CompTIA CS0-003 Practice Test 55
Question 540
Banking API provider has investigated credential exposure and function misuse for outbound transfer on serverless transaction function. Detection operators report that legitimate secrets are retrieved from a managed vault under a workload identity; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to a new environment variable contains a bearer secret and outbound requests spike to an unapproved collector, without validation or guardrails for payment service confidentiality
- Assign critical severity to every routine activity on serverless transaction function whether or not it matches detect plaintext secret injection combined with off-allowlist function egress
- Improve detection by requiring context-aware correlation: detect plaintext secret injection combined with off-allowlist function egress
- Suppress every future event associated with cloud function audit records plaintext secret change followed by outbound invoke events, including events outside legitimate secrets are retrieved from a managed vault under a workload identity
Explanation
Correct Answer
C:Detect plaintext secret injection combined with off-allowlist function egress retains the specific threat signal while discriminating against legitimate secrets are retrieved from a managed vault under a workload identity. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt payment service confidentiality and cannot distinguish the benign workflow from attacker behavior.
B:Alert severity without distinguishing legitimate secrets are retrieved from a managed vault under a workload identity from malicious conditions would increase noise and operational workload.
D:Suppressing all monitoring would also hide a recurrence of credential exposure and function misuse for outbound transfer, even where it threatens payment service confidentiality.
Question 541
At Financial application, the security team assesses static code scan. The current issue is hardcoded DB password found in source history; assessment evidence states: SAST reports string with verified credential pattern. The service is private repo copied to contractor build server. Operational constraints: legacy service config still reads environment variable. Which assessment approach is most appropriate before recommending a fix?
- Use only an anonymous outside-in scan of static code scan even when private repo copied to contractor build server requires authenticated deployment context
- Launch unapproved intrusive exploitation across static code scan during legacy service config still reads environment variable instead of using a scoped test
- Use an authorized, scoped validation approach that considers service sensitivity: confirm active credential via vault metadata and usage audit
- Accept the label hardcoded DB password found in source history as confirmed without checking the reported evidence SAST reports string with verified credential pattern or actual deployment
Explanation
Correct Answer
C:The evidence SAST reports string with verified credential pattern must be evaluated without violating the constraint legacy service config still reads environment variable. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Asset configuration and the constraints of static code scan matter; external findings alone may misstate or miss the exposed path.
B:Uncontrolled testing may breach service safety, especially because legacy service config still reads environment variable; authorization and scope are prerequisites.
D:The finding does not establish which live component is affected or whether the exposure private repo copied to contractor build server is real.
Question 542
At Financial application, the security team assesses static code scan. The current issue is hardcoded DB password found in source history; assessment evidence states: SAST reports string with verified credential pattern. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Assume static code scan is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: confirm active credential via vault metadata and usage audit
- Mark SAST reports string with verified credential pattern resolved or confirmed solely from the scanner severity without confirm active credential via vault metadata and usage audit
- Force a destructive proof-of-concept against static code scan, ignoring that legacy service config still reads environment variable and a safer validation exist
Explanation
Correct Answer
B:Confirm active credential via vault metadata and usage audit tests the reported condition SAST reports string with verified credential pattern against actual deployment context (private repo copied to contractor build server). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:Security of an unrelated host cannot establish the state of static code scan, whose reported issue is hardcoded DB password found in source history.
C:SAST reports string with verified credential pattern may be accurate but its actual occurrence and configuration on static code scan must be established before calling it validated.
D:A destructive proof is unnecessary when confirm active credential via vault metadata and usage audit can provide authorized evidence and legacy service config still reads environment variable constrains production testing.
Question 543
At Financial application, the security team assesses static code scan. The current issue is hardcoded DB password found in source history; assessment evidence states: SAST reports string with verified credential pattern. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Prioritize the confirmed exposure of static code scan, accounting for transaction data protection and the real access path: private repo copied to contractor build server
- Give every vulnerability the same deadline despite hardcoded DB password found in source history and business impact on transaction data protection
- Choose whatever finding on static code scan was logged most recently, regardless of actual exploit path or priority
- Choose the highest nominal scanner severity first while ignoring private repo copied to contractor build server and the consequence to transaction data protection
Explanation
Correct Answer
A:Risk depends on practical reachability, threat activity and consequence. The issue hardcoded DB password found in source history can affect transaction data protection through private repo copied to contractor build server; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
B:Uniform priority ignores private repo copied to contractor build server, operational harm and transaction data protection; documented context makes triage defensible.
C:Discovery order is not evidence of urgency compared with the actual affected static code scan.
D:CVSS describes technical characteristics, not the entirety of exposure and transaction data protection for this deployment.
