CompTIA CS0-003 Practice Test 9
Question 80
At County records office, the security team assesses document download service. The current issue is encoded dot-dot path traversal; assessment evidence states: scanner obtains config file through %2e%2e sequence. An analyst must separate confirmed impact from scanner assumptions. Which follow-up provides the strongest finding validation?
- Mark scanner obtains config file through %2e%2e sequence resolved or confirmed solely from the scanner severity without normalize path and verify resolved file stays in authorized root
- Force a destructive proof-of-concept against document download service, ignoring that nightly batch archive limits downtime and a safer validation exist
- Assume document download service is safe because another platform with similar software recently passed its own assessment
- Confirm the reported condition in the relevant asset context: normalize path and verify resolved file stays in authorized root
Explanation
Correct Answer
D:Normalize path and verify resolved file stays in authorized root tests the reported condition scanner obtains config file through %2e%2e sequence against actual deployment context (public portal handles tax and deeds records). That is stronger evidence than simply copying a scanner label.
Incorrect Answers
A:scanner obtains config file through %2e%2e sequence may be accurate but its actual occurrence and configuration on document download service must be established before calling it validated.
B:A destructive proof is unnecessary when normalize path and verify resolved file stays in authorized root can provide authorized evidence and nightly batch archive limits downtime constrains production testing.
C:Security of an unrelated host cannot establish the state of document download service, whose reported issue is encoded dot-dot path traversal.
Question 81
At County records office, the security team assesses document download service. The current issue is encoded dot-dot path traversal; assessment evidence states: scanner obtains config file through %2e%2e sequence. Another internal test host has a higher numerical scanner severity but is segregated and has no customer-data access. Which finding should receive risk-based attention first?
- Give every vulnerability the same deadline despite encoded dot-dot path traversal and business impact on public record and secrets exposure
- Choose the highest nominal scanner severity first while ignoring public portal handles tax and deeds records and the consequence to public record and secrets exposure
- Prioritize the confirmed exposure of document download service, accounting for public record and secrets exposure and the real access path: public portal handles tax and deeds records
- Choose whatever finding on document download service was logged most recently, regardless of actual exploit path or priority
Explanation
Correct Answer
C:Risk depends on practical reachability, threat activity and consequence. The issue encoded dot-dot path traversal can affect public record and secrets exposure through public portal handles tax and deeds records; a higher base score on an isolated host is not automatically a higher business priority.
Incorrect Answers
A:Uniform priority ignores public portal handles tax and deeds records, operational harm and public record and secrets exposure; documented context makes triage defensible.
B:CVSS describes technical characteristics, not the entirety of exposure and public record and secrets exposure for this deployment.
D:Discovery order is not evidence of urgency compared with the actual affected document download service.
Question 82
At County records office, the security team assesses document download service. The current issue is encoded dot-dot path traversal; assessment evidence states: scanner obtains config file through %2e%2e sequence. Testing confirms the reported vulnerability is exploitable in the described configuration. What lasting mitigation most directly addresses its underlying cause?
- Leave encoded dot-dot path traversal present indefinitely because no incident involving public record and secrets exposure was recorded this week
- Sign an exception document but do not implement or test canonicalize and constrain paths plus filesystem least privilege on document download service
- Implement and verify the root-cause fix: canonicalize and constrain paths plus filesystem least privilege
- Use reverse-proxy normalized path block pending app patch as permanent closure of the confirmed issue instead of deploying canonicalize and constrain paths plus filesystem least privilege
Explanation
Correct Answer
C:Canonicalize and constrain paths plus filesystem least privilege targets the mechanism encoded dot-dot path traversal rather than only filtering symptoms. Verification must account for scanner obtains config file through %2e%2e sequence and continued protection of public record and secrets exposure.
Incorrect Answers
A:No observed attack does not correct the verified condition scanner obtains config file through %2e%2e sequence or eliminate its potential impact on public record and secrets exposure.
