CompTIA CS0-003 Practice Test 49
Question 480
Biotechnology lab has investigated potential malware traffic requiring corroboration rather than fingerprint-only proof on TLS inspection appliance. Detection operators report that multiple legitimate browser libraries share overlapping TLS client fingerprints; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on TLS inspection appliance whether or not it matches require multi-signal conjunction to reduce benign TLS fingerprint false alerts
- Automate service shutdown on the first simple match to outbound TLS sessions share a fingerprint associated with a known loader family, without validation or guardrails for patent research
- Improve detection by requiring context-aware correlation: require multi-signal conjunction to reduce benign TLS fingerprint false alerts
- Suppress every future event associated with JA3-like fingerprint matches but destination and endpoint processes are mixed, including events outside multiple legitimate browser libraries share overlapping TLS client fingerprints
Explanation
Correct Answer
C:Require multi-signal conjunction to reduce benign TLS fingerprint false alerts retains the specific threat signal while discriminating against multiple legitimate browser libraries share overlapping TLS client fingerprints. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing multiple legitimate browser libraries share overlapping TLS client fingerprints from malicious conditions would increase noise and operational workload.
B:An untested, unqualified automation could interrupt patent research and cannot distinguish the benign workflow from attacker behavior.
D:Suppressing all monitoring would also hide a recurrence of potential malware traffic requiring corroboration rather than fingerprint-only proof, even where it threatens patent research.
Question 481
At Insurance broker, the security team assesses mobile customer API. The current issue is auth token is accepted for another customer's quote; assessment evidence states: authorization tests show scope missing for quote ID. The service is API reachable from mobile clients worldwide. Operational constraints: old mobile clients require backward-compatible error handling. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across mobile customer API during old mobile clients require backward-compatible error handling instead of using a scoped test
- Use only an anonymous outside-in scan of mobile customer API even when API reachable from mobile clients worldwide requires authenticated deployment context
- Accept the label auth token is accepted for another customer's quote as confirmed without checking the reported evidence authorization tests show scope missing for quote ID or actual deployment
- Use an authorized, scoped validation approach that considers service sensitivity: reproduce with two provisioned test identities and owned quote objects
Explanation
Correct Answer
D:The evidence authorization tests show scope missing for quote ID must be evaluated without violating the constraint old mobile clients require backward-compatible error handling. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because old mobile clients require backward-compatible error handling; authorization and scope are prerequisites.
B:Asset configuration and the constraints of mobile customer API matter; external findings alone may misstate or miss the exposed path.
C:The finding does not establish which live component is affected or whether the exposure API reachable from mobile clients worldwide is real.
Question 482
At Insurance broker, the security team assesses mobile customer API. The current issue is auth token is accepted for another customer's quote; assessment evidence states: authorization tests show scope missing for quote ID. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against mobile customer API, ignoring that old mobile clients require backward-compatible error handling and a safer validation exist
- Mark authorization tests show scope missing for quote ID resolved or confirmed solely from the scanner severity without reproduce with two provisioned test identities and owned quote objects
- Assume mobile customer API is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: reproduce with two provisioned test identities and owned quote objects
Explanation
Correct Answer
D:Reproduce with two provisioned test identities and owned quote objects tests the reported condition authorization tests show scope missing for quote ID against actual deployment context (API reachable from mobile clients worldwide). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when reproduce with two provisioned test identities and owned quote objects can provide authorized evidence and old mobile clients require backward-compatible error handling constrains production testing.
B:authorization tests show scope missing for quote ID may be accurate but its actual occurrence and configuration on mobile customer API must be established before calling it validated.
C:Security of an unrelated host cannot establish the state of mobile customer API, whose reported issue is auth token is accepted for another customer's quote.
Question 483
At Insurance broker, the security team assesses mobile customer API. The current issue is auth token is accepted for another customer's quote; assessment evidence states: authorization tests show scope missing for quote ID. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Choose whatever finding on mobile customer API was logged most recently, regardless of actual exploit path or priority
- Prioritize the confirmed exposure of mobile customer API, accounting for customer pricing privacy and the real access path: API reachable from mobile clients worldwide
- Choose the highest nominal scanner severity first while ignoring API reachable from mobile clients worldwide and the consequence to customer pricing privacy
- Give every vulnerability the same deadline despite auth token is accepted for another customer's quote and business impact on customer pricing privacy
Explanation
Correct Answer
B:Risk depends on practical reachability, threat activity and consequence. The issue auth token is accepted for another customer's quote can affect customer pricing privacy through API reachable from mobile clients worldwide; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Discovery order is not evidence of urgency compared with the actual affected mobile customer API.
C:CVSS describes technical characteristics, not the entirety of exposure and customer pricing privacy for this deployment.
