
D:Decode normalized paths and verify response content and backend process access ties the evidence on public web application to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: standard scanners produce marked test User-Agents and tickets during approved windows.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses or whether the activity matches standard scanners produce marked test User-Agents and tickets during approved windows.
B:Suppressing telemetry destroys the source needed to investigate directory traversal exploitation attempt against web resources and may conceal further actions.
C:The original reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 465
County benefits portal has a candidate alert for public web application: reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses. The team argues it is harmless because standard scanners produce marked test User-Agents and tickets during approved windows. What is the most defensible false-positive assessment?
- Create a blanket suppression for reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses because standard scanners produce marked test User-Agents and tickets during approved windows can produce a superficially similar event
- Automatically treat every event resembling reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses as confirmed compromise of public web application, without checking provenance
- Distinguish reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses from the approved behavior (standard scanners produce marked test User-Agents and tickets during approved windows) by validating process, identity and time attribution
- Interpret an absence of existing vendor signatures as proof that crafted URL paths containing dot-dot segments repeatedly request confidential configuration files is benign
Explanation
Correct Answer
C:Standard scanners produce marked test User-Agents and tickets during approved windows is a plausible alternative, but it must be proven to match the actual source of reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Similarity to standard scanners produce marked test User-Agents and tickets during approved windows does not exclude an attacker from producing the same surface event on public web application.
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting citizen benefit records.
D:Absence of a signature does not refute the concrete behavior: crafted URL paths containing dot-dot segments repeatedly request confidential configuration files.
Question 466
At County benefits portal, analysts monitor public web application. They observe that crafted URL paths containing dot-dot segments repeatedly request confidential configuration files. Evidence: reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses. The team confirms unauthorized behavior and must protect citizen benefit records; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: restrict affected route and preserve audit evidence while keeping emergency benefits lookup online
- Erase reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses from the evidence archive during the containment change to reduce repeated alerts
- Disable every production service at County benefits portal without measuring whether its dependencies share the observed malicious path
- Leave the confirmed unauthorized activity on public web application unrestricted until actual losses of citizen benefit records can be measured
Explanation
Correct Answer
A:Restrict affected route and preserve audit evidence while keeping emergency benefits lookup online constrains the observed threat while maintaining necessary service for citizen benefit records. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Eliminating reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses evidence does not contain directory traversal exploitation attempt against web resources and impairs forensic reconstruction.
C:Global shutdown could disrupt citizen benefit records without evidence that every system has been affected; scoped isolation is more proportionate.
D:Once unauthorized behavior is confirmed on public web application, delaying containment could expand the exposure affecting citizen benefit records.
Question 467
County benefits portal has correlated an alert involving public web application; the key observation is reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses. Another security organization requests a defensible, privacy-conscious indicator package to hunt for similar behavior. What should be shared?
- Share all raw citizen benefit records records to prove the alert is important before stripping unnecessary personal or protected content
- Send only the statement that directory traversal exploitation attempt against web resources exists with no indicator, observation time or confidence
- Share the validated technical observables and conditions from hunt for decoded traversal patterns and any successful sensitive-file response, with timing, confidence, classification and minimal sensitive data
- Declare every system using public web application technology compromised without proof beyond the single observation
Explanation
Correct Answer
C:Hunt for decoded traversal patterns and any successful sensitive-file response describes how other defenders can test the observation. Time, confidence and privacy handling preserve investigative value without disclosing unrelated citizen benefit records data.
Incorrect Answers
A:Sharing investigative indicators does not authorize exposing citizen benefit records; minimize records and follow approved intelligence-sharing rules.
B:A generic threat label cannot help a partner correlate reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses to its own assets or distinguish it from routine activity.
D:The single finding reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses on public web application does not prove the same activity across organizations; share enough context for each partner to validate it.
