CompTIA CS0-003 Practice Test 8
Question 70
Online retailer is reviewing a security finding affecting checkout applications: actively exploited edge flaw with critical business impact. The current reporting problem is that patch report sorts only by base CVSS score. Executives say the existing dashboard does not reveal whether exposure or response outcomes are improving. Which measurement best resolves that?
- Track a defined, evidence-based measure of externally exploited risk with exposure and interim controls, with trend, scope and accountable source
- Compare Online retailer teams only by tickets closed, ignoring which services are still exposed to actively exploited edge flaw with critical business impact
- Redefine externally exploited risk with exposure and interim controls every week until all dashboards appear positive
- Measure improvement in externally exploited risk with exposure and interim controls by how many slides were added to the board presentation
Explanation
Correct Answer
A:The measure externally exploited risk with exposure and interim controls connects reporting to a change in public exploitation despite modest CVSS requires urgent prioritization, rather than the number of reports or raw alert volume. Trends must use consistent inputs from exploit telemetry, reachable endpoint and affected customer route.
Incorrect Answers
B:Tickets can hide unresolved public exploitation despite modest CVSS requires urgent prioritization; a risk-weighted outcome metric is needed.
C:Inconsistent measures cannot support a credible trend for externally exploited risk with exposure and interim controls.
D:Presentation size does not establish externally exploited risk with exposure and interim controls or whether actively exploited edge flaw with critical business impact is managed.
Question 71
Online retailer is reviewing a security finding affecting checkout applications: actively exploited edge flaw with critical business impact. The current reporting problem is that patch report sorts only by base CVSS score. An action plan is being negotiated, but peak sales period limits downtime. What reporting recommendation best supports practical remediation?
- Ask the checkout platform owner to document mitigation choices for checkout applications, service constraints, milestones, approvers and time-bound risk acceptance if needed
- Set an immediate fix deadline for checkout applications without acknowledging that peak sales period limits downtime
- Copy a generic checklist for actively exploited edge flaw with critical business impact without accountable owners, asset scope or milestones
- Give checkout platform owner an unlimited exception because peak sales period limits downtime rather than reporting residual risk and expiry
Explanation
Correct Answer
A:Peak sales period limits downtime creates a real implementation constraint. A plan owned by checkout platform owner with measured risk and delegated approvals protects public exploitation despite modest CVSS requires urgent prioritization better than an unrealistic generic deadline.
Incorrect Answers
B:Ignoring peak sales period limits downtime can turn a security fix into service disruption while failing to clarify remaining risk.
C:A non-accountable template cannot address peak sales period limits downtime or demonstrate progress on actively exploited edge flaw with critical business impact.
D:Public exploitation despite modest CVSS requires urgent prioritization still requires a documented, reviewed response; difficulty is not indefinite risk acceptance.
Question 72
Online retailer is reviewing a security finding affecting checkout applications: actively exploited edge flaw with critical business impact. The current reporting problem is that patch report sorts only by base CVSS score. A corrective action has been reported complete. What should the next governance update include to establish credible closeout?
- Close actively exploited edge flaw with critical business impact based solely on a self-reported completion email from checkout platform owner with no verification
- Use the number of remediation meetings at Online retailer instead of observed change in externally exploited risk with exposure and interim controls as closeout proof
- Report retested exploit telemetry, reachable endpoint and affected customer route, the outcome against externally exploited risk with exposure and interim controls, remaining exceptions, and owner confirmation
- Discard the pre-change evidence exploit telemetry, reachable endpoint and affected customer route so that only the improved numbers for externally exploited risk with exposure and interim controls remain
Explanation
Correct Answer
C:Exploit telemetry, reachable endpoint and affected customer route provides source-linked closure proof. Showing externally exploited risk with exposure and interim controls and residual exceptions verifies whether checkout platform owner actually reduced public exploitation despite modest CVSS requires urgent prioritization rather than merely marking a ticket closed.
Incorrect Answers
A:Self-declared completion does not demonstrate improved externally exploited risk with exposure and interim controls against documented exploit telemetry, reachable endpoint and affected customer route.
B:Meetings do not confirm that actively exploited edge flaw with critical business impact was corrected or that remaining public exploitation despite modest CVSS requires urgent prioritization is acceptable.
D:Without historical externally exploited risk with exposure and interim controls inputs, leaders cannot validate the claimed improvement or identify recurrence.
Question 73
At Municipal transport agency, analysts monitor ticketing operations server. They observe that an ordinary service account touches hundreds of admin shares outside its ticketing subnet. Evidence: Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration. Which interpretation is the best initial security assessment, before attribution or final confirmation?
