CompTIA CS0-003 Practice Test 7
Question 60
At Logistics SaaS, the security team assesses PDF preview fetch endpoint. The current issue is server-side request forgery reaches metadata endpoint; assessment evidence states: test URL causes backend to request 169.254.169.254 response. The owner reports that egress allowlist, metadata protection and URL validation has been deployed. What evidence should close the vulnerability item?
- Close test URL causes backend to request 169.254.169.254 response after the deployment tool returns success, without verifying the current state of PDF preview fetch endpoint
- Use an unrelated server’s clean findings to claim PDF preview fetch endpoint is fixed without retesting the affected path
- Suppress future results for server-side request forgery reaches metadata endpoint so that the vulnerability dashboard shows a completed remediation
- Retest the originally affected configuration using verify egress path and response using safe controlled canary, confirm the vulnerability is gone and record change evidence
Explanation
Correct Answer
D:Closure requires checking the same affected path identified by test URL causes backend to request 169.254.169.254 response, plus regression impact on PDF preview fetch endpoint. A change ticket alone is not proof of removal of server-side request forgery reaches metadata endpoint.
Incorrect Answers
A:Process completion is not evidence that test URL causes backend to request 169.254.169.254 response no longer applies to PDF preview fetch endpoint.
B:The result must be tied to PDF preview fetch endpoint and the actual exposure: public preview URL accepts user-controlled destinations.
C:Suppression may hide a failed or incomplete fix, leaving cloud identity token confidentiality exposed despite the administrative record.
Question 61
At Bioengineering lab, the incident team supports research file share. A new security event is reported: a departing employee copies restricted data to an unmanaged cloud drive. The log clue is: proxy logs correlate bulk uploads with an account termination request. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Treat an ATT&CK label for a departing employee copies restricted data to an unmanaged cloud drive as a complete recovery instruction without checking evidence or impact
- Attribute a departing employee copies restricted data to an unmanaged cloud drive to a named foreign intelligence service using only proxy logs correlate bulk uploads with an account termination request
- Assign a final attack-chain stage to research file share without confirming what behavior actually occurred in proxy logs correlate bulk uploads with an account termination request
- Map the observed behavior in proxy logs correlate bulk uploads with an account termination request to a technique-level ATT&CK or kill-chain hypothesis and record confidence
Explanation
Correct Answer
D:A departing employee copies restricted data to an unmanaged cloud drive and proxy logs correlate bulk uploads with an account termination request support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:A taxonomy is not an incident response plan for research file share; scope and safety constraints still matter.
B:Neither a departing employee copies restricted data to an unmanaged cloud drive nor proxy logs correlate bulk uploads with an account termination request establishes uniquely identifying actor evidence.
C:Attack frameworks describe observable stages and techniques; the proxy logs correlate bulk uploads with an account termination request must substantiate whichever stage is assigned.
Question 62
At Bioengineering lab, the incident team supports research file share. A new security event is reported: a departing employee copies restricted data to an unmanaged cloud drive. The log clue is: proxy logs correlate bulk uploads with an account termination request. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Preserve and hash incident artifacts: cloud access events and endpoint file audit exported to read-only evidence store
- Rebuild research file share first and collect the volatile evidence for a departing employee copies restricted data to an unmanaged cloud drive afterward
- Keep only a screenshot of proxy logs correlate bulk uploads with an account termination request, discarding original artifacts such as cloud access events and endpoint file audit exported to read-only evidence store
- Alter original proxy logs correlate bulk uploads with an account termination request entries to remove irrelevant records before preserving the forensic timeline
Explanation
Correct Answer
A:Cloud access events and endpoint file audit exported to read-only evidence store retains relevant source context and integrity checks so the team can reconstruct a departing employee copies restricted data to an unmanaged cloud drive and support an auditable chain of custody.
Incorrect Answers
B:Volatile evidence relevant to a departing employee copies restricted data to an unmanaged cloud drive may disappear during remediation or reboot.
C:A screenshot cannot replace the underlying cloud access events and endpoint file audit exported to read-only evidence store needed to establish sequence and integrity.
D:Changing the original proxy logs correlate bulk uploads with an account termination request compromises provenance and makes later findings harder to verify.
Question 63
At Bioengineering lab, the incident team supports research file share. A new security event is reported: a departing employee copies restricted data to an unmanaged cloud drive. The log clue is: proxy logs correlate bulk uploads with an account termination request. The incident remains active, but research file share is operationally important. Which containment decision is most appropriate now?
- Publish a speculative full-incident attribution notice before constraining the active behavior a departing employee copies restricted data to an unmanaged cloud drive
- Erase proxy logs correlate bulk uploads with an account termination request to reduce alert volume rather than isolating the observed attacker route
- Execute scoped containment: suspend the person's data transfer permissions without deleting relevant logs
- Disconnect every service at Bioengineering lab, regardless of whether it has a dependency on the affected research file share
Explanation
Correct Answer
C:Suspend the person's data transfer permissions without deleting relevant logs stops or limits the observed path while balancing continuity of research file share. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Communication matters, but active a departing employee copies restricted data to an unmanaged cloud drive requires proportionate containment and evidence preservation first.
