CompTIA CS0-003 Practice Test 52
Question 510
At Law firm, the security team assesses source code repository. The current issue is committed cloud API secret in public fork; assessment evidence states: secret scanner matches token format and provider verifies active key. The owner reports that revoke/rotate secret and purge history with new safe credentials has been deployed. What evidence should close the vulnerability item?
- Use an unrelated server’s clean findings to claim source code repository is fixed without retesting the affected path
- Retest the originally affected configuration using confirm token validity via provider metadata without using secret for data access, confirm the vulnerability is gone and record change evidence
- Suppress future results for committed cloud API secret in public fork so that the vulnerability dashboard shows a completed remediation
- Close secret scanner matches token format and provider verifies active key after the deployment tool returns success, without verifying the current state of source code repository
Explanation
Correct Answer
B:Closure requires checking the same affected path identified by secret scanner matches token format and provider verifies active key, plus regression impact on source code repository. A change ticket alone is not proof of removal of committed cloud API secret in public fork.
Incorrect Answers
A:The result must be tied to source code repository and the actual exposure: fork mirrored to public hosting.
C:Suppression may hide a failed or incomplete fix, leaving client document confidentiality exposed despite the administrative record.
D:Process completion is not evidence that secret scanner matches token format and provider verifies active key no longer applies to source code repository.
Question 511
At Utility outage app, analysts monitor authentication microservice. They observe that new privileged API tokens are created outside the change window then used from overseas endpoints. Evidence: application audit logs show service-admin creation and rapid token access to reports. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Announce that application audit logs show service-admin creation and rapid token access to reports conclusively proves theft of outage map integrity before reviewing any sessions or file access
- Treat approved emergency account creation requires ticketed break-glass workflow with session recording as conclusive authorization for the current event without matching process or identity
- Treat the pattern as a hypothesis of unauthorized service-account provisioning and begin corroborating it with endpoint and network evidence
- Downgrade new privileged API tokens are created outside the change window then used from overseas endpoints solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
C:The combination of new privileged API tokens are created outside the change window then used from overseas endpoints and application audit logs show service-admin creation and rapid token access to reports is suspicious for unauthorized service-account provisioning. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting outage map integrity.
Incorrect Answers
A:application audit logs show service-admin creation and rapid token access to reports is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
B:The legitimate comparator is approved emergency account creation requires ticketed break-glass workflow with session recording; it does not establish that the current event came from the same approved identity or workflow.
D:An intrusion can begin on one asset. The specific indicator on authentication microservice warrants its own validation before expanding or closing the investigation.
Question 512
At Utility outage app, analysts monitor authentication microservice. They observe that new privileged API tokens are created outside the change window then used from overseas endpoints. Evidence: application audit logs show service-admin creation and rapid token access to reports. A separate known-good explanation is: approved emergency account creation requires ticketed break-glass workflow with session recording. Which next analysis most reliably determines what caused the observed event?
- Summarize application audit logs show service-admin creation and rapid token access to reports into a ticket and discard underlying event identifiers before correlation
- Perform a scoped investigation: link account-creation events to deployment logs, request IDs and IP egress
- Accept a public reputation score for the destination as proof of the origin of application audit logs show service-admin creation and rapid token access to reports, without using link account-creation events to deployment logs, request IDs and IP egress
- Suspend telemetry collection on authentication microservice while waiting for the connection pattern to stop
Explanation
Correct Answer
B:Link account-creation events to deployment logs, request IDs and IP egress ties the evidence on authentication microservice to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved emergency account creation requires ticketed break-glass workflow with session recording.
Incorrect Answers
A:The original application audit logs show service-admin creation and rapid token access to reports must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
C:A reputation score may inform triage but cannot establish the origin of application audit logs show service-admin creation and rapid token access to reports or whether the activity matches approved emergency account creation requires ticketed break-glass workflow with session recording.
D:Suppressing telemetry destroys the source needed to investigate unauthorized service-account provisioning and may conceal further actions.
Question 513
Utility outage app has a candidate alert for authentication microservice: application audit logs show service-admin creation and rapid token access to reports. The team argues it is harmless because approved emergency account creation requires ticketed break-glass workflow with session recording. What is the most defensible false-positive assessment?