- Announce that Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration conclusively proves theft of fare collection availability before reviewing any sessions or file access
- Treat approved configuration management touches a documented host list under a named service identity as conclusive authorization for the current event without matching process or identity
- Downgrade an ordinary service account touches hundreds of admin shares outside its ticketing subnet solely because the same symptom has not yet appeared on another endpoint
- Treat the pattern as a hypothesis of lateral movement using stolen service credentials and begin corroborating it with endpoint and network evidence
Explanation
Correct Answer
D:The combination of an ordinary service account touches hundreds of admin shares outside its ticketing subnet and Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration is suspicious for lateral movement using stolen service credentials. This supports a focused investigation, but the observed indicators alone do not prove final attribution or data loss affecting fare collection availability.
Incorrect Answers
A:Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration is an indicator rather than a measured inventory of transferred sensitive records. Confirmation requires corroboration and scope assessment.
B:The legitimate comparator is approved configuration management touches a documented host list under a named service identity; it does not establish that the current event came from the same approved identity or workflow.
C:An intrusion can begin on one asset. The specific indicator on ticketing operations server warrants its own validation before expanding or closing the investigation.
Question 74
At Municipal transport agency, analysts monitor ticketing operations server. They observe that an ordinary service account touches hundreds of admin shares outside its ticketing subnet. Evidence: Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration. A separate known-good explanation is: approved configuration management touches a documented host list under a named service identity. Which next analysis most reliably determines what caused the observed event?
- Perform a scoped investigation: pair share-access records with service-account privilege changes and process execution
- Accept a public reputation score for the destination as proof of the origin of Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration, without using pair share-access records with service-account privilege changes and process execution
- Suspend telemetry collection on ticketing operations server while waiting for the connection pattern to stop
- Summarize Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration into a ticket and discard underlying event identifiers before correlation
Explanation
Correct Answer
A:Pair share-access records with service-account privilege changes and process execution ties the evidence on ticketing operations server to accountable processes, sessions or connections. It can distinguish the suspicious observation from the approved baseline: approved configuration management touches a documented host list under a named service identity.
Incorrect Answers
B:A reputation score may inform triage but cannot establish the origin of Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration or whether the activity matches approved configuration management touches a documented host list under a named service identity.
C:Suppressing telemetry destroys the source needed to investigate lateral movement using stolen service credentials and may conceal further actions.
D:The original Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration must remain available to verify timestamps, fields, source identity and the analyst’s interpretation.
Question 75
Municipal transport agency has a candidate alert for ticketing operations server: Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration. The team argues it is harmless because approved configuration management touches a documented host list under a named service identity. What is the most defensible false-positive assessment?
- Create a blanket suppression for Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration because approved configuration management touches a documented host list under a named service identity can produce a superficially similar event
- Automatically treat every event resembling Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration as confirmed compromise of ticketing operations server, without checking provenance
- Interpret an absence of existing vendor signatures as proof that an ordinary service account touches hundreds of admin shares outside its ticketing subnet is benign
- Distinguish Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration from the approved behavior (approved configuration management touches a documented host list under a named service identity) by validating process, identity and time attribution
Explanation
Correct Answer
D:Approved configuration management touches a documented host list under a named service identity is a plausible alternative, but it must be proven to match the actual source of Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration. Independent attribution prevents both false suppression and unjustified incident declaration.
Incorrect Answers
A:Similarity to approved configuration management touches a documented host list under a named service identity does not exclude an attacker from producing the same surface event on ticketing operations server.
B:An approved workflow could account for similar activity; correlation is needed before broad response to avoid disrupting fare collection availability.
C:Absence of a signature does not refute the concrete behavior: an ordinary service account touches hundreds of admin shares outside its ticketing subnet.
Question 76
At Municipal transport agency, analysts monitor ticketing operations server. They observe that an ordinary service account touches hundreds of admin shares outside its ticketing subnet. Evidence: Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration. The team confirms unauthorized behavior and must protect fare collection availability; legitimate service continuity remains necessary. Which containment decision is best?
- Erase Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration from the evidence archive during the containment change to reduce repeated alerts
- Apply targeted containment: disable only the suspicious service-account session and segment affected servers after validating failover
- Leave the confirmed unauthorized activity on ticketing operations server unrestricted until actual losses of fare collection availability can be measured
- Disable every production service at Municipal transport agency without measuring whether its dependencies share the observed malicious path
Explanation
Correct Answer
B:Disable only the suspicious service-account session and segment affected servers after validating failover constrains the observed threat while maintaining necessary service for fare collection availability. The response follows the confirmed path rather than making an unsupported blanket shutdown.
Incorrect Answers
A:Eliminating Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration evidence does not contain lateral movement using stolen service credentials and impairs forensic reconstruction.
C:Once unauthorized behavior is confirmed on ticketing operations server, delaying containment could expand the exposure affecting fare collection availability.
D:Global shutdown could disrupt fare collection availability without evidence that every system has been affected; scoped isolation is more proportionate.
Question 77
At Municipal transport agency, analysts have investigated an initial alert involving ticketing operations server and need to scope related activity. Original event: Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration. Which threat-hunt pivot is best grounded in this observation?
