CompTIA CS0-003 Practice Test 53
Question 520
At City transit, the security team assesses platform cameras. The current issue is default admin credentials on network cameras; assessment evidence states: credentialed baseline scan shows unchanged factory account. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use block direct management outside jump host pending rotation as permanent closure of the confirmed issue instead of deploying unique credentials, PAM and management-plane segmentation
- Implement and verify the root-cause fix: unique credentials, PAM and management-plane segmentation
- Leave default admin credentials on network cameras present indefinitely because no incident involving passenger privacy was recorded this week
- Sign an exception document but do not implement or test unique credentials, PAM and management-plane segmentation on platform cameras
Explanation
Correct Answer
B:Unique credentials, PAM and management-plane segmentation targets the mechanism default admin credentials on network cameras rather than only filtering symptoms. Verification must account for credentialed baseline scan shows unchanged factory account and continued protection of passenger privacy.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying default admin credentials on network cameras and should be time-limited with verification and owner oversight.
C:No observed attack does not correct the verified condition credentialed baseline scan shows unchanged factory account or eliminate its potential impact on passenger privacy.
D:Risk acceptance paperwork does not itself remediate default admin credentials on network cameras on platform cameras; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 521
At City transit, the security team assesses platform cameras. The current issue is default admin credentials on network cameras; assessment evidence states: credentialed baseline scan shows unchanged factory account. A permanent correction cannot be deployed immediately because camera recording must continue during commute. Which interim treatment is the safest governed option?
- Apply a time-bound compensating measure, block direct management outside jump host pending rotation, record the residual risk owner and schedule the tested permanent fix
- Claim default admin credentials on network cameras is patched when the change ticket opens, without confirming block direct management outside jump host pending rotation or a planned permanent change
- Push unique credentials, PAM and management-plane segmentation immediately to all production systems with no safe change window despite camera recording must continue during commute
- Accept continued exposure of passenger privacy without any owner, expiry or compensating verification because camera recording must continue during commute
Explanation
Correct Answer
A:Block direct management outside jump host pending rotation can reduce short-term exposure while camera recording must continue during commute delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because passenger privacy remains at stake.
Incorrect Answers
B:A work item is not proof that default admin credentials on network cameras was corrected or even that block direct management outside jump host pending rotation operates.
C:Ignoring camera recording must continue during commute could cause avoidable service failure and is not a risk-aware remediation process.
D:Business criticality increases the need for accountable decisions and review; it does not make passenger privacy irrelevant.
Question 522
At City transit, the security team assesses platform cameras. The current issue is default admin credentials on network cameras; assessment evidence states: credentialed baseline scan shows unchanged factory account. The owner reports that unique credentials, PAM and management-plane segmentation has been deployed. What evidence should close the vulnerability item?
- Retest the originally affected configuration using validate against authorized device inventory and managed test password, confirm the vulnerability is gone and record change evidence
- Use an unrelated server’s clean findings to claim platform cameras is fixed without retesting the affected path
- Close credentialed baseline scan shows unchanged factory account after the deployment tool returns success, without verifying the current state of platform cameras
- Suppress future results for default admin credentials on network cameras so that the vulnerability dashboard shows a completed remediation
Explanation
Correct Answer
A:Closure requires checking the same affected path identified by credentialed baseline scan shows unchanged factory account, plus regression impact on platform cameras. A change ticket alone is not proof of removal of default admin credentials on network cameras.
Incorrect Answers
B:The result must be tied to platform cameras and the actual exposure: cameras accessible on operations subnet.
C:Process completion is not evidence that credentialed baseline scan shows unchanged factory account no longer applies to platform cameras.
D:Suppression may hide a failed or incomplete fix, leaving passenger privacy exposed despite the administrative record.
Question 523
At Professional services firm, analysts monitor remote desktop gateway. They observe that one IP attempts passwords for 34 accounts but never exceeds three attempts per account. Evidence: RDP logs show distributed username spray and later single successful 4624. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of password spraying against remote workforce and begin corroborating it with endpoint and network evidence
- Announce that RDP logs show distributed username spray and later single successful 4624 conclusively proves theft of customer projects before reviewing any sessions or file access
- Treat legitimate employee reconnects are tied to known device certificates and individual logon failures as conclusive authorization for the current event without matching process or identity
- Downgrade one IP attempts passwords for 34 accounts but never exceeds three attempts per account solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
A:The combination of one IP attempts passwords for 34 accounts but never exceeds three attempts per account and RDP logs show distributed username spray and later single successful 4624 is suspicious for password spraying against remote workforce. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting customer projects.