- Create a blanket suppression for application audit logs show service-admin creation and rapid token access to reports because approved emergency account creation requires ticketed break-glass workflow with session recording can produce a superficially similar event
- Interpret an absence of existing vendor signatures as proof that new privileged API tokens are created outside the change window then used from overseas endpoints is benign
- Distinguish application audit logs show service-admin creation and rapid token access to reports from the approved behavior (approved emergency account creation requires ticketed break-glass workflow with session recording) by validating process, identity and time attribution
- Automatically treat every event resembling application audit logs show service-admin creation and rapid token access to reports as confirmed compromise of authentication microservice, without checking provenance
Explanation
Correct Answer
C:Approved emergency account creation requires ticketed break-glass workflow with session recording is a plausible alternative, but it must be proven to match the actual source of application audit logs show service-admin creation and rapid token access to reports. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Similarity to approved emergency account creation requires ticketed break-glass workflow with session recording does not exclude an attacker from producing the same surface event on authentication microservice.
B:Absence of a signature does not refute the concrete behavior: new privileged API tokens are created outside the change window then used from overseas endpoints.
D:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting outage map integrity.
Question 514
At Utility outage app, analysts monitor authentication microservice. They observe that new privileged API tokens are created outside the change window then used from overseas endpoints. Evidence: application audit logs show service-admin creation and rapid token access to reports. The team confirms unauthorized behavior and must protect outage map integrity; legitimate service continuity remains necessary. Which containment decision is best?
- Erase application audit logs show service-admin creation and rapid token access to reports from the evidence archive during the containment change to reduce repeated alerts
- Apply targeted containment: disable newly created tokens after verifying emergency access continuity
- Disable every production service at Utility outage app without measuring whether its dependencies share the observed malicious path
- Leave the confirmed unauthorized activity on authentication microservice unrestricted until actual losses of outage map integrity can be measured
Explanation
Correct Answer
B:Disable newly created tokens after verifying emergency access continuity constrains the observed threat while maintaining necessary service for outage map integrity. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Eliminating application audit logs show service-admin creation and rapid token access to reports evidence does not contain unauthorized service-account provisioning and impairs forensic reconstruction.
C:Global shutdown could disrupt outage map integrity without evidence that every system has been affected; scoped isolation is more proportionate.
D:Once unauthorized behavior is confirmed on authentication microservice, delaying containment could expand the exposure affecting outage map integrity.
Question 515
At Utility outage app, analysts have investigated an initial alert involving authentication microservice and need to scope related activity. Original event: application audit logs show service-admin creation and rapid token access to reports. Which threat-hunt pivot is best grounded in this observation?
- Use the previous month’s overall alert closure count instead of pivoting on application audit logs show service-admin creation and rapid token access to reports across related identities and systems
- Pivot across the environment: hunt for the same creator principal and unapproved admin token grants
- Stop scoping once the initial authentication microservice has been contained, even though hunt for the same creator principal and unapproved admin token grants has not been attempted
- Mark every host adjacent to authentication microservice compromised by assumption without comparing activity-linked observables
Explanation
Correct Answer
B:Hunt for the same creator principal and unapproved admin token grants extends the investigation from the specific clue, application audit logs show service-admin creation and rapid token access to reports, to related activity while preserving host and user attribution. This estimates the scope of potential unauthorized service-account provisioning.
Incorrect Answers
A:Historical alert volume does not trace the shared indicator or determine whether unauthorized service-account provisioning spread beyond authentication microservice.
C:The initiating host may not be the only affected one; scoping requires examining the connected evidence application audit logs show service-admin creation and rapid token access to reports.
D:Proximity to authentication microservice is not proof of exposure; use the activity-linked pivot to identify actual relationships.
Question 516
Utility outage app has investigated unauthorized service-account provisioning on authentication microservice. Detection operators report that approved emergency account creation requires ticketed break-glass workflow with session recording; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Suppress every future event associated with application audit logs show service-admin creation and rapid token access to reports, including events outside approved emergency account creation requires ticketed break-glass workflow with session recording
- Automate service shutdown on the first simple match to new privileged API tokens are created outside the change window then used from overseas endpoints, without validation or guardrails for outage map integrity
- Improve detection by requiring context-aware correlation: alert on off-window privileged token creation and fast first-use from unfamiliar networks
- Assign critical severity to every routine activity on authentication microservice whether or not it matches alert on off-window privileged token creation and fast first-use from unfamiliar networks
Explanation
Correct Answer
C:Alert on off-window privileged token creation and fast first-use from unfamiliar networks retains the specific threat signal while discriminating against approved emergency account creation requires ticketed break-glass workflow with session recording. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Suppressing all monitoring would also hide a recurrence of unauthorized service-account provisioning, even where it threatens outage map integrity.
B:An untested, unqualified automation could interrupt outage map integrity and cannot distinguish the benign workflow from attacker behavior.
D:Alert severity without distinguishing approved emergency account creation requires ticketed break-glass workflow with session recording from malicious conditions would increase noise and operational workload.
