CompTIA CS0-003 Practice Test 58
Question 570
Industrial supplier has formally retired the vulnerable segmented lab server rather than applying a software patch. What closure evidence would establish the unsupported service is no longer exposed?
- Mark decommission complete when the change request is approved, even while the lab host remains reachable
- Suppress the critical scanner finding on the dashboard without verifying that the offline test host was actually retired
- Use a clean scan from an unrelated production gateway as proof that the retired laboratory system was shut down
- Validate the segmented lab server is removed from active inventory, compute and network routes and verify approved decommission evidence
Explanation
Correct Answer
D:A decommissioned host cannot pass an ordinary postpatch scanner probe. Inventory, reachability and signed removal evidence establish that the affected asset is actually out of service.
Incorrect Answers
A:Approval initiates removal but does not prove the vulnerable retired service is absent from network routes and asset inventory.
B:A suppression rule changes visibility, not reachability; the host might still be running and exposed.
C:A different asset has no evidentiary bearing on whether this exact lab host was removed from service.
Question 571
At University admissions, analysts monitor registrar endpoint. They observe that a removable drive receives hundreds of student records during lunch break. Evidence: device control logs record unapproved USB serial and bulk CSV copy. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Announce that device control logs record unapproved USB serial and bulk CSV copy conclusively proves theft of applicant personal data before reviewing any sessions or file access
- Treat authorized archival exports are encrypted and run to managed storage under signed ticket as conclusive authorization for the current event without matching process or identity
- Downgrade a removable drive receives hundreds of student records during lunch break solely because the same symptom has not yet appeared on another endpoint
- Treat the pattern as a hypothesis of potential insider data removal to unmanaged removable media and begin corroborating it with endpoint and network evidence
Explanation
Correct Answer
D:The combination of a removable drive receives hundreds of student records during lunch break and device control logs record unapproved USB serial and bulk CSV copy is suspicious for potential insider data removal to unmanaged removable media. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting applicant personal data.
Incorrect Answers
A:device control logs record unapproved USB serial and bulk CSV copy is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
B:The legitimate comparator is authorized archival exports are encrypted and run to managed storage under signed ticket; it does not establish that the current event came from the same approved identity or workflow.
C:An intrusion can begin on one asset. The specific indicator on registrar endpoint warrants its own validation before expanding or closing the investigation.
Question 572
At University admissions, analysts monitor registrar endpoint. They observe that a removable drive receives hundreds of student records during lunch break. Evidence: device control logs record unapproved USB serial and bulk CSV copy. A separate known-good explanation is: authorized archival exports are encrypted and run to managed storage under signed ticket. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of device control logs record unapproved USB serial and bulk CSV copy, without using correlate device serial, file audit event and export authorization
- Summarize device control logs record unapproved USB serial and bulk CSV copy into a ticket and discard underlying event identifiers before correlation
- Perform a scoped investigation: correlate device serial, file audit event and export authorization
- Suspend telemetry collection on registrar endpoint while waiting for the connection pattern to stop
Explanation
Correct Answer
C:Correlate device serial, file audit event and export authorization ties the evidence on registrar endpoint to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: authorized archival exports are encrypted and run to managed storage under signed ticket.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of device control logs record unapproved USB serial and bulk CSV copy or whether the activity matches authorized archival exports are encrypted and run to managed storage under signed ticket.
B:The original device control logs record unapproved USB serial and bulk CSV copy must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:Suppressing telemetry destroys the source needed to investigate potential insider data removal to unmanaged removable media and may conceal further actions.
Question 573
University admissions has a candidate alert for registrar endpoint: device control logs record unapproved USB serial and bulk CSV copy. The team argues it is harmless because authorized archival exports are encrypted and run to managed storage under signed ticket. What is the most defensible false-positive assessment?
- Create a blanket suppression for device control logs record unapproved USB serial and bulk CSV copy because authorized archival exports are encrypted and run to managed storage under signed ticket can produce a superficially similar event
- Distinguish device control logs record unapproved USB serial and bulk CSV copy from the approved behavior (authorized archival exports are encrypted and run to managed storage under signed ticket) by validating process, identity and time attribution
- Automatically treat every event resembling device control logs record unapproved USB serial and bulk CSV copy as confirmed compromise of registrar endpoint, without checking provenance
- Interpret an absence of existing vendor signatures as proof that a removable drive receives hundreds of student records during lunch break is benign
Explanation
Correct Answer
B:Authorized archival exports are encrypted and run to managed storage under signed ticket is a plausible alternative, but it must be proven to match the actual source of device control logs record unapproved USB serial and bulk CSV copy. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Similarity to authorized archival exports are encrypted and run to managed storage under signed ticket does not exclude an attacker from producing the same surface event on registrar endpoint.
C:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting applicant personal data.
D:Absence of a signature does not refute the concrete behavior: a removable drive receives hundreds of student records during lunch break.
Question 574
At University admissions, analysts monitor registrar endpoint. They observe that a removable drive receives hundreds of student records during lunch break. Evidence: device control logs record unapproved USB serial and bulk CSV copy. The team confirms unauthorized behavior and must protect applicant personal data; legitimate service continuity remains necessary. Which containment decision is best?
- Leave the confirmed unauthorized activity on registrar endpoint unrestricted until actual losses of applicant personal data can be measured
- Disable every production service at University admissions without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: block the unauthorized USB path and preserve logs before interviewing account holder
- Erase device control logs record unapproved USB serial and bulk CSV copy from the evidence archive during the containment change to reduce repeated alerts
Explanation
Correct Answer
C:Block the unauthorized USB path and preserve logs before interviewing account holder constrains the observed threat while maintaining necessary service for applicant personal data. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Once unauthorized behavior is confirmed on registrar endpoint, delaying containment could expand the exposure affecting applicant personal data.
B:Global shutdown could disrupt applicant personal data without evidence that every system has been affected; scoped isolation is more proportionate.
D:Eliminating device control logs record unapproved USB serial and bulk CSV copy evidence does not contain potential insider data removal to unmanaged removable media and impairs forensic reconstruction.
Question 575
University admissions has correlated an alert involving registrar endpoint; the key observation is device control logs record unapproved USB serial and bulk CSV copy. Another security organization requests a defensible, privacy-conscious indicator package to hunt for similar behavior. What should be shared?
- Share the validated technical observables and conditions from hunt for matching USB serial use and bulk sensitive exports on other endpoints, with timing, confidence, classification and minimal sensitive data
- Share all raw applicant personal data records to prove the alert is important before stripping unnecessary personal or protected content
- Send only the statement that potential insider data removal to unmanaged removable media exists with no indicator, observation time or confidence
- Declare every system using registrar endpoint technology compromised without proof beyond the single observation
Explanation
Correct Answer
A:Hunt for matching USB serial use and bulk sensitive exports on other endpoints describes how other defenders can test the observation. Time, confidence and privacy handling preserve investigative value without disclosing unrelated applicant personal data data.
Incorrect Answers
B:Sharing investigative indicators does not authorize exposing applicant personal data; minimize records and follow approved intelligence-sharing rules.
C:A generic threat label cannot help a partner correlate device control logs record unapproved USB serial and bulk CSV copy to its own assets or distinguish it from routine activity.
D:The single finding device control logs record unapproved USB serial and bulk CSV copy on registrar endpoint does not prove the same activity across organizations; share enough context for each partner to validate it.
Question 576
University admissions has investigated potential insider data removal to unmanaged removable media on registrar endpoint. Detection operators report that authorized archival exports are encrypted and run to managed storage under signed ticket; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Improve detection by requiring context-aware correlation: flag sensitive-file copy to unapproved removable media with no ticket
- Assign critical severity to every routine activity on registrar endpoint whether or not it matches flag sensitive-file copy to unapproved removable media with no ticket
- Suppress every future event associated with device control logs record unapproved USB serial and bulk CSV copy, including events outside authorized archival exports are encrypted and run to managed storage under signed ticket
- Automate service shutdown on the first simple match to a removable drive receives hundreds of student records during lunch break, without validation or guardrails for applicant personal data
Explanation
Correct Answer
A:Flag sensitive-file copy to unapproved removable media with no ticket retains the specific threat signal while discriminating against authorized archival exports are encrypted and run to managed storage under signed ticket. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
B:Alert severity without distinguishing authorized archival exports are encrypted and run to managed storage under signed ticket from malicious conditions would increase noise and operational workload.
C:Suppressing all monitoring would also hide a recurrence of potential insider data removal to unmanaged removable media, even where it threatens applicant personal data.
D:An untested, unqualified automation could interrupt applicant personal data and cannot distinguish the benign workflow from attacker behavior.
