CompTIA CS0-003 Practice Test 50
Question 490
At Government payroll, analysts monitor staff identity push MFA. They observe that a user receives 19 MFA pushes at midnight then one accepted push from a new device. Evidence: IdP log shows repeated denied approvals followed by new-session token issuance. The team confirms unauthorized behavior and must protect payroll payment data; legitimate service continuity remains necessary. Which containment decision is best?
- Disable every production service at Government payroll without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: revoke new sessions and reset MFA factors through verified identity recovery
- Erase IdP log shows repeated denied approvals followed by new-session token issuance from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on staff identity push MFA unrestricted until actual losses of payroll payment data can be measured
Explanation
Correct Answer
B:Revoke new sessions and reset MFA factors through verified identity recovery constrains the observed threat while maintaining necessary service for payroll payment data. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Global shutdown could disrupt payroll payment data without evidence that every system has been affected; scoped isolation is more proportionate.
C:Eliminating IdP log shows repeated denied approvals followed by new-session token issuance evidence does not contain MFA fatigue attack culminating in unauthorized approval and impairs forensic reconstruction.
D:Once unauthorized behavior is confirmed on staff identity push MFA, delaying containment could expand the exposure affecting payroll payment data.
Question 491
Government payroll receives a three-month-old threat-intelligence bulletin associating an observable with MFA fatigue attack culminating in unauthorized approval. On staff identity push MFA, local telemetry reports: IdP log shows repeated denied approvals followed by new-session token issuance. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions MFA fatigue attack culminating in unauthorized approval, without checking whether its observable is present on staff identity push MFA
- Assess bulletin timeliness and provenance, then corroborate its observables against IdP log shows repeated denied approvals followed by new-session token issuance and affected staff identity push MFA
- Dismiss the bulletin solely because Government payroll has not named the attacker associated with IdP log shows repeated denied approvals followed by new-session token issuance
- Forward the bulletin about MFA fatigue attack culminating in unauthorized approval as a confirmed breach of staff identity push MFA without hosts, timestamps or confidence caveats
Explanation
Correct Answer
B:An old feed with unknown confidence is not automatic proof of activity at Government payroll. Comparing its timestamps and provenance with IdP log shows repeated denied approvals followed by new-session token issuance reveals whether the indicator is still relevant to staff identity push MFA and payroll payment data.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual IdP log shows repeated denied approvals followed by new-session token issuance.
C:Actor attribution is not required to assess a supported technique, source confidence or relevance to staff identity push MFA.
D:Converting the unverified feed into confirmed activity on staff identity push MFA may mislead investigators and prompt harmful response for payroll payment data.
Question 492
Government payroll has investigated MFA fatigue attack culminating in unauthorized approval on staff identity push MFA. Detection operators report that legitimate MFA migration requires helpdesk ticket and device binding under staffed window; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on staff identity push MFA whether or not it matches alert on high-frequency push requests followed by unrecognized approved device
- Automate service shutdown on the first simple match to a user receives 19 MFA pushes at midnight then one accepted push from a new device, without validation or guardrails for payroll payment data
- Improve detection by requiring context-aware correlation: alert on high-frequency push requests followed by unrecognized approved device
- Suppress every future event associated with IdP log shows repeated denied approvals followed by new-session token issuance, including events outside legitimate MFA migration requires helpdesk ticket and device binding under staffed window
Explanation
Correct Answer
C:Alert on high-frequency push requests followed by unrecognized approved device retains the specific threat signal while discriminating against legitimate MFA migration requires helpdesk ticket and device binding under staffed window. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing legitimate MFA migration requires helpdesk ticket and device binding under staffed window from malicious conditions would increase noise and operational workload.
B:An untested, unqualified automation could interrupt payroll payment data and cannot distinguish the benign workflow from attacker behavior.
D:Suppressing all monitoring would also hide a recurrence of MFA fatigue attack culminating in unauthorized approval, even where it threatens payroll payment data.
Question 493
At University IT, the security team assesses retired staging environment. The current issue is forgotten staging portal exposes debug endpoints; assessment evidence states: attack-surface scanner finds staging host resolving publicly. The service is external DNS and unprotected test data. Operational constraints: old developer bookmarks used for deployment. Which assessment approach is most appropriate before recommending a fix?
- Accept the label forgotten staging portal exposes debug endpoints as confirmed without checking the reported evidence attack-surface scanner finds staging host resolving publicly or actual deployment
- Use an authorized, scoped validation approach that considers service sensitivity: confirm ownership, service dependency and permitted exposure
- Use only an anonymous outside-in scan of retired staging environment even when external DNS and unprotected test data requires authenticated deployment context
- Launch unapproved intrusive exploitation across retired staging environment during old developer bookmarks used for deployment instead of using a scoped test
Explanation
Correct Answer
B:The evidence attack-surface scanner finds staging host resolving publicly must be evaluated without violating the constraint old developer bookmarks used for deployment. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:The finding does not establish which live component is affected or whether the exposure external DNS and unprotected test data is real.