Incorrect Answers
B:RDP logs show distributed username spray and later single successful 4624 is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
C:The legitimate comparator is legitimate employee reconnects are tied to known device certificates and individual logon failures; it does not establish that the current event came from the same approved identity or workflow.
D:An intrusion can begin on one asset. The specific indicator on remote desktop gateway warrants its own validation before expanding or closing the investigation.
Question 524
At Professional services firm, analysts monitor remote desktop gateway. They observe that one IP attempts passwords for 34 accounts but never exceeds three attempts per account. Evidence: RDP logs show distributed username spray and later single successful 4624. A separate known-good explanation is: legitimate employee reconnects are tied to known device certificates and individual logon failures. Which next analysis most reliably determines what caused the observed event?
- Perform a scoped investigation: aggregate failures by source and unique username rather than per-user threshold
- Accept a public reputation score for the destination as proof of the origin of RDP logs show distributed username spray and later single successful 4624, without using aggregate failures by source and unique username rather than per-user threshold
- Summarize RDP logs show distributed username spray and later single successful 4624 into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on remote desktop gateway while waiting for the connection pattern to stop
Explanation
Correct Answer
A:Aggregate failures by source and unique username rather than per-user threshold ties the evidence on remote desktop gateway to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: legitimate employee reconnects are tied to known device certificates and individual logon failures.
Incorrect Answers
B:A reputation score may inform triage but cannot establish the origin of RDP logs show distributed username spray and later single successful 4624 or whether the activity matches legitimate employee reconnects are tied to known device certificates and individual logon failures.
C:The original RDP logs show distributed username spray and later single successful 4624 must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:Suppressing telemetry destroys the source needed to investigate password spraying against remote workforce and may conceal further actions.
Question 525
Professional services firm has a candidate alert for remote desktop gateway: RDP logs show distributed username spray and later single successful 4624. The team argues it is harmless because legitimate employee reconnects are tied to known device certificates and individual logon failures. What is the most defensible false-positive assessment?
- Distinguish RDP logs show distributed username spray and later single successful 4624 from the approved behavior (legitimate employee reconnects are tied to known device certificates and individual logon failures) by validating process, identity and time attribution
- Interpret an absence of existing vendor signatures as proof that one IP attempts passwords for 34 accounts but never exceeds three attempts per account is benign
- Automatically treat every event resembling RDP logs show distributed username spray and later single successful 4624 as confirmed compromise of remote desktop gateway, without checking provenance
- Create a blanket suppression for RDP logs show distributed username spray and later single successful 4624 because legitimate employee reconnects are tied to known device certificates and individual logon failures can produce a superficially similar event
Explanation
Correct Answer
A:Legitimate employee reconnects are tied to known device certificates and individual logon failures is a plausible alternative, but it must be proven to match the actual source of RDP logs show distributed username spray and later single successful 4624. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
B:Absence of a signature does not refute the concrete behavior: one IP attempts passwords for 34 accounts but never exceeds three attempts per account.
C:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting customer projects.
D:Similarity to legitimate employee reconnects are tied to known device certificates and individual logon failures does not exclude an attacker from producing the same surface event on remote desktop gateway.
Question 526
At Professional services firm, analysts monitor remote desktop gateway. They observe that one IP attempts passwords for 34 accounts but never exceeds three attempts per account. Evidence: RDP logs show distributed username spray and later single successful 4624. The team confirms unauthorized behavior and must protect customer projects; legitimate service continuity remains necessary. Which containment decision is best?
- Erase RDP logs show distributed username spray and later single successful 4624 from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on remote desktop gateway unrestricted until actual losses of customer projects can be measured
- Disable every production service at Professional services firm without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: rate-limit and block source session plus challenge exposed accounts without locking out all staff
Explanation
Correct Answer
D:Rate-limit and block source session plus challenge exposed accounts without locking out all staff constrains the observed threat while maintaining necessary service for customer projects. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Eliminating RDP logs show distributed username spray and later single successful 4624 evidence does not contain password spraying against remote workforce and impairs forensic reconstruction.
B:Once unauthorized behavior is confirmed on remote desktop gateway, delaying containment could expand the exposure affecting customer projects.
C:Global shutdown could disrupt customer projects without evidence that every system has been affected; scoped isolation is more proportionate.