- Stop scoping once the initial ticketing operations server has been contained, even though hunt for the same service identity accessing unexpected ADMIN$ shares has not been attempted
- Use the previous month’s overall alert closure count instead of pivoting on Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration across related identities and systems
- Pivot across the environment: hunt for the same service identity accessing unexpected ADMIN$ shares
- Mark every host adjacent to ticketing operations server compromised by assumption without comparing activity-linked observables
Explanation
Correct Answer
C:Hunt for the same service identity accessing unexpected ADMIN$ shares extends the investigation from the specific clue, Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration, to related activity while preserving host and user attribution. This estimates the scope of potential lateral movement using stolen service credentials.
Incorrect Answers
A:The initiating host may not be the only affected one; scoping requires examining the connected evidence Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration.
B:Historical alert volume does not trace the shared indicator or determine whether lateral movement using stolen service credentials spread beyond ticketing operations server.
D:Proximity to ticketing operations server is not proof of exposure; use the activity-linked pivot to identify actual relationships.
Question 78
Municipal transport agency has investigated lateral movement using stolen service credentials on ticketing operations server. Detection operators report that approved configuration management touches a documented host list under a named service identity; simple alerts on a single indicator either overfire or miss related suspicious activity. What rule improvement is most useful?
- Assign critical severity to every routine activity on ticketing operations server whether or not it matches compare service-account network logons to its approved asset inventory and deployment schedule
- Suppress every future event associated with Windows 5140 share-access and 4624 type-3 logons show rapid east-west enumeration, including events outside approved configuration management touches a documented host list under a named service identity
- Improve detection by requiring context-aware correlation: compare service-account network logons to its approved asset inventory and deployment schedule
- Automate service shutdown on the first simple match to an ordinary service account touches hundreds of admin shares outside its ticketing subnet, without validation or guardrails for fare collection availability
Explanation
Correct Answer
C:Compare service-account network logons to its approved asset inventory and deployment schedule retains the specific threat signal while discriminating against approved configuration management touches a documented host list under a named service identity. A correlation is more actionable than a blind match on one common technique.
Incorrect Answers
A:Alert severity without distinguishing approved configuration management touches a documented host list under a named service identity from malicious conditions would increase noise and operational workload.
B:Suppressing all monitoring would also hide a recurrence of lateral movement using stolen service credentials, even where it threatens fare collection availability.
D:An untested, unqualified automation could interrupt fare collection availability and cannot distinguish the benign workflow from attacker behavior.
Question 79
At County records office, the security team assesses document download service. The current issue is encoded dot-dot path traversal; assessment evidence states: scanner obtains config file through %2e%2e sequence. The service is public portal handles tax and deeds records. Operational constraints: nightly batch archive limits downtime. Which assessment approach is most appropriate before recommending a fix?
- Launch unapproved intrusive exploitation across document download service during nightly batch archive limits downtime instead of using a scoped test
- Use only an anonymous outside-in scan of document download service even when public portal handles tax and deeds records requires authenticated deployment context
- Accept the label encoded dot-dot path traversal as confirmed without checking the reported evidence scanner obtains config file through %2e%2e sequence or actual deployment
- Use an authorized, scoped validation approach that considers service sensitivity: normalize path and verify resolved file stays in authorized root
Explanation
Correct Answer
D:The evidence scanner obtains config file through %2e%2e sequence must be evaluated without violating the constraint nightly batch archive limits downtime. A scoped assessment distinguishes an actual relevant flaw from an unsafe intrusive scan.
Incorrect Answers
A:Uncontrolled testing may breach service safety, especially because nightly batch archive limits downtime; authorization and scope are prerequisites.
B:Asset configuration and the constraints of document download service matter; external findings alone may misstate or miss the exposed path.
C:The finding does not establish which live component is affected or whether the exposure public portal handles tax and deeds records is real.
Question 80
At County records office, the security team assesses document download service. The current issue is encoded dot-dot path traversal; assessment evidence states: scanner obtains config file through %2e%2e sequence. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Mark scanner obtains config file through %2e%2e sequence resolved or confirmed solely from the scanner severity without normalize path and verify resolved file stays in authorized root
- Force a destructive proof-of-concept against document download service, ignoring that nightly batch archive limits downtime and a safer validation exist
- Assume document download service is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: normalize path and verify resolved file stays in authorized root
Explanation
Correct Answer
D:Normalize path and verify resolved file stays in authorized root tests the reported condition scanner obtains config file through %2e%2e sequence against actual deployment context (public portal handles tax and deeds records). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:scanner obtains config file through %2e%2e sequence may be accurate but its actual occurrence and configuration on document download service must be established before calling it validated.
B:A destructive proof is unnecessary when normalize path and verify resolved file stays in authorized root can provide authorized evidence and nightly batch archive limits downtime constrains production testing.
C:Security of an unrelated host cannot establish the state of document download service, whose reported issue is encoded dot-dot path traversal.