C:Asset configuration and the constraints of retired staging environment matter; external findings alone may misstate or miss the exposed path.
D:Uncontrolled testing may breach service safety, especially because old developer bookmarks used for deployment; authorization and scope are prerequisites.
Question 494
At University IT, the security team assesses retired staging environment. The current issue is forgotten staging portal exposes debug endpoints; assessment evidence states: attack-surface scanner finds staging host resolving publicly. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Mark attack-surface scanner finds staging host resolving publicly resolved or confirmed solely from the scanner severity without confirm ownership, service dependency and permitted exposure
- Assume retired staging environment is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: confirm ownership, service dependency and permitted exposure
- Force a destructive proof-of-concept against retired staging environment, ignoring that old developer bookmarks used for deployment and a safer validation exist
Explanation
Correct Answer
C:Confirm ownership, service dependency and permitted exposure tests the reported condition attack-surface scanner finds staging host resolving publicly against actual deployment context (external DNS and unprotected test data). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:attack-surface scanner finds staging host resolving publicly may be accurate but its actual occurrence and configuration on retired staging environment must be established before calling it validated.
B:Security of an unrelated host cannot establish the state of retired staging environment, whose reported issue is forgotten staging portal exposes debug endpoints.
D:A destructive proof is unnecessary when confirm ownership, service dependency and permitted exposure can provide authorized evidence and old developer bookmarks used for deployment constrains production testing.
Question 495
At University IT, the security team assesses retired staging environment. The current issue is forgotten staging portal exposes debug endpoints; assessment evidence states: attack-surface scanner finds staging host resolving publicly. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Choose the highest nominal scanner severity first while ignoring external DNS and unprotected test data and the consequence to student test credentials
- Prioritize the confirmed exposure of retired staging environment, accounting for student test credentials and the real access path: external DNS and unprotected test data
- Choose whatever finding on retired staging environment was logged most recently, regardless of actual exploit path or priority
- Give every vulnerability the same deadline despite forgotten staging portal exposes debug endpoints and business impact on student test credentials
Explanation
Correct Answer
B:Risk depends on practical reachability, threat activity and consequence. The issue forgotten staging portal exposes debug endpoints can affect student test credentials through external DNS and unprotected test data; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:CVSS describes technical characteristics, not the entirety of exposure and student test credentials for this deployment.
C:Discovery order is not evidence of urgency compared with the actual affected retired staging environment.
D:Uniform priority ignores external DNS and unprotected test data, operational harm and student test credentials; documented context makes triage defensible.
Question 496
At University IT, the security team assesses retired staging environment. The current issue is forgotten staging portal exposes debug endpoints; assessment evidence states: attack-surface scanner finds staging host resolving publicly. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Sign an exception document but do not implement or test decommission host or require authenticated network isolation on retired staging environment
- Leave forgotten staging portal exposes debug endpoints present indefinitely because no incident involving student test credentials was recorded this week
- Use remove public DNS and restrict ingress until retirement as permanent closure of the confirmed issue instead of deploying decommission host or require authenticated network isolation
- Implement and verify the root-cause fix: decommission host or require authenticated network isolation
Explanation
Correct Answer
D:Decommission host or require authenticated network isolation targets the mechanism forgotten staging portal exposes debug endpoints rather than only filtering symptoms. Verification must account for attack-surface scanner finds staging host resolving publicly and continued protection of student test credentials.
Incorrect Answers
A:Risk acceptance paperwork does not itself remediate forgotten staging portal exposes debug endpoints on retired staging environment; authorized, tested implementation is still required when the risk exceeds tolerance.
B:No observed attack does not correct the verified condition attack-surface scanner finds staging host resolving publicly or eliminate its potential impact on student test credentials.
C:The interim control may reduce exposure, but it can leave the underlying forgotten staging portal exposes debug endpoints and should be time-limited with verification and owner oversight.
Question 497
At University IT, the security team assesses retired staging environment. The current issue is forgotten staging portal exposes debug endpoints; assessment evidence states: attack-surface scanner finds staging host resolving publicly. A permanent correction cannot be deployed immediately because old developer bookmarks used for deployment. Which interim treatment is the safest governed option?
- Apply a time-bound compensating measure, remove public DNS and restrict ingress until retirement, record the residual risk owner and schedule the tested permanent fix
- Accept continued exposure of student test credentials without any owner, expiry or compensating verification because old developer bookmarks used for deployment
- Claim forgotten staging portal exposes debug endpoints is patched when the change ticket opens, without confirming remove public DNS and restrict ingress until retirement or a planned permanent change
- Push decommission host or require authenticated network isolation immediately to all production systems with no safe change window despite old developer bookmarks used for deployment
Explanation
Correct Answer
A:Remove public DNS and restrict ingress until retirement can reduce short-term exposure while old developer bookmarks used for deployment delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because student test credentials remains at stake.
