CompTIA CS0-003 Practice Test 60
Question 590
At Civic information portal, analysts monitor managed browser fleet. They observe that an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint. Evidence: browser policy audit shows sideloaded extension and broad host permissions. A separate known-good explanation is: approved extensions are allowlisted by signed publisher and narrow permissions. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of browser policy audit shows sideloaded extension and broad host permissions, without using review extension manifest, install source and outbound host requests
- Perform a scoped investigation: review extension manifest, install source and outbound host requests
- Summarize browser policy audit shows sideloaded extension and broad host permissions into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on managed browser fleet while waiting for the connection pattern to stop
Explanation
Correct Answer
B:Review extension manifest, install source and outbound host requests ties the evidence on managed browser fleet to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved extensions are allowlisted by signed publisher and narrow permissions.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of browser policy audit shows sideloaded extension and broad host permissions or whether the activity matches approved extensions are allowlisted by signed publisher and narrow permissions.
C:The original browser policy audit shows sideloaded extension and broad host permissions must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
D:Suppressing telemetry destroys the source needed to investigate malicious browser extension harvesting session data and may conceal further actions.
Question 591
Civic information portal has a candidate alert for managed browser fleet: browser policy audit shows sideloaded extension and broad host permissions. The team argues it is harmless because approved extensions are allowlisted by signed publisher and narrow permissions. What is the most defensible false-positive assessment?
- Create a blanket suppression for browser policy audit shows sideloaded extension and broad host permissions because approved extensions are allowlisted by signed publisher and narrow permissions can produce a superficially similar event
- Distinguish browser policy audit shows sideloaded extension and broad host permissions from the approved behavior (approved extensions are allowlisted by signed publisher and narrow permissions) by validating process, identity and time attribution
- Interpret an absence of existing vendor signatures as proof that an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint is benign
- Automatically treat every event resembling browser policy audit shows sideloaded extension and broad host permissions as confirmed compromise of managed browser fleet, without checking provenance
Explanation
Correct Answer
B:Approved extensions are allowlisted by signed publisher and narrow permissions is a plausible alternative, but it must be proven to match the actual source of browser policy audit shows sideloaded extension and broad host permissions. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Similarity to approved extensions are allowlisted by signed publisher and narrow permissions does not exclude an attacker from producing the same surface event on managed browser fleet.
C:Absence of a signature does not refute the concrete behavior: an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint.
D:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting citizen portal sessions.
Question 592
At Civic information portal, analysts monitor managed browser fleet. They observe that an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint. Evidence: browser policy audit shows sideloaded extension and broad host permissions. The team confirms unauthorized behavior and must protect citizen portal sessions; legitimate service continuity remains necessary. Which containment decision is best?
- Disable every production service at Civic information portal without measuring whether its dependencies share the observed malicious path
- Leave the confirmed unauthorized activity on managed browser fleet unrestricted until actual losses of citizen portal sessions can be measured
- Erase browser policy audit shows sideloaded extension and broad host permissions from the evidence archive during the containment change to reduce repeated alerts
- Apply targeted containment: disable the extension and invalidate exposed sessions while keeping core browsers operational
Explanation
Correct Answer
D:Disable the extension and invalidate exposed sessions while keeping core browsers operational constrains the observed threat while maintaining necessary service for citizen portal sessions. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Global shutdown could disrupt citizen portal sessions without evidence that every system has been affected; scoped isolation is more proportionate.
B:Once unauthorized behavior is confirmed on managed browser fleet, delaying containment could expand the exposure affecting citizen portal sessions.
C:Eliminating browser policy audit shows sideloaded extension and broad host permissions evidence does not contain malicious browser extension harvesting session data and impairs forensic reconstruction.
Question 593
Civic information portal receives a three-month-old threat-intelligence bulletin associating an observable with malicious browser extension harvesting session data. On managed browser fleet, local telemetry reports: browser policy audit shows sideloaded extension and broad host permissions. The bulletin gives no collection confidence. What should the analyst determine before using it to prioritize detection work?
