CompTIA CS0-003 Practice Test 57
Question 560
At Printing fulfillment service, analysts monitor document rendering servers. They observe that backup catalogs and shadow copies are deleted immediately before rapid file extensions change. Evidence: EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process. A separate known-good explanation is: legitimate backup retention agents use signed workflows and scheduled maintenance identities. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process, without using correlate shadow deletion, process signer and file-modification rate
- Perform a scoped investigation: correlate shadow deletion, process signer and file-modification rate
- Summarize EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on document rendering servers while waiting for the connection pattern to stop
Explanation
Correct Answer
B:Correlate shadow deletion, process signer and file-modification rate ties the evidence on document rendering servers to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: legitimate backup retention agents use signed workflows and scheduled maintenance identities.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process or whether the activity matches legitimate backup retention agents use signed workflows and scheduled maintenance identities.
C:The original EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:Suppressing telemetry destroys the source needed to investigate ransomware behavior preceding broad encryption and may conceal further actions.
Question 561
Printing fulfillment service has a candidate alert for document rendering servers: EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process. The team argues it is harmless because legitimate backup retention agents use signed workflows and scheduled maintenance identities. What is the most defensible false-positive assessment?
- Automatically treat every event resembling EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process as confirmed compromise of document rendering servers, without checking provenance
- Distinguish EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process from the approved behavior (legitimate backup retention agents use signed workflows and scheduled maintenance identities) by validating process, identity and time attribution
- Interpret an absence of existing vendor signatures as proof that backup catalogs and shadow copies are deleted immediately before rapid file extensions change is benign
- Create a blanket suppression for EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process because legitimate backup retention agents use signed workflows and scheduled maintenance identities can produce a superficially similar event
Explanation
Correct Answer
B:Legitimate backup retention agents use signed workflows and scheduled maintenance identities is a plausible alternative, but it must be proven to match the actual source of EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting customer document availability.
C:Absence of a signature does not refute the concrete behavior: backup catalogs and shadow copies are deleted immediately before rapid file extensions change.
D:Similarity to legitimate backup retention agents use signed workflows and scheduled maintenance identities does not exclude an attacker from producing the same surface event on document rendering servers.
Question 562
At Printing fulfillment service, analysts monitor document rendering servers. They observe that backup catalogs and shadow copies are deleted immediately before rapid file extensions change. Evidence: EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process. The team confirms unauthorized behavior and must protect customer document availability; legitimate service continuity remains necessary. Which containment decision is best?
- Apply targeted containment: isolate affected renderer nodes and protect clean backup stores before attempting recovery
- Erase EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process from the evidence archive during the containment change to reduce repeated alerts
- Disable every production service at Printing fulfillment service without measuring whether its dependencies share the observed malicious path
- Leave the confirmed unauthorized activity on document rendering servers unrestricted until actual losses of customer document availability can be measured
Explanation
Correct Answer
A:Isolate affected renderer nodes and protect clean backup stores before attempting recovery constrains the observed threat while maintaining necessary service for customer document availability. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
B:Eliminating EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process evidence does not contain ransomware behavior preceding broad encryption and impairs forensic reconstruction.
C:Global shutdown could disrupt customer document availability without evidence that every system has been affected; scoped isolation is more proportionate.
D:Once unauthorized behavior is confirmed on document rendering servers, delaying containment could expand the exposure affecting customer document availability.
Question 563
Printing fulfillment service receives a three-month-old threat-intelligence bulletin associating an observable with ransomware behavior preceding broad encryption. On document rendering servers, local telemetry reports: EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions ransomware behavior preceding broad encryption, without checking whether its observable is present on document rendering servers
- Dismiss the bulletin solely because Printing fulfillment service has not named the attacker associated with EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process
- Assess bulletin timeliness and provenance, then corroborate its observables against EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process and affected document rendering servers
- Forward the bulletin about ransomware behavior preceding broad encryption as a confirmed breach of document rendering servers without hosts, timestamps or confidence caveats
Explanation
Correct Answer
C:An old feed with unknown confidence is not automatic proof of activity at Printing fulfillment service. Comparing its timestamps and provenance with EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process reveals whether the indicator is still relevant to document rendering servers and customer document availability.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process.
B:Actor attribution is not required to assess a supported technique, source confidence or relevance to document rendering servers.