Incorrect Answers
B:Business criticality increases the need for accountable decisions and review; it does not make student test credentials irrelevant.
C:A work item is not proof that forgotten staging portal exposes debug endpoints was corrected or even that remove public DNS and restrict ingress until retirement operates.
D:Ignoring old developer bookmarks used for deployment could cause avoidable service failure and is not a risk-aware remediation process.
Question 498
At University IT, the security team assesses retired staging environment. The current issue is forgotten staging portal exposes debug endpoints; assessment evidence states: attack-surface scanner finds staging host resolving publicly. The owner reports that decommission host or require authenticated network isolation has been deployed. What evidence should close the vulnerability item?
- Retest the originally affected configuration using confirm ownership, service dependency and permitted exposure, confirm the vulnerability is gone and record change evidence
- Close attack-surface scanner finds staging host resolving publicly after the deployment tool returns success, without verifying the current state of retired staging environment
- Suppress future results for forgotten staging portal exposes debug endpoints so that the vulnerability dashboard shows a completed remediation
- Use an unrelated server’s clean findings to claim retired staging environment is fixed without retesting the affected path
Explanation
Correct Answer
A:Closure requires checking the same affected path identified by attack-surface scanner finds staging host resolving publicly, plus regression impact on retired staging environment. A change ticket alone is not proof of removal of forgotten staging portal exposes debug endpoints.
Incorrect Answers
B:Process completion is not evidence that attack-surface scanner finds staging host resolving publicly no longer applies to retired staging environment.
C:Suppression may hide a failed or incomplete fix, leaving student test credentials exposed despite the administrative record.
D:The result must be tied to retired staging environment and the actual exposure: external DNS and unprotected test data.
Question 499
At International hotel chain, analysts monitor reservation mail gateway. They observe that a booking invoice says it originates at corporate domain while DKIM is invalid and DMARC alignment fails. Evidence: email headers show SPF pass for an unrelated forwarding sender with From mismatch. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of spoofed reservation message with malicious embedded link and begin corroborating it with endpoint and network evidence
- Announce that email headers show SPF pass for an unrelated forwarding sender with From mismatch conclusively proves theft of guest identity data before reviewing any sessions or file access
- Treat approved reservation relays use authorized DKIM selectors and aligned envelope domains as conclusive authorization for the current event without matching process or identity
- Downgrade a booking invoice says it originates at corporate domain while DKIM is invalid and DMARC alignment fails solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
A:The combination of a booking invoice says it originates at corporate domain while DKIM is invalid and DMARC alignment fails and email headers show SPF pass for an unrelated forwarding sender with From mismatch is suspicious for spoofed reservation message with malicious embedded link. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting guest identity data.
Incorrect Answers
B:email headers show SPF pass for an unrelated forwarding sender with From mismatch is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
C:The legitimate comparator is approved reservation relays use authorized DKIM selectors and aligned envelope domains; it does not establish that the current event came from the same approved identity or workflow.
D:An intrusion can begin on one asset. The specific indicator on reservation mail gateway warrants its own validation before expanding or closing the investigation.
Question 500
At International hotel chain, analysts monitor reservation mail gateway. They observe that a booking invoice says it originates at corporate domain while DKIM is invalid and DMARC alignment fails. Evidence: email headers show SPF pass for an unrelated forwarding sender with From mismatch. A separate known-good explanation is: approved reservation relays use authorized DKIM selectors and aligned envelope domains. Which next analysis most reliably determines what caused the observed event?
- Perform a scoped investigation: check From/envelope alignment, DKIM signatures and message route
- Suspend telemetry collection on reservation mail gateway while waiting for the connection pattern to stop
- Accept a public reputation score for the destination as proof of the origin of email headers show SPF pass for an unrelated forwarding sender with From mismatch, without using check From/envelope alignment, DKIM signatures and message route
- Summarize email headers show SPF pass for an unrelated forwarding sender with From mismatch into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
A:Check From/envelope alignment, DKIM signatures and message route ties the evidence on reservation mail gateway to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved reservation relays use authorized DKIM selectors and aligned envelope domains.
Incorrect Answers
B:Suppressing telemetry destroys the source needed to investigate spoofed reservation message with malicious embedded link and may conceal further actions.
C:A reputation score may inform triage but cannot establish the origin of email headers show SPF pass for an unrelated forwarding sender with From mismatch or whether the activity matches approved reservation relays use authorized DKIM selectors and aligned envelope domains.
D:The original email headers show SPF pass for an unrelated forwarding sender with From mismatch must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