Question 517
At City transit, the security team assesses platform cameras. The current issue is default admin credentials on network cameras; assessment evidence states: credentialed baseline scan shows unchanged factory account. The service is cameras accessible on operations subnet. Operational constraints: camera recording must continue during commute. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across platform cameras during camera recording must continue during commute instead of using a scoped test
- Accept the label default admin credentials on network cameras as confirmed without checking the reported evidence credentialed baseline scan shows unchanged factory account or actual deployment
- Use only an anonymous outside-in scan of platform cameras even when cameras accessible on operations subnet requires authenticated deployment context
- Use an authorized, scoped validation approach that considers service sensitivity: validate against authorized device inventory and managed test password
Explanation
Correct Answer
D:The evidence credentialed baseline scan shows unchanged factory account must be evaluated without violating the constraint camera recording must continue during commute. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because camera recording must continue during commute; authorization and scope are prerequisites.
B:The finding does not establish which live component is affected or whether the exposure cameras accessible on operations subnet is real.
C:Asset configuration and the constraints of platform cameras matter; external findings alone may misstate or miss the exposed path.
Question 518
At City transit, the security team assesses platform cameras. The current issue is default admin credentials on network cameras; assessment evidence states: credentialed baseline scan shows unchanged factory account. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Mark credentialed baseline scan shows unchanged factory account resolved or confirmed solely from the scanner severity without validate against authorized device inventory and managed test password
- Force a destructive proof-of-concept against platform cameras, ignoring that camera recording must continue during commute and a safer validation exist
- Confirm the reported condition in the relevant asset context: validate against authorized device inventory and managed test password
- Assume platform cameras is safe because another platform with similar software recently passed its own assessment
Explanation
Correct Answer
C:Validate against authorized device inventory and managed test password tests the reported condition credentialed baseline scan shows unchanged factory account against actual deployment context (cameras accessible on operations subnet). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:credentialed baseline scan shows unchanged factory account may be accurate but its actual occurrence and configuration on platform cameras must be established before calling it validated.
B:A destructive proof is unnecessary when validate against authorized device inventory and managed test password can provide authorized evidence and camera recording must continue during commute constrains production testing.
D:Security of an unrelated host cannot establish the state of platform cameras, whose reported issue is default admin credentials on network cameras.
Question 519
At City transit, the security team assesses platform cameras. The current issue is default admin credentials on network cameras; assessment evidence states: credentialed baseline scan shows unchanged factory account. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Choose the highest nominal scanner severity first while ignoring cameras accessible on operations subnet and the consequence to passenger privacy
- Prioritize the confirmed exposure of platform cameras, accounting for passenger privacy and the real access path: cameras accessible on operations subnet
- Give every vulnerability the same deadline despite default admin credentials on network cameras and business impact on passenger privacy
- Choose whatever finding on platform cameras was logged most recently, regardless of actual exploit path or priority
Explanation
Correct Answer
B:Risk depends on practical reachability, threat activity and consequence. The issue default admin credentials on network cameras can affect passenger privacy through cameras accessible on operations subnet; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:CVSS describes technical characteristics, not the entirety of exposure and passenger privacy for this deployment.
C:Uniform priority ignores cameras accessible on operations subnet, operational harm and passenger privacy; documented context makes triage defensible.
D:Discovery order is not evidence of urgency compared with the actual affected platform cameras.
Question 520
At City transit, the security team assesses platform cameras. The current issue is default admin credentials on network cameras; assessment evidence states: credentialed baseline scan shows unchanged factory account. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use block direct management outside jump host pending rotation as permanent closure of the confirmed issue instead of deploying unique credentials, PAM and management-plane segmentation
- Implement and verify the root-cause fix: unique credentials, PAM and management-plane segmentation
- Leave default admin credentials on network cameras present indefinitely because no incident involving passenger privacy was recorded this week
- Sign an exception document but do not implement or test unique credentials, PAM and management-plane segmentation on platform cameras
Explanation
Correct Answer
B:Unique credentials, PAM and management-plane segmentation targets the mechanism default admin credentials on network cameras rather than only filtering symptoms. Verification must account for credentialed baseline scan shows unchanged factory account and continued protection of passenger privacy.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying default admin credentials on network cameras and should be time-limited with verification and owner oversight.
C:No observed attack does not correct the verified condition credentialed baseline scan shows unchanged factory account or eliminate its potential impact on passenger privacy.
D:Risk acceptance paperwork does not itself remediate default admin credentials on network cameras on platform cameras; authorized, tested implementation is still required when the risk exceeds tolerance.