- Rank the bulletin critical solely because it mentions malicious browser extension harvesting session data, without checking whether its observable is present on managed browser fleet
- Assess bulletin timeliness and provenance, then corroborate its observables against browser policy audit shows sideloaded extension and broad host permissions and affected managed browser fleet
- Dismiss the bulletin solely because Civic information portal has not named the attacker associated with browser policy audit shows sideloaded extension and broad host permissions
- Forward the bulletin about malicious browser extension harvesting session data as a confirmed breach of managed browser fleet without hosts, timestamps or confidence caveats
Explanation
Correct Answer
B:An old feed with unknown confidence is not automatic proof of activity at Civic information portal. Comparing its timestamps and provenance with browser policy audit shows sideloaded extension and broad host permissions reveals whether the indicator is still relevant to managed browser fleet and citizen portal sessions.
Incorrect Answers
A:The threat label is a lead, not verified current exposure. The analyst must check source reliability, currency and the actual browser policy audit shows sideloaded extension and broad host permissions.
C:Actor attribution is not required to assess a supported technique, source confidence or relevance to managed browser fleet.
D:Converting the unverified feed into confirmed activity on managed browser fleet may mislead investigators and prompt harmful response for citizen portal sessions.
Question 594
Civic information portal has investigated malicious browser extension harvesting session data on managed browser fleet. Detection operators report that approved extensions are allowlisted by signed publisher and narrow permissions; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Automate service shutdown on the first simple match to an unapproved extension gains read access to all websites and begins contacting a recently registered endpoint, without validation or guardrails for citizen portal sessions
- Improve detection by requiring context-aware correlation: detect sideloaded extension with broad read privileges and new external egress
- Suppress every future event associated with browser policy audit shows sideloaded extension and broad host permissions, including events outside approved extensions are allowlisted by signed publisher and narrow permissions
- Assign critical severity to every routine activity on managed browser fleet whether or not it matches detect sideloaded extension with broad read privileges and new external egress
Explanation
Correct Answer
B:Detect sideloaded extension with broad read privileges and new external egress retains the specific threat signal while discriminating against approved extensions are allowlisted by signed publisher and narrow permissions. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:An untested, unqualified automation could interrupt citizen portal sessions and cannot distinguish the benign workflow from attacker behavior.
C:Suppressing all monitoring would also hide a recurrence of malicious browser extension harvesting session data, even where it threatens citizen portal sessions.
D:Alert severity without distinguishing approved extensions are allowlisted by signed publisher and narrow permissions from malicious conditions would increase noise and operational workload.
Question 595
At Aerospace supplier, analysts monitor SIEM timestamp correlation. They observe that impossible-travel alerts increase after two log collectors start reporting local time as UTC. Evidence: collector logs show a timezone shift without corresponding device-authentication anomalies. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Treat the pattern as a hypothesis of time-normalization artifact rather than genuine impossible travel and begin corroborating it with endpoint and network evidence
- Treat verified IdP token IDs and device certificates consistently indicate normal sessions as conclusive authorization for the current event without matching process or identity
- Announce that collector logs show a timezone shift without corresponding device-authentication anomalies conclusively proves theft of supplier engineering access before reviewing any sessions or file access
- Downgrade impossible-travel alerts increase after two log collectors start reporting local time as UTC solely because the same symptom has not yet appeared on another endpoint
Explanation
Correct Answer
A:The combination of impossible-travel alerts increase after two log collectors start reporting local time as UTC and collector logs show a timezone shift without corresponding device-authentication anomalies is suspicious for time-normalization artifact rather than genuine impossible travel. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting supplier engineering access.
Incorrect Answers
B:The legitimate comparator is verified IdP token IDs and device certificates consistently indicate normal sessions; it does not establish that the current event came from the same approved identity or workflow.