B:Erasing proxy logs correlate bulk uploads with an account termination request neither blocks attacker access nor supports a reliable subsequent recovery decision.
D:Broad interruption may unnecessarily affect research file share; containment should be scoped to evidenced systems and approved critical-service requirements.
Question 64
At Bioengineering lab, the incident team supports research file share. A new security event is reported: a departing employee copies restricted data to an unmanaged cloud drive. The log clue is: proxy logs correlate bulk uploads with an account termination request. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Rewrite the playbook for research file share but leave the confirmed malicious access mechanism active
- Restore research file share without first correcting the access and persistence cause addressed by revoke external shares and remove unauthorized sync clients after scoping
- Remove the attack’s established access and persistence: revoke external shares and remove unauthorized sync clients after scoping
- Use only the original firewall block and assume it has also removed all persistence behind a departing employee copies restricted data to an unmanaged cloud drive
Explanation
Correct Answer
C:Revoke external shares and remove unauthorized sync clients after scoping targets the mechanism behind a departing employee copies restricted data to an unmanaged cloud drive, reducing recurrence when research file share returns to normal operations.
Incorrect Answers
A:Updated paperwork does not eradicate the mechanism behind a departing employee copies restricted data to an unmanaged cloud drive.
B:Recovery before revoke external shares and remove unauthorized sync clients after scoping could reintroduce the same compromise path.
D:Containment can stop communication without eliminating the root access that produced proxy logs correlate bulk uploads with an account termination request.
Question 65
At Bioengineering lab, the incident team supports research file share. A new security event is reported: a departing employee copies restricted data to an unmanaged cloud drive. The log clue is: proxy logs correlate bulk uploads with an account termination request. Containment and eradication are complete. Which recovery acceptance test should precede release of research file share to normal users?
- Expose research file share to users before confirming that the conditions behind a departing employee copies restricted data to an unmanaged cloud drive are absent
- Delete preserved evidence including cloud access events and endpoint file audit exported to read-only evidence store as soon as the service restarts
- Perform controlled return-to-service validation: confirm only authorized collaboration paths remain and inspect residual shared links
- Approve recovery of research file share when it boots, without executing the test confirm only authorized collaboration paths remain and inspect residual shared links
Explanation
Correct Answer
C:Confirm only authorized collaboration paths remain and inspect residual shared links demonstrates that the compromised pathway is absent while research file share again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, research file share could immediately face the same exploit condition.
B:Evidence retention obligations continue beyond restart; cloud access events and endpoint file audit exported to read-only evidence store may be required for subsequent review.
D:A boot event cannot prove confirm only authorized collaboration paths remain and inspect residual shared links or protect the service from recurrence of a departing employee copies restricted data to an unmanaged cloud drive.
Question 66
At Bioengineering lab, the incident team supports research file share. A new security event is reported: a departing employee copies restricted data to an unmanaged cloud drive. The log clue is: proxy logs correlate bulk uploads with an account termination request. The incident has been contained and normal service has resumed. A post-incident review identifies that research access revocation was not tied to personnel departure event. Which improvement should be prioritized?
- Write a lessons-learned memo about a departing employee copies restricted data to an unmanaged cloud drive with no due date, control owner or validation activity
- Close the follow-up for research file share merely because restoration completed, without addressing research access revocation was not tied to personnel departure event
- Assign an owner and measurable corrective action addressing the root cause: research access revocation was not tied to personnel departure event, with a future effectiveness test
- Discipline the whole on-duty response shift rather than examining the documented weakness research access revocation was not tied to personnel departure event
Explanation
Correct Answer
C:Research access revocation was not tied to personnel departure event was the systemic weakness that enabled or worsened a departing employee copies restricted data to an unmanaged cloud drive. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:An unowned recommendation does not produce a verified control improvement for research file share.
B:Service restoration does not address research access revocation was not tied to personnel departure event; ignoring it leaves the next incident likely to follow the same route.
D:A personnel-only response lacks support from the documented root cause: research access revocation was not tied to personnel departure event.
Question 67
Online retailer is reviewing a security finding affecting checkout applications: actively exploited edge flaw with critical business impact. The current reporting problem is that patch report sorts only by base CVSS score. What information should be delivered first to decision makers responsible for public exploitation despite modest CVSS requires urgent prioritization?