Question 544
At Financial application, the security team assesses static code scan. The current issue is hardcoded DB password found in source history; assessment evidence states: SAST reports string with verified credential pattern. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Implement and verify the root-cause fix: move secret to vault, rotate password and remove code reference
- Leave hardcoded DB password found in source history present indefinitely because no incident involving transaction data protection was recorded this week
- Sign an exception document but do not implement or test move secret to vault, rotate password and remove code reference on static code scan
- Use revoke compromised credential at database as permanent closure of the confirmed issue instead of deploying move secret to vault, rotate password and remove code reference
Explanation
Correct Answer
A:Move secret to vault, rotate password and remove code reference targets the mechanism hardcoded DB password found in source history rather than only filtering symptoms. Verification must account for SAST reports string with verified credential pattern and continued protection of transaction data protection.
Incorrect Answers
B:No observed attack does not correct the verified condition SAST reports string with verified credential pattern or eliminate its potential impact on transaction data protection.
C:Risk acceptance paperwork does not itself remediate hardcoded DB password found in source history on static code scan; authorized, tested implementation is still required when the risk exceeds tolerance.
D:The interim control may reduce exposure, but it can leave the underlying hardcoded DB password found in source history and should be time-limited with verification and owner oversight.
Question 545
At Financial application, the security team assesses static code scan. The current issue is hardcoded DB password found in source history; assessment evidence states: SAST reports string with verified credential pattern. A permanent correction cannot be deployed immediately because legacy service config still reads environment variable. Which interim treatment is the safest governed option?
- Claim hardcoded DB password found in source history is patched when the change ticket opens, without confirming revoke compromised credential at database or a planned permanent change
- Apply a time-bound compensating measure, revoke compromised credential at database, record the residual risk owner and schedule the tested permanent fix
- Push move secret to vault, rotate password and remove code reference immediately to all production systems with no safe change window despite legacy service config still reads environment variable
- Accept continued exposure of transaction data protection without any owner, expiry or compensating verification because legacy service config still reads environment variable
Explanation
Correct Answer
B:Revoke compromised credential at database can reduce short-term exposure while legacy service config still reads environment variable delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because transaction data protection remains at stake.
Incorrect Answers
A:A work item is not proof that hardcoded DB password found in source history was corrected or even that revoke compromised credential at database operates.
C:Ignoring legacy service config still reads environment variable could cause avoidable service failure and is not a risk-aware remediation process.
D:Business criticality increases the need for accountable decisions and review; it does not make transaction data protection irrelevant.
Question 546
At Financial application, the security team assesses static code scan. The current issue is hardcoded DB password found in source history; assessment evidence states: SAST reports string with verified credential pattern. The owner reports that move secret to vault, rotate password and remove code reference has been deployed. What evidence should close the vulnerability item?
- Suppress future results for hardcoded DB password found in source history so that the vulnerability dashboard shows a completed remediation
- Close SAST reports string with verified credential pattern after the deployment tool returns success, without verifying the current state of static code scan
- Use an unrelated server’s clean findings to claim static code scan is fixed without retesting the affected path
- Retest the originally affected configuration using confirm active credential via vault metadata and usage audit, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by SAST reports string with verified credential pattern, plus regression impact on static code scan. A change ticket alone is not proof of removal of hardcoded DB password found in source history.
Incorrect Answers
A:Suppression may hide a failed or incomplete fix, leaving transaction data protection exposed despite the administrative record.
B:Process completion is not evidence that SAST reports string with verified credential pattern no longer applies to static code scan.
C:The result must be tied to static code scan and the actual exposure: private repo copied to contractor build server.
Question 547
At Hospital security operations, analysts monitor SOAR quarantine playbook. They observe that an enrichment webhook classifies all unrecognized IPs as hostile and quarantines nurse workstations. Evidence: SOAR action logs show automatic isolation without asset criticality or analyst review. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Announce that SOAR action logs show automatic isolation without asset criticality or analyst review conclusively proves theft of patient care continuity before reviewing any sessions or file access
- Treat the pattern as a hypothesis of overbroad automation causing operational harm despite ambiguous indicators and begin corroborating it with endpoint and network evidence
- Downgrade an enrichment webhook classifies all unrecognized IPs as hostile and quarantines nurse workstations solely because the same symptom has not yet appeared on another endpoint
- Treat approved playbooks have a staging test and clinical high-impact host exception as conclusive authorization for the current event without matching process or identity
Explanation
Correct Answer
B:The combination of an enrichment webhook classifies all unrecognized IPs as hostile and quarantines nurse workstations and SOAR action logs show automatic isolation without asset criticality or analyst review is suspicious for overbroad automation causing operational harm despite ambiguous indicators. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting patient care continuity.