Question 468
County benefits portal has investigated directory traversal exploitation attempt against web resources on public web application. Detection operators report that standard scanners produce marked test User-Agents and tickets during approved windows; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to crafted URL paths containing dot-dot segments repeatedly request confidential configuration files, without validation or guardrails for citizen benefit records
- Assign critical severity to every routine activity on public web application whether or not it matches detect normalized traversal plus nonstandard file access rather than raw 404 volume
- Suppress every future event associated with reverse proxy logs show encoded traversal attempts with 403 and occasional 200 responses, including events outside standard scanners produce marked test User-Agents and tickets during approved windows
- Improve detection by requiring context-aware correlation: detect normalized traversal plus nonstandard file access rather than raw 404 volume
Explanation
Correct Answer
D:Detect normalized traversal plus nonstandard file access rather than raw 404 volume retains the specific threat signal while discriminating against standard scanners produce marked test User-Agents and tickets during approved windows. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt citizen benefit records and cannot distinguish the benign workflow from attacker behavior.
B:Alert severity without distinguishing standard scanners produce marked test User-Agents and tickets during approved windows from malicious conditions would increase noise and operational workload.
C:Suppressing all monitoring would also hide a recurrence of directory traversal exploitation attempt against web resources, even where it threatens citizen benefit records.
Question 469
At Hotel reservation, the security team assesses third-party CMS plugin. The current issue is outdated booking plugin vulnerable to SQL injection; assessment evidence states: CMS scan identifies old plugin matching vendor bulletin. The service is internet-facing booking form. Operational constraints: marketing blackout weekend prevents redesign. Which assessment approach is most appropriate before recommending a fix?
- Accept the label outdated booking plugin vulnerable to SQL injection as confirmed without checking the reported evidence CMS scan identifies old plugin matching vendor bulletin or actual deployment
- Use only an anonymous outside-in scan of third-party CMS plugin even when internet-facing booking form requires authenticated deployment context
- Use an authorized, scoped validation approach that considers service sensitivity: verify installed plugin version and vulnerable route with safe test
- Launch unapproved intrusive exploitation across third-party CMS plugin during marketing blackout weekend prevents redesign instead of using a scoped test
Explanation
Correct Answer
C:The evidence CMS scan identifies old plugin matching vendor bulletin must be evaluated without violating the constraint marketing blackout weekend prevents redesign. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:The finding does not establish which live component is affected or whether the exposure internet-facing booking form is real.
B:Asset configuration and the constraints of third-party CMS plugin matter; external findings alone may misstate or miss the exposed path.
D:Uncontrolled testing may breach service safety, especially because marketing blackout weekend prevents redesign; authorization and scope are prerequisites.
Question 470
At Hotel reservation, the security team assesses third-party CMS plugin. The current issue is outdated booking plugin vulnerable to SQL injection; assessment evidence states: CMS scan identifies old plugin matching vendor bulletin. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Confirm the reported condition in the relevant asset context: verify installed plugin version and vulnerable route with safe test
- Force a destructive proof-of-concept against third-party CMS plugin, ignoring that marketing blackout weekend prevents redesign and a safer validation exist
- Assume third-party CMS plugin is safe because another platform with similar software recently passed its own assessment
- Mark CMS scan identifies old plugin matching vendor bulletin resolved or confirmed solely from the scanner severity without verify installed plugin version and vulnerable route with safe test
Explanation
Correct Answer
A:Verify installed plugin version and vulnerable route with safe test tests the reported condition CMS scan identifies old plugin matching vendor bulletin against actual deployment context (internet-facing booking form). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
B:A destructive proof is unnecessary when verify installed plugin version and vulnerable route with safe test can provide authorized evidence and marketing blackout weekend prevents redesign constrains production testing.
C:Security of an unrelated host cannot establish the state of third-party CMS plugin, whose reported issue is outdated booking plugin vulnerable to SQL injection.
D:CMS scan identifies old plugin matching vendor bulletin may be accurate but its actual occurrence and configuration on third-party CMS plugin must be established before calling it validated.