B:Risk acceptance paperwork does not itself remediate encoded dot-dot path traversal on document download service; authorized, tested implementation is still required when the risk exceeds tolerance.
D:The interim control may reduce exposure, but it can leave the underlying encoded dot-dot path traversal and should be time-limited with verification and owner oversight.
Question 83
At County records office, the security team assesses document download service. The current issue is encoded dot-dot path traversal; assessment evidence states: scanner obtains config file through %2e%2e sequence. A permanent correction cannot be deployed immediately because nightly batch archive limits downtime. Which interim treatment is the safest governed option?
- Claim encoded dot-dot path traversal is patched when the change ticket opens, without confirming reverse-proxy normalized path block pending app patch or a planned permanent change
- Apply a time-bound compensating measure, reverse-proxy normalized path block pending app patch, record the residual risk owner and schedule the tested permanent fix
- Accept continued exposure of public record and secrets exposure without any owner, expiry or compensating verification because nightly batch archive limits downtime
- Push canonicalize and constrain paths plus filesystem least privilege immediately to all production systems with no safe change window despite nightly batch archive limits downtime
Explanation
Correct Answer
B:Reverse-proxy normalized path block pending app patch can reduce short-term exposure while nightly batch archive limits downtime delays full remediation. The exception must have a defined owner, expiry, monitoring and tested repair plan because public record and secrets exposure remains at stake.
Incorrect Answers
A:A work item is not proof that encoded dot-dot path traversal was corrected or even that reverse-proxy normalized path block pending app patch operates.
C:Business criticality increases the need for accountable decisions and review; it does not make public record and secrets exposure irrelevant.
D:Ignoring nightly batch archive limits downtime could cause avoidable service failure and is not a risk-aware remediation process.
Question 84
At County records office, the security team assesses document download service. The current issue is encoded dot-dot path traversal; assessment evidence states: scanner obtains config file through %2e%2e sequence. The owner reports that canonicalize and constrain paths plus filesystem least privilege has been deployed. What evidence should close the vulnerability item?
- Close scanner obtains config file through %2e%2e sequence after the deployment tool returns success, without verifying the current state of document download service
- Retest the originally affected configuration using normalize path and verify resolved file stays in authorized root, confirm the vulnerability is gone and record change evidence
- Suppress future results for encoded dot-dot path traversal so that the vulnerability dashboard shows a completed remediation
- Use an unrelated server’s clean findings to claim document download service is fixed without retesting the affected path
Explanation
Correct Answer
B:Closure requires checking the same affected path identified by scanner obtains config file through %2e%2e sequence, plus regression impact on document download service. A change ticket alone is not proof of removal of encoded dot-dot path traversal.
Incorrect Answers
A:Process completion is not evidence that scanner obtains config file through %2e%2e sequence no longer applies to document download service.
C:Suppression may hide a failed or incomplete fix, leaving public record and secrets exposure exposed despite the administrative record.
D:The result must be tied to document download service and the actual exposure: public portal handles tax and deeds records.
Question 85
At Retail ticketing vendor, the incident team supports reservation web server. A new security event is reported: a web shell appears after repeated POST requests to a vulnerable upload endpoint. The log clue is: WAF logs and child shell process show attacker command execution. How should an analyst apply an attack-method framework at this point without overclaiming who the attacker is?
- Assign a final attack-chain stage to reservation web server without confirming what behavior actually occurred in WAF logs and child shell process show attacker command execution
- Map the observed behavior in WAF logs and child shell process show attacker command execution to a technique-level ATT&CK or kill-chain hypothesis and record confidence
- Attribute a web shell appears after repeated POST requests to a vulnerable upload endpoint to a named foreign intelligence service using only WAF logs and child shell process show attacker command execution
- Treat an ATT&CK label for a web shell appears after repeated POST requests to a vulnerable upload endpoint as a complete recovery instruction without checking evidence or impact
Explanation
Correct Answer
B:A web shell appears after repeated POST requests to a vulnerable upload endpoint and WAF logs and child shell process show attacker command execution support classification of observed attacker behavior, not confident attribution to a specific actor. Technique mapping helps correlate and anticipate later actions.