D:Converting the unverified feed into confirmed activity on document rendering servers may mislead investigators and prompt harmful response for customer document availability.
Question 564
Printing fulfillment service has investigated ransomware behavior preceding broad encryption on document rendering servers. Detection operators report that legitimate backup retention agents use signed workflows and scheduled maintenance identities; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to backup catalogs and shadow copies are deleted immediately before rapid file extensions change, without validation or guardrails for customer document availability
- Suppress every future event associated with EDR shows vssadmin Delete Shadows and mass rename operations by a nonbackup process, including events outside legitimate backup retention agents use signed workflows and scheduled maintenance identities
- Improve detection by requiring context-aware correlation: combine backup-deletion commands with rapid file changes by untrusted processes
- Assign critical severity to every routine activity on document rendering servers whether or not it matches combine backup-deletion commands with rapid file changes by untrusted processes
Explanation
Correct Answer
C:Combine backup-deletion commands with rapid file changes by untrusted processes retains the specific threat signal while discriminating against legitimate backup retention agents use signed workflows and scheduled maintenance identities. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt customer document availability and cannot distinguish the benign workflow from attacker behavior.
B:Suppressing all monitoring would also hide a recurrence of ransomware behavior preceding broad encryption, even where it threatens customer document availability.
D:Alert severity without distinguishing legitimate backup retention agents use signed workflows and scheduled maintenance identities from malicious conditions would increase noise and operational workload.
Question 565
At Industrial supplier, the security team assesses segmented lab server. The current issue is high base CVSS issue on offline test host; assessment evidence states: scanner reports critical severity with remote vector. The service is host physically isolated and scheduled for retirement. Operational constraints: production WAN gateway has lower-scored but exploited bug. Which assessment approach is most appropriate before recommending a fix?
- Accept the label high base CVSS issue on offline test host as confirmed without checking the reported evidence scanner reports critical severity with remote vector or actual deployment
- Launch unapproved intrusive exploitation across segmented lab server during production WAN gateway has lower-scored but exploited bug instead of using a scoped test
- Use an authorized, scoped validation approach that considers service sensitivity: validate actual paths, users, and security boundary before prioritizing
- Use only an anonymous outside-in scan of segmented lab server even when host physically isolated and scheduled for retirement requires authenticated deployment context
Explanation
Correct Answer
C:The evidence scanner reports critical severity with remote vector must be evaluated without violating the constraint production WAN gateway has lower-scored but exploited bug. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:The finding does not establish which live component is affected or whether the exposure host physically isolated and scheduled for retirement is real.
B:Uncontrolled testing may breach service safety, especially because production WAN gateway has lower-scored but exploited bug; authorization and scope are prerequisites.
D:Asset configuration and the constraints of segmented lab server matter; external findings alone may misstate or miss the exposed path.
Question 566
At Industrial supplier, the security team assesses segmented lab server. The current issue is high base CVSS issue on offline test host; assessment evidence states: scanner reports critical severity with remote vector. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Force a destructive proof-of-concept against segmented lab server, ignoring that production WAN gateway has lower-scored but exploited bug and a safer validation exist
- Assume segmented lab server is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: validate actual paths, users, and security boundary before prioritizing
- Mark scanner reports critical severity with remote vector resolved or confirmed solely from the scanner severity without validate actual paths, users, and security boundary before prioritizing
Explanation
Correct Answer
C:Validate actual paths, users, and security boundary before prioritizing tests the reported condition scanner reports critical severity with remote vector against actual deployment context (host physically isolated and scheduled for retirement). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:A destructive proof is unnecessary when validate actual paths, users, and security boundary before prioritizing can provide authorized evidence and production WAN gateway has lower-scored but exploited bug constrains production testing.
B:Security of an unrelated host cannot establish the state of segmented lab server, whose reported issue is high base CVSS issue on offline test host.
D:scanner reports critical severity with remote vector may be accurate but its actual occurrence and configuration on segmented lab server must be established before calling it validated.
Question 567
Industrial supplier has two findings: a critical base CVSS issue on segmented lab server that is physically isolated and scheduled for retirement, and a lower-scored but actively exploited vulnerability on the production WAN gateway. Which should be prioritized first?