D:Uniform priority ignores API reachable from mobile clients worldwide, operational harm and customer pricing privacy; documented context makes triage defensible.
Question 484
At Insurance broker, the security team assesses mobile customer API. The current issue is auth token is accepted for another customer's quote; assessment evidence states: authorization tests show scope missing for quote ID. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Sign an exception document but do not implement or test enforce token subject-to-object authorization on mobile customer API
- Use disable cross-account quote lookup temporarily as permanent closure of the confirmed issue instead of deploying enforce token subject-to-object authorization
- Leave auth token is accepted for another customer's quote present indefinitely because no incident involving customer pricing privacy was recorded this week
- Implement and verify the root-cause fix: enforce token subject-to-object authorization
Explanation
Correct Answer
D:Enforce token subject-to-object authorization targets the mechanism auth token is accepted for another customer's quote rather than only filtering symptoms. Verification must account for authorization tests show scope missing for quote ID and continued protection of customer pricing privacy.
Incorrect Answers
A:Risk acceptance paperwork does not itself remediate auth token is accepted for another customer's quote on mobile customer API; authorized, tested implementation is still required when the risk exceeds tolerance.
B:The interim control may reduce exposure, but it can leave the underlying auth token is accepted for another customer's quote and should be time-limited with verification and owner oversight.
C:No observed attack does not correct the verified condition authorization tests show scope missing for quote ID or eliminate its potential impact on customer pricing privacy.
Question 485
At Insurance broker, the security team assesses mobile customer API. The current issue is auth token is accepted for another customer's quote; assessment evidence states: authorization tests show scope missing for quote ID. A permanent correction cannot be deployed immediately because old mobile clients require backward-compatible error handling. Which interim treatment is the safest governed option?
- Push enforce token subject-to-object authorization immediately to all production systems with no safe change window despite old mobile clients require backward-compatible error handling
- Claim auth token is accepted for another customer's quote is patched when the change ticket opens, without confirming disable cross-account quote lookup temporarily or a planned permanent change
- Accept continued exposure of customer pricing privacy without any owner, expiry or compensating verification because old mobile clients require backward-compatible error handling
- Apply a time-bound compensating measure, disable cross-account quote lookup temporarily, record the residual risk owner and schedule the tested permanent fix
Explanation
Correct Answer
D:Disable cross-account quote lookup temporarily can reduce short-term exposure while old mobile clients require backward-compatible error handling delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because customer pricing privacy remains at stake.
Incorrect Answers
A:Ignoring old mobile clients require backward-compatible error handling could cause avoidable service failure and is not a risk-aware remediation process.
B:A work item is not proof that auth token is accepted for another customer's quote was corrected or even that disable cross-account quote lookup temporarily operates.
C:Business criticality increases the need for accountable decisions and review; it does not make customer pricing privacy irrelevant.
Question 486
At Insurance broker, the security team assesses mobile customer API. The current issue is auth token is accepted for another customer's quote; assessment evidence states: authorization tests show scope missing for quote ID. The owner reports that enforce token subject-to-object authorization has been deployed. What evidence should close the vulnerability item?
- Close authorization tests show scope missing for quote ID after the deployment tool returns success, without verifying the current state of mobile customer API
- Use an unrelated server’s clean findings to claim mobile customer API is fixed without retesting the affected path
- Retest the originally affected configuration using reproduce with two provisioned test identities and owned quote objects, confirm the vulnerability is gone and record change evidence
- Suppress future results for auth token is accepted for another customer's quote so that the vulnerability dashboard shows a completed remediation
Explanation
Correct Answer
C:Closure requires checking the same affected path identified by authorization tests show scope missing for quote ID, plus regression impact on mobile customer API. A change ticket alone is not proof of removal of auth token is accepted for another customer's quote.
Incorrect Answers
A:Process completion is not evidence that authorization tests show scope missing for quote ID no longer applies to mobile customer API.
B:The result must be tied to mobile customer API and the actual exposure: API reachable from mobile clients worldwide.
D:Suppression may hide a failed or incomplete fix, leaving customer pricing privacy exposed despite the administrative record.
Question 487
At Government payroll, analysts monitor staff identity push MFA. They observe that a user receives 19 MFA pushes at midnight then one accepted push from a new device. Evidence: IdP log shows repeated denied approvals followed by new-session token issuance. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of MFA fatigue attack culminating in unauthorized approval and begin corroborating it with endpoint and network evidence
- Downgrade a user receives 19 MFA pushes at midnight then one accepted push from a new device solely because the same symptom has not yet appeared on another endpoint
- Treat legitimate MFA migration requires helpdesk ticket and device binding under staffed window as conclusive authorization for the current event without matching process or identity
- Announce that IdP log shows repeated denied approvals followed by new-session token issuance conclusively proves theft of payroll payment data before reviewing any sessions or file access
Explanation
Correct Answer
A:The combination of a user receives 19 MFA pushes at midnight then one accepted push from a new device and IdP log shows repeated denied approvals followed by new-session token issuance is suspicious for MFA fatigue attack culminating in unauthorized approval. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting payroll payment data.