C:collector logs show a timezone shift without corresponding device-authentication anomalies is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
D:An intrusion can begin on one asset. The specific indicator on SIEM timestamp correlation warrants its own validation before expanding or closing the investigation.
Question 596
At Aerospace supplier, analysts monitor SIEM timestamp correlation. They observe that impossible-travel alerts increase after two log collectors start reporting local time as UTC. Evidence: collector logs show a timezone shift without corresponding device-authentication anomalies. A separate known-good explanation is: verified IdP token IDs and device certificates consistently indicate normal sessions. Which next analysis most reliably determines what caused the observed event?
- Accept a public reputation score for the destination as proof of the origin of collector logs show a timezone shift without corresponding device-authentication anomalies, without using compare raw timestamps, timezone metadata and independent IdP session sequence
- Summarize collector logs show a timezone shift without corresponding device-authentication anomalies into a ticket and discard underlying event identifiers before correlation
- Suspend telemetry collection on SIEM timestamp correlation while waiting for the connection pattern to stop
- Perform a scoped investigation: compare raw timestamps, timezone metadata and independent IdP session sequence
Explanation
Correct Answer
D:Compare raw timestamps, timezone metadata and independent IdP session sequence ties the evidence on SIEM timestamp correlation to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: verified IdP token IDs and device certificates consistently indicate normal sessions.
Incorrect Answers
A:A reputation score may inform triage but cannot establish the origin of collector logs show a timezone shift without corresponding device-authentication anomalies or whether the activity matches verified IdP token IDs and device certificates consistently indicate normal sessions.
B:The original collector logs show a timezone shift without corresponding device-authentication anomalies must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
C:Suppressing telemetry destroys the source needed to investigate time-normalization artifact rather than genuine impossible travel and may conceal further actions.
Question 597
Aerospace supplier has a candidate alert for SIEM timestamp correlation: collector logs show a timezone shift without corresponding device-authentication anomalies. The team argues it is harmless because verified IdP token IDs and device certificates consistently indicate normal sessions. What is the most defensible false-positive assessment?
- Distinguish collector logs show a timezone shift without corresponding device-authentication anomalies from the approved behavior (verified IdP token IDs and device certificates consistently indicate normal sessions) by validating process, identity and time attribution
- Create a blanket suppression for collector logs show a timezone shift without corresponding device-authentication anomalies because verified IdP token IDs and device certificates consistently indicate normal sessions can produce a superficially similar event
- Interpret an absence of existing vendor signatures as proof that impossible-travel alerts increase after two log collectors start reporting local time as UTC is benign
- Automatically treat every event resembling collector logs show a timezone shift without corresponding device-authentication anomalies as confirmed compromise of SIEM timestamp correlation, without checking provenance
Explanation
Correct Answer
A:Verified IdP token IDs and device certificates consistently indicate normal sessions is a plausible alternative, but it must be proven to match the actual source of collector logs show a timezone shift without corresponding device-authentication anomalies. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
B:Similarity to verified IdP token IDs and device certificates consistently indicate normal sessions does not exclude an attacker from producing the same surface event on SIEM timestamp correlation.
C:Absence of a signature does not refute the concrete behavior: impossible-travel alerts increase after two log collectors start reporting local time as UTC.
D:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting supplier engineering access.
Question 598
Aerospace supplier determines that the anomaly in SIEM timestamp correlation comes from time normalization or clock drift, not from confirmed attacker access. Evidence: collector logs show a timezone shift without corresponding device-authentication anomalies. What response protects log correlation and authorized service continuity?