- State that actively exploited edge flaw with critical business impact was eliminated because Online retailer distributed a dashboard on schedule
- Report only the number of tickets closed for checkout applications, concealing the unresolved exposure from actively exploited edge flaw with critical business impact
- Forward raw telemetry from exploit telemetry, reachable endpoint and affected customer route to executives without summarizing consequences for public exploitation despite modest CVSS requires urgent prioritization
- Present a concise, evidence-qualified risk and impact summary based on exploit telemetry, reachable endpoint and affected customer route, with decisions and uncertainty stated
Explanation
Correct Answer
D:Exploit telemetry, reachable endpoint and affected customer route supports a decision-oriented picture of public exploitation despite modest CVSS requires urgent prioritization while separating confirmed facts from unknowns. This corrects the reporting defect: patch report sorts only by base CVSS score.
Incorrect Answers
A:Reporting timeliness is not evidence that exploit telemetry, reachable endpoint and affected customer route shows full risk elimination.
B:Ticket counts do not establish whether actively exploited edge flaw with critical business impact still threatens public exploitation despite modest CVSS requires urgent prioritization.
C:Raw telemetry may support analysts, but decision makers need the meaning for public exploitation despite modest CVSS requires urgent prioritization and accountable options.
Question 68
Online retailer is reviewing a security finding affecting checkout applications: actively exploited edge flaw with critical business impact. The current reporting problem is that patch report sorts only by base CVSS score. The technical remediation team and assurance group request reproducible supporting information. Which report content is most useful?
- Remove the timestamps and correlations from exploit telemetry, reachable endpoint and affected customer route so the technical report occupies fewer pages
- Provide the original relevant artifacts and validation method from exploit telemetry, reachable endpoint and affected customer route, tied to affected assets, owners and retest criteria
- Accept an assertion that checkout platform owner completed the correction with no retest against exploit telemetry, reachable endpoint and affected customer route
- Give checkout platform owner the same board overview rather than the reproducible records from exploit telemetry, reachable endpoint and affected customer route
Explanation
Correct Answer
B:Exploit telemetry, reachable endpoint and affected customer route gives engineers traceable scope and a basis for confirming that checkout platform owner has resolved the identified exposure on checkout applications.
Incorrect Answers
A:Such edits break reproducibility of actively exploited edge flaw with critical business impact and make scope or remediation errors harder to find.
C:Self-assessment without test artifacts is weaker than verifiable exploit telemetry, reachable endpoint and affected customer route and agreed acceptance conditions.
D:A high-level board summary cannot identify the concrete exploit telemetry, reachable endpoint and affected customer route fields needed for technical validation.
Question 69
Online retailer is reviewing a security finding affecting checkout applications: actively exploited edge flaw with critical business impact. The current reporting problem is that patch report sorts only by base CVSS score. Stakeholders include commerce VP and platform engineering. Notification may be sensitive while facts are still being verified. Which communication process is most appropriate?
- Give a technical engineer sole authority for every legal or public statement otherwise owned by commerce VP and platform engineering
- Coordinate fact-checked messages, recipients and timing with commerce VP and platform engineering, preserving applicable legal and incident approval paths
- Withhold notification of actively exploited edge flaw with critical business impact indefinitely even after verified exploit telemetry, reachable endpoint and affected customer route meets a binding disclosure threshold
- Release unconfirmed details about actively exploited edge flaw with critical business impact externally before evidence and approvals from commerce VP and platform engineering have been reconciled
Explanation
Correct Answer
B:The parties commerce VP and platform engineering have different responsibilities. Using verified exploit telemetry, reachable endpoint and affected customer route and governed timing avoids both premature unsubstantiated disclosure and withholding a binding notification.
Incorrect Answers
A:Technical diagnosis does not automatically confer the disclosure authority held by commerce VP and platform engineering.
C:If verified exploit telemetry, reachable endpoint and affected customer route triggers obligations, indefinite silence could breach law, contracts or organizational response rules.
D:Unconfirmed claims could misrepresent the impact of actively exploited edge flaw with critical business impact and breach communication obligations.
Question 70
Online retailer is reviewing a security finding affecting checkout applications: actively exploited edge flaw with critical business impact. The current reporting problem is that patch report sorts only by base CVSS score. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Track a defined, evidence-based measure of externally exploited risk with exposure and interim controls, with trend, scope and accountable source
- Compare Online retailer teams only by tickets closed, ignoring which services are still exposed to actively exploited edge flaw with critical business impact
- Redefine externally exploited risk with exposure and interim controls every week until all dashboards appear positive
- Measure improvement in externally exploited risk with exposure and interim controls by how many slides were added to the board presentation
Explanation
Correct Answer
A:The measure externally exploited risk with exposure and interim controls connects reporting to a change in public exploitation despite modest CVSS requires urgent prioritization, rather than the number of reports or raw alert volume. Trends must use consistent inputs from exploit telemetry, reachable endpoint and affected customer route.
Incorrect Answers
B:Tickets can hide unresolved public exploitation despite modest CVSS requires urgent prioritization; a risk-weighted outcome metric is needed.
C:Inconsistent measures cannot support a credible trend for externally exploited risk with exposure and interim controls.
D:Presentation size does not establish externally exploited risk with exposure and interim controls or whether actively exploited edge flaw with critical business impact is managed.
