CompTIA CS0-003 Practice Test 59
Question 580
At Online bank, the security team assesses public administrative API. The current issue is medium CVSS bug permits unauthenticated account lookup; assessment evidence states: scan report lists CVSS medium but exploit telemetry is observed. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Use disable endpoint and block suspicious source while updating code as permanent closure of the confirmed issue instead of deploying enforce authentication and rate limits before exposing route
- Implement and verify the root-cause fix: enforce authentication and rate limits before exposing route
- Leave medium CVSS bug permits unauthenticated account lookup present indefinitely because no incident involving account enumeration impact was recorded this week
- Sign an exception document but do not implement or test enforce authentication and rate limits before exposing route on public administrative API
Explanation
Correct Answer
B:Enforce authentication and rate limits before exposing route targets the mechanism medium CVSS bug permits unauthenticated account lookup rather than only filtering symptoms. Verification must account for scan report lists CVSS medium but exploit telemetry is observed and continued protection of account enumeration impact.
Incorrect Answers
A:The interim control may reduce exposure, but it can leave the underlying medium CVSS bug permits unauthenticated account lookup and should be time-limited with verification and owner oversight.
C:No observed attack does not correct the verified condition scan report lists CVSS medium but exploit telemetry is observed or eliminate its potential impact on account enumeration impact.
D:Risk acceptance paperwork does not itself remediate medium CVSS bug permits unauthenticated account lookup on public administrative API; authorized, tested implementation is still required when the risk exceeds tolerance.
Question 581
At Online bank, the security team assesses public administrative API. The current issue is medium CVSS bug permits unauthenticated account lookup; assessment evidence states: scan report lists CVSS medium but exploit telemetry is observed. A permanent correction cannot be deployed immediately because admin staff require controlled continuity. Which interim treatment is the safest governed option?
- Claim medium CVSS bug permits unauthenticated account lookup is patched when the change ticket opens, without confirming disable endpoint and block suspicious source while updating code or a planned permanent change
- Accept continued exposure of account enumeration impact without any owner, expiry or compensating verification because admin staff require controlled continuity
- Push enforce authentication and rate limits before exposing route immediately to all production systems with no safe change window despite admin staff require controlled continuity
- Apply a time-bound compensating measure, disable endpoint and block suspicious source while updating code, record the residual risk owner and schedule the tested permanent fix
Explanation
Correct Answer
D:Disable endpoint and block suspicious source while updating code can reduce short-term exposure while admin staff require controlled continuity delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because account enumeration impact remains at stake.
Incorrect Answers
A:A work item is not proof that medium CVSS bug permits unauthenticated account lookup was corrected or even that disable endpoint and block suspicious source while updating code operates.
B:Business criticality increases the need for accountable decisions and review; it does not make account enumeration impact irrelevant.
C:Ignoring admin staff require controlled continuity could cause avoidable service failure and is not a risk-aware remediation process.
Question 582
At Online bank, the security team assesses public administrative API. The current issue is medium CVSS bug permits unauthenticated account lookup; assessment evidence states: scan report lists CVSS medium but exploit telemetry is observed. The owner reports that enforce authentication and rate limits before exposing route has been deployed. What evidence should close the vulnerability item?
- Suppress future results for medium CVSS bug permits unauthenticated account lookup so that the vulnerability dashboard shows a completed remediation
- Use an unrelated server’s clean findings to claim public administrative API is fixed without retesting the affected path
- Close scan report lists CVSS medium but exploit telemetry is observed after the deployment tool returns success, without verifying the current state of public administrative API
- Retest the originally affected configuration using confirm authentication bypass using safe owned test accounts, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by scan report lists CVSS medium but exploit telemetry is observed, plus regression impact on public administrative API. A change ticket alone is not proof of removal of medium CVSS bug permits unauthenticated account lookup.
Incorrect Answers
A:Suppression may hide a failed or incomplete fix, leaving account enumeration impact exposed despite the administrative record.
B:The result must be tied to public administrative API and the actual exposure: direct internet exposure on payment admin API.
C:Process completion is not evidence that scan report lists CVSS medium but exploit telemetry is observed no longer applies to public administrative API.
Question 583
At SaaS developer platform, analysts monitor Kubernetes namespace. They observe that a public image accidentally contains a service-account token and pods make unusual API calls. Evidence: container scan finds token string; audit logs show cluster-role binding modifications. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Downgrade a public image accidentally contains a service-account token and pods make unusual API calls solely because the same symptom has not yet appeared on another endpoint
- Announce that container scan finds token string; audit logs show cluster-role binding modifications conclusively proves theft of multi-tenant application isolation before reviewing any sessions or file access
- Treat legitimate workloads use short-lived projected tokens and minimum namespace RBAC as conclusive authorization for the current event without matching process or identity
- Treat the pattern as a hypothesis of exposed cluster credential enabling privilege escalation and begin corroborating it with endpoint and network evidence
Explanation
Correct Answer
D:The combination of a public image accidentally contains a service-account token and pods make unusual API calls and container scan finds token string; audit logs show cluster-role binding modifications is suspicious for exposed cluster credential enabling privilege escalation. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting multi-tenant application isolation.