- Immediately revoke all legitimate remote sessions at Aerospace supplier because the incorrectly ordered timestamps are presumed malicious
- Suppress all future correlation alerts on SIEM timestamp correlation rather than normalize the affected event timestamps
- Correct the telemetry source rather than isolating legitimate systems: correct collector normalization without revoking legitimate authenticated worker sessions
- Rewrite the original SIEM timestamp correlation events by hand after collector logs show a timezone shift without corresponding device-authentication anomalies, losing the raw source and documented offset
Explanation
Correct Answer
C:The evidence collector logs show a timezone shift without corresponding device-authentication anomalies indicates a clock-related correlation error. Correct collector normalization without revoking legitimate authenticated worker sessions addresses the proven log-quality cause without disrupting legitimate authenticated access.
Incorrect Answers
A:The analyzed collector logs show a timezone shift without corresponding device-authentication anomalies reflects a timestamp interpretation error; indiscriminate revocation would interrupt authorized access without fixing log chronology.
B:Blanket suppression conceals real future incidents and does not repair the event ordering error documented by collector logs show a timezone shift without corresponding device-authentication anomalies.
D:Hand-editing the original collector logs show a timezone shift without corresponding device-authentication anomalies destroys provenance and reproducibility; document the source offset and correct pipeline normalization instead.
Question 599
At Aerospace supplier, analysts have investigated an initial alert involving SIEM timestamp correlation and need to scope related activity. Original event: collector logs show a timezone shift without corresponding device-authentication anomalies. Which threat-hunt pivot is best grounded in this observation?
- Use the previous month’s overall alert closure count instead of pivoting on collector logs show a timezone shift without corresponding device-authentication anomalies across related identities and systems
- Pivot across the environment: hunt for sources with timezone drift and correlated false travel alerts
- Stop scoping once the initial SIEM timestamp correlation has been contained, even though hunt for sources with timezone drift and correlated false travel alerts has not been attempted
- Mark every host adjacent to SIEM timestamp correlation compromised by assumption without comparing activity-linked observables
Explanation
Correct Answer
B:Hunt for sources with timezone drift and correlated false travel alerts extends the investigation from the specific clue, collector logs show a timezone shift without corresponding device-authentication anomalies, to related activity while preserving host and user attribution. This estimates the scope of potential time-normalization artifact rather than genuine impossible travel.
Incorrect Answers
A:Historical alert volume does not trace the shared indicator or determine whether time-normalization artifact rather than genuine impossible travel spread beyond SIEM timestamp correlation.
C:The initiating host may not be the only affected one; scoping requires examining the connected evidence collector logs show a timezone shift without corresponding device-authentication anomalies.
D:Proximity to SIEM timestamp correlation is not proof of exposure; use the activity-linked pivot to identify actual relationships.
Question 600
Aerospace supplier has investigated time-normalization artifact rather than genuine impossible travel on SIEM timestamp correlation. Detection operators report that verified IdP token IDs and device certificates consistently indicate normal sessions; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Suppress every future event associated with collector logs show a timezone shift without corresponding device-authentication anomalies, including events outside verified IdP token IDs and device certificates consistently indicate normal sessions
- Assign critical severity to every routine activity on SIEM timestamp correlation whether or not it matches validate normalized UTC and provenance before emitting geographic-impossibility alerts
- Improve detection by requiring context-aware correlation: validate normalized UTC and provenance before emitting geographic-impossibility alerts
- Automate service shutdown on the first simple match to impossible-travel alerts increase after two log collectors start reporting local time as UTC, without validation or guardrails for supplier engineering access
Explanation
Correct Answer
C:Validate normalized UTC and provenance before emitting geographic-impossibility alerts retains the specific threat signal while discriminating against verified IdP token IDs and device certificates consistently indicate normal sessions. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Suppressing all monitoring would also hide a recurrence of time-normalization artifact rather than genuine impossible travel, even where it threatens supplier engineering access.
B:Alert severity without distinguishing verified IdP token IDs and device certificates consistently indicate normal sessions from malicious conditions would increase noise and operational workload.
D:An untested, unqualified automation could interrupt supplier engineering access and cannot distinguish the benign workflow from attacker behavior.