- Automatically fix the isolated segmented lab server first solely because its base CVSS number is higher
- Choose whichever finding was scanned most recently, without assessing exploit evidence
- Prioritize the exploited, internet-reachable production WAN gateway despite its lower base severity, then schedule the isolated lab retirement
- Give both the isolated lab issue and actively exploited production gateway the same priority deadline
Explanation
Correct Answer
C:Active exploitation and public reachability of the production gateway outweigh a higher theoretical base score on the isolated, retiring lab host; prioritization follows actual threat and business exposure.
Incorrect Answers
A:The segmented lab server has no comparable reachable attack path; the production gateway has verified exploitation and should be treated first.
B:Scanner detection time does not outrank current attacks on the production gateway.
D:Uniform response dates ignore the substantial differences in reachability, attacker activity and service importance.
Question 568
At Industrial supplier, the security team assesses segmented lab server. The current issue is high base CVSS issue on offline test host; assessment evidence states: scanner reports critical severity with remote vector. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Leave high base CVSS issue on offline test host present indefinitely because no incident involving lab integrity versus production risk was recorded this week
- Sign an exception document but do not implement or test decommission vulnerable test host under owner plan on segmented lab server
- Use monitor lab isolation until removal as permanent closure of the confirmed issue instead of deploying decommission vulnerable test host under owner plan
- Implement and verify the root-cause fix: decommission vulnerable test host under owner plan
Explanation
Correct Answer
D:Decommission vulnerable test host under owner plan targets the mechanism high base CVSS issue on offline test host rather than only filtering symptoms. Verification must account for scanner reports critical severity with remote vector and continued protection of lab integrity versus production risk.
Incorrect Answers
A:No observed attack does not correct the verified condition scanner reports critical severity with remote vector or eliminate its potential impact on lab integrity versus production risk.
B:Risk acceptance paperwork does not itself remediate high base CVSS issue on offline test host on segmented lab server; authorized, tested implementation is still required when the risk exceeds tolerance.
C:The interim control may reduce exposure, but it can leave the underlying high base CVSS issue on offline test host and should be time-limited with verification and owner oversight.
Question 569
At Industrial supplier, the security team assesses segmented lab server. The current issue is high base CVSS issue on offline test host; assessment evidence states: scanner reports critical severity with remote vector. A permanent correction cannot be deployed immediately because production WAN gateway has lower-scored but exploited bug. Which interim treatment is the safest governed option?
- Accept continued exposure of lab integrity versus production risk without any owner, expiry or compensating verification because production WAN gateway has lower-scored but exploited bug
- Push decommission vulnerable test host under owner plan immediately to all production systems with no safe change window despite production WAN gateway has lower-scored but exploited bug
- Apply a time-bound compensating measure, monitor lab isolation until removal, record the residual risk owner and schedule the tested permanent fix
- Claim high base CVSS issue on offline test host is patched when the change ticket opens, without confirming monitor lab isolation until removal or a planned permanent change
Explanation
Correct Answer
C:Monitor lab isolation until removal can reduce short-term exposure while production WAN gateway has lower-scored but exploited bug delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because lab integrity versus production risk remains at stake.
Incorrect Answers
A:Business criticality increases the need for accountable decisions and review; it does not make lab integrity versus production risk irrelevant.
B:Ignoring production WAN gateway has lower-scored but exploited bug could cause avoidable service failure and is not a risk-aware remediation process.
D:A work item is not proof that high base CVSS issue on offline test host was corrected or even that monitor lab isolation until removal operates.
Question 570
Industrial supplier has formally retired the vulnerable segmented lab server rather than applying a software patch. What closure evidence would establish the unsupported service is no longer exposed?
- Mark decommission complete when the change request is approved, even while the lab host remains reachable
- Suppress the critical scanner finding on the dashboard without verifying that the offline test host was actually retired
- Use a clean scan from an unrelated production gateway as proof that the retired laboratory system was shut down
- Validate the segmented lab server is removed from active inventory, compute and network routes and verify approved decommission evidence
Explanation
Correct Answer
D:A decommissioned host cannot pass an ordinary postpatch scanner probe. Inventory, reachability and signed removal evidence establish that the affected asset is actually out of service.
Incorrect Answers
A:Approval initiates removal but does not prove the vulnerable retired service is absent from network routes and asset inventory.
B:A suppression rule changes visibility, not reachability; the host might still be running and exposed.
C:A different asset has no evidentiary bearing on whether this exact lab host was removed from service.