Incorrect Answers
A:An intrusion can begin on one asset. The specific indicator on Kubernetes namespace warrants its own validation before expanding or closing the investigation.
B:container scan finds token string; audit logs show cluster-role binding modifications is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
C:The legitimate comparator is legitimate workloads use short-lived projected tokens and minimum namespace RBAC; it does not establish that the current event came from the same approved identity or workflow.
Question 584
At SaaS developer platform, analysts monitor Kubernetes namespace. They observe that a public image accidentally contains a service-account token and pods make unusual API calls. Evidence: container scan finds token string; audit logs show cluster-role binding modifications. A separate known-good explanation is: legitimate workloads use short-lived projected tokens and minimum namespace RBAC. Which next analysis most reliably determines what caused the observed event?
- Perform a scoped investigation: correlate token issuance, Kubernetes audit verb and image digest
- Summarize container scan finds token string; audit logs show cluster-role binding modifications into a ticket and discard underlying event identifiers before correlation
- Accept a public reputation score for the destination as proof of the origin of container scan finds token string; audit logs show cluster-role binding modifications, without using correlate token issuance, Kubernetes audit verb and image digest
- Suspend telemetry collection on Kubernetes namespace while waiting for the connection pattern to stop
Explanation
Correct Answer
A:Correlate token issuance, Kubernetes audit verb and image digest ties the evidence on Kubernetes namespace to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: legitimate workloads use short-lived projected tokens and minimum namespace RBAC.
Incorrect Answers
B:The original container scan finds token string; audit logs show cluster-role binding modifications must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
C:A reputation score may inform triage but cannot establish the origin of container scan finds token string; audit logs show cluster-role binding modifications or whether the activity matches legitimate workloads use short-lived projected tokens and minimum namespace RBAC.
D:Suppressing telemetry destroys the source needed to investigate exposed cluster credential enabling privilege escalation and may conceal further actions.
Question 585
SaaS developer platform has a candidate alert for Kubernetes namespace: container scan finds token string; audit logs show cluster-role binding modifications. The team argues it is harmless because legitimate workloads use short-lived projected tokens and minimum namespace RBAC. What is the most defensible false-positive assessment?
- Interpret an absence of existing vendor signatures as proof that a public image accidentally contains a service-account token and pods make unusual API calls is benign
- Distinguish container scan finds token string; audit logs show cluster-role binding modifications from the approved behavior (legitimate workloads use short-lived projected tokens and minimum namespace RBAC) by validating process, identity and time attribution
- Automatically treat every event resembling container scan finds token string; audit logs show cluster-role binding modifications as confirmed compromise of Kubernetes namespace, without checking provenance
- Create a blanket suppression for container scan finds token string; audit logs show cluster-role binding modifications because legitimate workloads use short-lived projected tokens and minimum namespace RBAC can produce a superficially similar event
Explanation
Correct Answer
B:Legitimate workloads use short-lived projected tokens and minimum namespace RBAC is a plausible alternative, but it must be proven to match the actual source of container scan finds token string; audit logs show cluster-role binding modifications. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Absence of a signature does not refute the concrete behavior: a public image accidentally contains a service-account token and pods make unusual API calls.
C:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting multi-tenant application isolation.
D:Similarity to legitimate workloads use short-lived projected tokens and minimum namespace RBAC does not exclude an attacker from producing the same surface event on Kubernetes namespace.
Question 586
At SaaS developer platform, analysts monitor Kubernetes namespace. They observe that a public image accidentally contains a service-account token and pods make unusual API calls. Evidence: container scan finds token string; audit logs show cluster-role binding modifications. The team confirms unauthorized behavior and must protect multi-tenant application isolation; legitimate service continuity remains necessary. Which containment decision is best?
- Disable every production service at SaaS developer platform without measuring whether its dependencies share the observed malicious path
- Apply targeted containment: revoke the embedded token and isolate the suspect workload without dropping healthy namespaces
- Erase container scan finds token string; audit logs show cluster-role binding modifications from the evidence archive during the containment change to reduce repeated alerts
- Leave the confirmed unauthorized activity on Kubernetes namespace unrestricted until actual losses of multi-tenant application isolation can be measured
Explanation
Correct Answer
B:Revoke the embedded token and isolate the suspect workload without dropping healthy namespaces constrains the observed threat while maintaining necessary service for multi-tenant application isolation. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Global shutdown could disrupt multi-tenant application isolation without evidence that every system has been affected; scoped isolation is more proportionate.
C:Eliminating container scan finds token string; audit logs show cluster-role binding modifications evidence does not contain exposed cluster credential enabling privilege escalation and impairs forensic reconstruction.
D:Once unauthorized behavior is confirmed on Kubernetes namespace, delaying containment could expand the exposure affecting multi-tenant application isolation.