Incorrect Answers
A:SOAR action logs show automatic isolation without asset criticality or analyst review is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
C:An intrusion can begin on one asset. The specific indicator on SOAR quarantine playbook warrants its own validation before expanding or closing the investigation.
D:The legitimate comparator is approved playbooks have a staging test and clinical high-impact host exception; it does not establish that the current event came from the same approved identity or workflow.
Question 548
At Hospital security operations, analysts monitor SOAR quarantine playbook. They observe that an enrichment webhook classifies all unrecognized IPs as hostile and quarantines nurse workstations. Evidence: SOAR action logs show automatic isolation without asset criticality or analyst review. A separate known-good explanation is: approved playbooks have a staging test and clinical high-impact host exception. Which next analysis most reliably determines what caused the observed event?
- Perform a scoped investigation: compare enrichment confidence, asset inventory and isolation approval logs
- Accept a public reputation score for the destination as proof of the origin of SOAR action logs show automatic isolation without asset criticality or analyst review, without using compare enrichment confidence, asset inventory and isolation approval logs
- Suspend telemetry collection on SOAR quarantine playbook while waiting for the connection pattern to stop
- Summarize SOAR action logs show automatic isolation without asset criticality or analyst review into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
A:Compare enrichment confidence, asset inventory and isolation approval logs ties the evidence on SOAR quarantine playbook to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved playbooks have a staging test and clinical high-impact host exception.
Incorrect Answers
B:A reputation score may inform triage but cannot establish the origin of SOAR action logs show automatic isolation without asset criticality or analyst review or whether the activity matches approved playbooks have a staging test and clinical high-impact host exception.
C:Suppressing telemetry destroys the source needed to investigate overbroad automation causing operational harm despite ambiguous indicators and may conceal further actions.
D:The original SOAR action logs show automatic isolation without asset criticality or analyst review must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 549
Hospital security operations has a candidate alert for SOAR quarantine playbook: SOAR action logs show automatic isolation without asset criticality or analyst review. The team argues it is harmless because approved playbooks have a staging test and clinical high-impact host exception. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that an enrichment webhook classifies all unrecognized IPs as hostile and quarantines nurse workstations is benign
- Distinguish SOAR action logs show automatic isolation without asset criticality or analyst review from the approved behavior (approved playbooks have a staging test and clinical high-impact host exception) by validating process, identity and time attribution
- Create a blanket suppression for SOAR action logs show automatic isolation without asset criticality or analyst review because approved playbooks have a staging test and clinical high-impact host exception can produce a superficially similar event
- Automatically treat every event resembling SOAR action logs show automatic isolation without asset criticality or analyst review as confirmed compromise of SOAR quarantine playbook, without checking provenance
Explanation
Correct Answer
B:Approved playbooks have a staging test and clinical high-impact host exception is a plausible alternative, but it must be proven to match the actual source of SOAR action logs show automatic isolation without asset criticality or analyst review. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: an enrichment webhook classifies all unrecognized IPs as hostile and quarantines nurse workstations.
C:Similarity to approved playbooks have a staging test and clinical high-impact host exception does not exclude an attacker from producing the same surface event on SOAR quarantine playbook.
D:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting patient care continuity.
Question 550
At Hospital security operations, analysts monitor SOAR quarantine playbook. They observe that an enrichment webhook classifies all unrecognized IPs as hostile and quarantines nurse workstations. Evidence: SOAR action logs show automatic isolation without asset criticality or analyst review. The team confirms unauthorized behavior and must protect patient care continuity; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: pause automatic isolation for high-impact clinical devices and require analyst authorization
- Disable every production service at Hospital security operations without measuring whether its dependencies share the observed malicious path
- Leave the confirmed unauthorized activity on SOAR quarantine playbook unrestricted until actual losses of patient care continuity can be measured
- Erase SOAR action logs show automatic isolation without asset criticality or analyst review from the evidence archive during the containment change to reduce repeated alerts
Explanation
Correct Answer
A:Pause automatic isolation for high-impact clinical devices and require analyst authorization constrains the observed threat while maintaining necessary service for patient care continuity. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Global shutdown could disrupt patient care continuity without evidence that every system has been affected; scoped isolation is more proportionate.
C:Once unauthorized behavior is confirmed on SOAR quarantine playbook, delaying containment could expand the exposure affecting patient care continuity.
D:Eliminating SOAR action logs show automatic isolation without asset criticality or analyst review evidence does not contain overbroad automation causing operational harm despite ambiguous indicators and impairs forensic reconstruction.