Incorrect Answers
A:Attack frameworks describe observable stages and techniques; the WAF logs and child shell process show attacker command execution must substantiate whichever stage is assigned.
C:Neither a web shell appears after repeated POST requests to a vulnerable upload endpoint nor WAF logs and child shell process show attacker command execution establishes uniquely identifying actor evidence.
D:A taxonomy is not an incident response plan for reservation web server; scope and safety constraints still matter.
Question 86
At Retail ticketing vendor, the incident team supports reservation web server. A new security event is reported: a web shell appears after repeated POST requests to a vulnerable upload endpoint. The log clue is: WAF logs and child shell process show attacker command execution. The team expects later legal and technical review. Which acquisition step best preserves a defensible evidence trail?
- Keep only a screenshot of WAF logs and child shell process show attacker command execution, discarding original artifacts such as server disk image, process memory and reverse-proxy request logs with timestamps
- Rebuild reservation web server first and collect the volatile evidence for a web shell appears after repeated POST requests to a vulnerable upload endpoint afterward
- Preserve and hash incident artifacts: server disk image, process memory and reverse-proxy request logs with timestamps
- Alter original WAF logs and child shell process show attacker command execution entries to remove irrelevant records before preserving the forensic timeline
Explanation
Correct Answer
C:Server disk image, process memory and reverse-proxy request logs with timestamps retains relevant source context and integrity checks so the team can reconstruct a web shell appears after repeated POST requests to a vulnerable upload endpoint and support an auditable chain of custody.
Incorrect Answers
A:A screenshot cannot replace the underlying server disk image, process memory and reverse-proxy request logs with timestamps needed to establish sequence and integrity.
B:Volatile evidence relevant to a web shell appears after repeated POST requests to a vulnerable upload endpoint may disappear during remediation or reboot.
D:Changing the original WAF logs and child shell process show attacker command execution compromises provenance and makes later findings harder to verify.
Question 87
At Retail ticketing vendor, the incident team supports reservation web server. A new security event is reported: a web shell appears after repeated POST requests to a vulnerable upload endpoint. The log clue is: WAF logs and child shell process show attacker command execution. The incident remains active, but reservation web server is operationally important. Which containment decision is most appropriate now?
- Publish a speculative full-incident attribution notice before constraining the active behavior a web shell appears after repeated POST requests to a vulnerable upload endpoint
- Erase WAF logs and child shell process show attacker command execution to reduce alert volume rather than isolating the observed attacker route
- Execute scoped containment: remove public reachability of affected upload path and route reservations to standby
- Disconnect every service at Retail ticketing vendor, regardless of whether it has a dependency on the affected reservation web server
Explanation
Correct Answer
C:Remove public reachability of affected upload path and route reservations to standby stops or limits the observed path while balancing continuity of reservation web server. It is a response to the current incident, not a replacement for evidence handling.
Incorrect Answers
A:Communication matters, but active a web shell appears after repeated POST requests to a vulnerable upload endpoint requires proportionate containment and evidence preservation first.
B:Erasing WAF logs and child shell process show attacker command execution neither blocks attacker access nor supports a reliable subsequent recovery decision.
D:Broad interruption may unnecessarily affect reservation web server; containment should be scoped to evidenced systems and approved critical-service requirements.
Question 88
At Retail ticketing vendor, the incident team supports reservation web server. A new security event is reported: a web shell appears after repeated POST requests to a vulnerable upload endpoint. The log clue is: WAF logs and child shell process show attacker command execution. The active incident path is now isolated and evidence is retained. What should eradication focus on before service is restored?