Question 577
At Online bank, the security team assesses public administrative API. The current issue is medium CVSS bug permits unauthenticated account lookup; assessment evidence states: scan report lists CVSS medium but exploit telemetry is observed. The service is direct internet exposure on payment admin API. Operational constraints: admin staff require controlled continuity. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across public administrative API during admin staff require controlled continuity instead of using a scoped test
- Use an authorized, scoped validation approach that considers service sensitivity: confirm authentication bypass using safe owned test accounts
- Accept the label medium CVSS bug permits unauthenticated account lookup as confirmed without checking the reported evidence scan report lists CVSS medium but exploit telemetry is observed or actual deployment
- Use only an anonymous outside-in scan of public administrative API even when direct internet exposure on payment admin API requires authenticated deployment context
Explanation
Correct Answer
B:The evidence scan report lists CVSS medium but exploit telemetry is observed must be evaluated without violating the constraint admin staff require controlled continuity. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because admin staff require controlled continuity; authorization and scope are prerequisites.
C:The finding does not establish which live component is affected or whether the exposure direct internet exposure on payment admin API is real.
D:Asset configuration and the constraints of public administrative API matter; external findings alone may misstate or miss the exposed path.
Question 578
At Online bank, the security team assesses public administrative API. The current issue is medium CVSS bug permits unauthenticated account lookup; assessment evidence states: scan report lists CVSS medium but exploit telemetry is observed. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Assume public administrative API is safe because another platform with similar software recently passed its own assessment
- Force a destructive proof-of-concept against public administrative API, ignoring that admin staff require controlled continuity and a safer validation exist
- Confirm the reported condition in the relevant asset context: confirm authentication bypass using safe owned test accounts
- Mark scan report lists CVSS medium but exploit telemetry is observed resolved or confirmed solely from the scanner severity without confirm authentication bypass using safe owned test accounts
Explanation
Correct Answer
C:Confirm authentication bypass using safe owned test accounts tests the reported condition scan report lists CVSS medium but exploit telemetry is observed against actual deployment context (direct internet exposure on payment admin API). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:Security of an unrelated host cannot establish the state of public administrative API, whose reported issue is medium CVSS bug permits unauthenticated account lookup.
B:A destructive proof is unnecessary when confirm authentication bypass using safe owned test accounts can provide authorized evidence and admin staff require controlled continuity constrains production testing.
D:scan report lists CVSS medium but exploit telemetry is observed may be accurate but its actual occurrence and configuration on public administrative API must be established before calling it validated.
Question 579
At Online bank, the security team assesses public administrative API. The current issue is medium CVSS bug permits unauthenticated account lookup; assessment evidence states: scan report lists CVSS medium but exploit telemetry is observed. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Give every vulnerability the same deadline despite medium CVSS bug permits unauthenticated account lookup and business impact on account enumeration impact
- Choose whatever finding on public administrative API was logged most recently, regardless of actual exploit path or priority
- Prioritize the confirmed exposure of public administrative API, accounting for account enumeration impact and the real access path: direct internet exposure on payment admin API
- Choose the highest nominal scanner severity first while ignoring direct internet exposure on payment admin API and the consequence to account enumeration impact
Explanation
Correct Answer
C:Risk depends on practical reachability, threat activity and consequence. The issue medium CVSS bug permits unauthenticated account lookup can affect account enumeration impact through direct internet exposure on payment admin API; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Uniform priority ignores direct internet exposure on payment admin API, operational harm and account enumeration impact; documented context makes triage defensible.
B:Discovery order is not evidence of urgency compared with the actual affected public administrative API.
D:CVSS describes technical characteristics, not the entirety of exposure and account enumeration impact for this deployment.
Question 580
At Online bank, the security team assesses public administrative API. The current issue is medium CVSS bug permits unauthenticated account lookup; assessment evidence states: scan report lists CVSS medium but exploit telemetry is observed. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use disable endpoint and block suspicious source while updating code as permanent closure of the confirmed issue instead of deploying enforce authentication and rate limits before exposing route
- Implement and verify the root-cause fix: enforce authentication and rate limits before exposing route
- Leave medium CVSS bug permits unauthenticated account lookup present indefinitely because no incident involving account enumeration impact was recorded this week
- Sign an exception document but do not implement or test enforce authentication and rate limits before exposing route on public administrative API
Explanation
Correct Answer
B:Enforce authentication and rate limits before exposing route targets the mechanism medium CVSS bug permits unauthenticated account lookup rather than only filtering symptoms. Verification must account for scan report lists CVSS medium but exploit telemetry is observed and continued protection of account enumeration impact.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying medium CVSS bug permits unauthenticated account lookup and should be time-limited with verification and owner oversight.
C:No observed attack does not correct the verified condition scan report lists CVSS medium but exploit telemetry is observed or eliminate its potential impact on account enumeration impact.
D:Risk acceptance paperwork does not itself remediate medium CVSS bug permits unauthenticated account lookup on public administrative API; authorized, tested implementation is still required when the risk exceeds tolerance.