Incorrect Answers
B:An intrusion can begin on one asset. The specific indicator on staff identity push MFA warrants its own validation before expanding or closing the investigation.
C:The legitimate comparator is legitimate MFA migration requires helpdesk ticket and device binding under staffed window; it does not establish that the current event came from the same approved identity or workflow.
D:IdP log shows repeated denied approvals followed by new-session token issuance is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
Question 488
At Government payroll, analysts monitor staff identity push MFA. They observe that a user receives 19 MFA pushes at midnight then one accepted push from a new device. Evidence: IdP log shows repeated denied approvals followed by new-session token issuance. A separate known-good explanation is: legitimate MFA migration requires helpdesk ticket and device binding under staffed window. Which next analysis most reliably determines what caused the observed event?
- Summarize IdP log shows repeated denied approvals followed by new-session token issuance into a ticket and discard underlying event identifiers before correlation
- Accept a public reputation score for the destination as proof of the origin of IdP log shows repeated denied approvals followed by new-session token issuance, without using correlate push events with device registration and session grants
- Suspend telemetry collection on staff identity push MFA while waiting for the connection pattern to stop
- Perform a scoped investigation: correlate push events with device registration and session grants
Explanation
Correct Answer
D:Correlate push events with device registration and session grants ties the evidence on staff identity push MFA to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: legitimate MFA migration requires helpdesk ticket and device binding under staffed window.
Incorrect Answers
A:The original IdP log shows repeated denied approvals followed by new-session token issuance must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
B:A reputation score may inform triage but cannot establish the origin of IdP log shows repeated denied approvals followed by new-session token issuance or whether the activity matches legitimate MFA migration requires helpdesk ticket and device binding under staffed window.
C:Suppressing telemetry destroys the source needed to investigate MFA fatigue attack culminating in unauthorized approval and may conceal further actions.
Question 489
Government payroll has a candidate alert for staff identity push MFA: IdP log shows repeated denied approvals followed by new-session token issuance. The team argues it is harmless because legitimate MFA migration requires helpdesk ticket and device binding under staffed window. What is the most defensible false-positive assessment?
- Distinguish IdP log shows repeated denied approvals followed by new-session token issuance from the approved behavior (legitimate MFA migration requires helpdesk ticket and device binding under staffed window) by validating process, identity and time attribution
- Create a blanket suppression for IdP log shows repeated denied approvals followed by new-session token issuance because legitimate MFA migration requires helpdesk ticket and device binding under staffed window can produce a superficially similar event
- Automatically treat every event resembling IdP log shows repeated denied approvals followed by new-session token issuance as confirmed compromise of staff identity push MFA, without checking provenance
- Interpret an absence of existing vendor signatures as proof that a user receives 19 MFA pushes at midnight then one accepted push from a new device is benign
Explanation
Correct Answer
A:Legitimate MFA migration requires helpdesk ticket and device binding under staffed window is a plausible alternative, but it must be proven to match the actual source of IdP log shows repeated denied approvals followed by new-session token issuance. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
B:Similarity to legitimate MFA migration requires helpdesk ticket and device binding under staffed window does not exclude an attacker from producing the same surface event on staff identity push MFA.
C:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting payroll payment data.
D:Absence of a signature does not refute the concrete behavior: a user receives 19 MFA pushes at midnight then one accepted push from a new device.
Question 490
At Government payroll, analysts monitor staff identity push MFA. They observe that a user receives 19 MFA pushes at midnight then one accepted push from a new device. Evidence: IdP log shows repeated denied approvals followed by new-session token issuance. The team confirms unauthorized behavior and must protect payroll payment data; legitimate service continuity remains necessary. Which containment decision is best?
- Disable every production service at Government payroll without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: revoke new sessions and reset MFA factors through verified identity recovery
- Erase IdP log shows repeated denied approvals followed by new-session token issuance from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on staff identity push MFA unrestricted until actual losses of payroll payment data can be measured
Explanation
Correct Answer
B:Revoke new sessions and reset MFA factors through verified identity recovery constrains the observed threat while maintaining necessary service for payroll payment data. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Global shutdown could disrupt payroll payment data without evidence that every system has been affected; scoped isolation is more proportionate.
C:Eliminating IdP log shows repeated denied approvals followed by new-session token issuance evidence does not contain MFA fatigue attack culminating in unauthorized approval and impairs forensic reconstruction.
D:Once unauthorized behavior is confirmed on staff identity push MFA, delaying containment could expand the exposure affecting payroll payment data.