- Remove the attack’s established access and persistence: rebuild from trusted image, patch unsafe upload handling and rotate host secrets
- Restore reservation web server without first correcting the access and persistence cause addressed by rebuild from trusted image, patch unsafe upload handling and rotate host secrets
- Use only the original firewall block and assume it has also removed all persistence behind a web shell appears after repeated POST requests to a vulnerable upload endpoint
- Rewrite the playbook for reservation web server but leave the confirmed malicious access mechanism active
Explanation
Correct Answer
A:Rebuild from trusted image, patch unsafe upload handling and rotate host secrets targets the mechanism behind a web shell appears after repeated POST requests to a vulnerable upload endpoint, reducing recurrence when reservation web server returns to normal operations.
Incorrect Answers
B:Recovery before rebuild from trusted image, patch unsafe upload handling and rotate host secrets could reintroduce the same compromise path.
C:Containment can stop communication without eliminating the root access that produced WAF logs and child shell process show attacker command execution.
D:Updated paperwork does not eradicate the mechanism behind a web shell appears after repeated POST requests to a vulnerable upload endpoint.
Question 89
At Retail ticketing vendor, the incident team supports reservation web server. A new security event is reported: a web shell appears after repeated POST requests to a vulnerable upload endpoint. The log clue is: WAF logs and child shell process show attacker command execution. Containment and eradication are complete. Which recovery acceptance test should precede release of reservation web server to normal users?
- Expose reservation web server to users before confirming that the conditions behind a web shell appears after repeated POST requests to a vulnerable upload endpoint are absent
- Approve recovery of reservation web server when it boots, without executing the test test resumed booking on clean infrastructure and compare outbound connections to baseline
- Perform controlled return-to-service validation: test resumed booking on clean infrastructure and compare outbound connections to baseline
- Delete preserved evidence including server disk image, process memory and reverse-proxy request logs with timestamps as soon as the service restarts
Explanation
Correct Answer
C:Test resumed booking on clean infrastructure and compare outbound connections to baseline demonstrates that the compromised pathway is absent while reservation web server again supports legitimate business processes. Verified recovery differs from mere uptime.
Incorrect Answers
A:Without a clean functional/security validation, reservation web server could immediately face the same exploit condition.
B:A boot event cannot prove test resumed booking on clean infrastructure and compare outbound connections to baseline or protect the service from recurrence of a web shell appears after repeated POST requests to a vulnerable upload endpoint.
D:Evidence retention obligations continue beyond restart; server disk image, process memory and reverse-proxy request logs with timestamps may be required for subsequent review.
Question 90
At Retail ticketing vendor, the incident team supports reservation web server. A new security event is reported: a web shell appears after repeated POST requests to a vulnerable upload endpoint. The log clue is: WAF logs and child shell process show attacker command execution. The incident has been contained and normal service has resumed. A post-incident review identifies that unrestricted script uploads enabled executable web root. Which improvement should be prioritized?
- Close the follow-up for reservation web server merely because restoration completed, without addressing unrestricted script uploads enabled executable web root
- Assign an owner and measurable corrective action addressing the root cause: unrestricted script uploads enabled executable web root, with a future effectiveness test
- Discipline the whole on-duty response shift rather than examining the documented weakness unrestricted script uploads enabled executable web root
- Write a lessons-learned memo about a web shell appears after repeated POST requests to a vulnerable upload endpoint with no due date, control owner or validation activity
Explanation
Correct Answer
B:Unrestricted script uploads enabled executable web root was the systemic weakness that enabled or worsened a web shell appears after repeated POST requests to a vulnerable upload endpoint. An assigned, testable correction and later validation strengthen preparation against recurrence.
Incorrect Answers
A:Service restoration does not address unrestricted script uploads enabled executable web root; ignoring it leaves the next incident likely to follow the same route.
C:A personnel-only response lacks support from the documented root cause: unrestricted script uploads enabled executable web root.
D:An unowned recommendation does not produce a verified control improvement for reservation web server.