Question 527
Professional services firm receives a three-month-old threat-intelligence bulletin associating an observable with password spraying against remote workforce. On remote desktop gateway, local telemetry reports: RDP logs show distributed username spray and later single successful 4624. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Assess bulletin timeliness and provenance, then corroborate its observables against RDP logs show distributed username spray and later single successful 4624 and affected remote desktop gateway
- Rank the bulletin critical solely because it mentions password spraying against remote workforce, without checking whether its observable is present on remote desktop gateway
- Dismiss the bulletin solely because Professional services firm has not named the attacker associated with RDP logs show distributed username spray and later single successful 4624
- Forward the bulletin about password spraying against remote workforce as a confirmed breach of remote desktop gateway without hosts, timestamps or confidence caveats
Explanation
Correct Answer
A:An old feed with unknown confidence is not automatic proof of activity at Professional services firm. Comparing its timestamps and provenance with RDP logs show distributed username spray and later single successful 4624 reveals whether the indicator is still relevant to remote desktop gateway and customer projects.
Incorrect Answers
B:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual RDP logs show distributed username spray and later single successful 4624.
C:Actor attribution is not required to assess a supported technique, source confidence or relevance to remote desktop gateway.
D:Converting the unverified feed into confirmed activity on remote desktop gateway may mislead investigators and prompt harmful response for customer projects.
Question 528
Professional services firm has investigated password spraying against remote workforce on remote desktop gateway. Detection operators report that legitimate employee reconnects are tied to known device certificates and individual logon failures; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on remote desktop gateway whether or not it matches detect high distinct-username failures before one success with device trust anomalies
- Improve detection by requiring context-aware correlation: detect high distinct-username failures before one success with device trust anomalies
- Automate service shutdown on the first simple match to one IP attempts passwords for 34 accounts but never exceeds three attempts per account, without validation or guardrails for customer projects
- Suppress every future event associated with RDP logs show distributed username spray and later single successful 4624, including events outside legitimate employee reconnects are tied to known device certificates and individual logon failures
Explanation
Correct Answer
B:Detect high distinct-username failures before one success with device trust anomalies retains the specific threat signal while discriminating against legitimate employee reconnects are tied to known device certificates and individual logon failures. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing legitimate employee reconnects are tied to known device certificates and individual logon failures from malicious conditions would increase noise and operational workload.
C:An untested, unqualified automation could interrupt customer projects and cannot distinguish the benign workflow from attacker behavior.
D:Suppressing all monitoring would also hide a recurrence of password spraying against remote workforce, even where it threatens customer projects.
Question 529
At Cloud hosting provider, the security team assesses metadata proxy. The current issue is SSRF permits requests to cloud metadata service; assessment evidence states: security tester safely reproduces internal HTTP request via URL input. The service is public image fetch endpoint on VM. Operational constraints: image processing latency SLO limits network proxy. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across metadata proxy during image processing latency SLO limits network proxy instead of using a scoped test
- Accept the label SSRF permits requests to cloud metadata service as confirmed without checking the reported evidence security tester safely reproduces internal HTTP request via URL input or actual deployment
- Use an authorized, scoped validation approach that considers service sensitivity: verify metadata hop limits and proxy egress under controlled canary
- Use only an anonymous outside-in scan of metadata proxy even when public image fetch endpoint on VM requires authenticated deployment context
Explanation
Correct Answer
C:The evidence security tester safely reproduces internal HTTP request via URL input must be evaluated without violating the constraint image processing latency SLO limits network proxy. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because image processing latency SLO limits network proxy; authorization and scope are prerequisites.
B:The finding does not establish which live component is affected or whether the exposure public image fetch endpoint on VM is real.
D:Asset configuration and the constraints of metadata proxy matter; external findings alone may misstate or miss the exposed path.
Question 530
At Cloud hosting provider, the security team assesses metadata proxy. The current issue is SSRF permits requests to cloud metadata service; assessment evidence states: security tester safely reproduces internal HTTP request via URL input. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Confirm the reported condition in the relevant asset context: verify metadata hop limits and proxy egress under controlled canary
- Mark security tester safely reproduces internal HTTP request via URL input resolved or confirmed solely from the scanner severity without verify metadata hop limits and proxy egress under controlled canary
- Force a destructive proof-of-concept against metadata proxy, ignoring that image processing latency SLO limits network proxy and a safer validation exist
- Assume metadata proxy is safe because another platform with similar software recently passed its own assessment
Explanation
Correct Answer
A:Verify metadata hop limits and proxy egress under controlled canary tests the reported condition security tester safely reproduces internal HTTP request via URL input against actual deployment context (public image fetch endpoint on VM). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
B:security tester safely reproduces internal HTTP request via URL input may be accurate but its actual occurrence and configuration on metadata proxy must be established before calling it validated.
C:A destructive proof is unnecessary when verify metadata hop limits and proxy egress under controlled canary can provide authorized evidence and image processing latency SLO limits network proxy constrains production testing.
D:Security of an unrelated host cannot establish the state of metadata proxy, whose reported issue is SSRF permits requests to cloud metadata service.