Question 587
At SaaS developer platform, analysts have investigated an initial alert involving Kubernetes namespace and need to scope related activity. Original event: container scan finds token string; audit logs show cluster-role binding modifications. Which threat-hunt pivot is best grounded in this observation?
- Pivot across the environment: hunt for image digest, suspicious role bindings and reused token subjects
- Stop scoping once the initial Kubernetes namespace has been contained, even though hunt for image digest, suspicious role bindings and reused token subjects has not been attempted
- Mark every host adjacent to Kubernetes namespace compromised by assumption without comparing activity-linked observables
- Use the previous month’s overall alert closure count instead of pivoting on container scan finds token string; audit logs show cluster-role binding modifications across related identities and systems
Explanation
Correct Answer
A:Hunt for image digest, suspicious role bindings and reused token subjects extends the investigation from the specific clue, container scan finds token string; audit logs show cluster-role binding modifications, to related activity while preserving host and user attribution. This estimates the scope of potential exposed cluster credential enabling privilege escalation.
Incorrect Answers
B:The initiating host may not be the only affected one; scoping requires examining the connected evidence container scan finds token string; audit logs show cluster-role binding modifications.
C:Proximity to Kubernetes namespace is not proof of exposure; use the activity-linked pivot to identify actual relationships.
D:Historical alert volume does not trace the shared indicator or determine whether exposed cluster credential enabling privilege escalation spread beyond Kubernetes namespace.
Question 588
SaaS developer platform has investigated exposed cluster credential enabling privilege escalation on Kubernetes namespace. Detection operators report that legitimate workloads use short-lived projected tokens and minimum namespace RBAC; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Suppress every future event associated with container scan finds token string; audit logs show cluster-role binding modifications, including events outside legitimate workloads use short-lived projected tokens and minimum namespace RBAC
- Assign critical severity to every routine activity on Kubernetes namespace whether or not it matches block image admission with embedded secrets and alert on off-policy role binding
- Automate service shutdown on the first simple match to a public image accidentally contains a service-account token and pods make unusual API calls, without validation or guardrails for multi-tenant application isolation
- Improve detection by requiring context-aware correlation: block image admission with embedded secrets and alert on off-policy role binding
Explanation
Correct Answer
D:Block image admission with embedded secrets and alert on off-policy role binding retains the specific threat signal while discriminating against legitimate workloads use short-lived projected tokens and minimum namespace RBAC. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Suppressing all monitoring would also hide a recurrence of exposed cluster credential enabling privilege escalation, even where it threatens multi-tenant application isolation.
B:Alert severity without distinguishing legitimate workloads use short-lived projected tokens and minimum namespace RBAC from malicious conditions would increase noise and operational workload.
C:An untested, unqualified automation could interrupt multi-tenant application isolation and cannot distinguish the benign workflow from attacker behavior.
Question 589
At Civic information portal, analysts monitor managed browser fleet. They observe that an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint. Evidence: browser policy audit shows sideloaded extension and broad host permissions. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of malicious browser extension harvesting session data and begin corroborating it with endpoint and network evidence
- Treat approved extensions are allowlisted by signed publisher and narrow permissions as conclusive authorization for the current event without matching process or identity
- Downgrade an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint solely because the same symptom has not yet appeared on another endpoint
- Announce that browser policy audit shows sideloaded extension and broad host permissions conclusively proves theft of citizen portal sessions before reviewing any sessions or file access
Explanation
Correct Answer
A:The combination of an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint and browser policy audit shows sideloaded extension and broad host permissions is suspicious for malicious browser extension harvesting session data. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting citizen portal sessions.
Incorrect Answers
B:The legitimate comparator is approved extensions are allowlisted by signed publisher and narrow permissions; it does not establish that the current event came from the same approved identity or workflow.
C:An intrusion can begin on one asset. The specific indicator on managed browser fleet warrants its own validation before expanding or closing the investigation.
D:browser policy audit shows sideloaded extension and broad host permissions is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
Question 590
At Civic information portal, analysts monitor managed browser fleet. They observe that an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint. Evidence: browser policy audit shows sideloaded extension and broad host permissions. A separate known-good explanation is: approved extensions are allowlisted by signed publisher and narrow permissions. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of browser policy audit shows sideloaded extension and broad host permissions, without using review extension manifest, install source and outbound host requests
- Perform a scoped investigation: review extension manifest, install source and outbound host requests
- Summarize browser policy audit shows sideloaded extension and broad host permissions into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on managed browser fleet while waiting for the connection pattern to stop
Explanation
Correct Answer
B:Review extension manifest, install source and outbound host requests ties the evidence on managed browser fleet to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved extensions are allowlisted by signed publisher and narrow permissions.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of browser policy audit shows sideloaded extension and broad host permissions or whether the activity matches approved extensions are allowlisted by signed publisher and narrow permissions.
C:The original browser policy audit shows sideloaded extension and broad host permissions must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:Suppressing telemetry destroys the source needed to investigate malicious browser extension harvesting session data and may conceal further actions.
