CompTIA CS0-003 Practice Test 1

Question 1

A break-glass account logs in during a scheduled maintenance outage without a ticket. Which next step is MOST defensible for the security team?

Validate emergency authorization and record the privileged session for review.
Correlate the source, user, MFA result and subsequent activity before declaring compromise.
Review and revoke excessive consent and restrict high-risk app grants.
Revoke active sessions and verify token revocation or conditional access behavior.

Explanation

Correct Answer

Emergency accounts require explicit high-signal governance despite legitimate uses. Investigate break-glass account use.

Incorrect Answers

Authentication success after failures needs contextual validation rather than automatic certainty. It could help triage password-spray-like authentication, but it would not investigate break-glass account use.

OAuth delegation can expose data without new password sign-ins. That is relevant to identity telemetry and session anomalies, not to investigate break-glass account use.

Existing issued tokens can outlive an identity state change. It would invalidate persistent access tokens, but it would not investigate break-glass account use.

Question 2

A cluster autoscaler creates nodes without the required endpoint security agent. Which action BEST aligns with sound security operations?

Preserve immutable versioned backups and verify recovery points preceding encryption.
Enforce boot-time enrollment and reject noncompliant nodes from sensitive workloads.
Configure equivalent log forwarding on active and standby units and test failover.
Add the recovery environment to log ingestion and test detection in DR exercises.

Explanation

Correct Answer

Dynamic infrastructure requires automated baseline enforcement. Secure newly scaled compute nodes.

Incorrect Answers

Synchronous replication is not a substitute for clean historical recovery. It could help keep recoverable backup versions, but it would not secure newly scaled compute nodes.

High availability must preserve security telemetry across failover events. It would maintain firewall logs through failover, but it would not secure newly scaled compute nodes.

Monitoring continuity is part of operational recovery readiness. It could help validate monitoring in DR environment, but it would not secure newly scaled compute nodes.

Question 3

A cloud audit shows a service role given wildcard storage permissions for one job. Which response BEST addresses the security problem described?

Validate source identity and session evidence, then investigate and disable unauthorized use.
Block public access and investigate policy changes using control-plane logs.
Replace wildcard permissions with resource- and action-scoped service-role policy.
Ingest cloud activity and configuration audit logs in addition to guest telemetry.

Explanation

Correct Answer

Narrow entitlements limit the impact of a compromised automation identity. Remediate overbroad cloud service permissions.

Incorrect Answers

Root activity is high-impact and cannot be accepted solely because MFA was present. That is relevant to cloud entitlement and control-plane coverage, not to remediate overbroad cloud service permissions.

Exposure is an authorization problem requiring containment and attribution. It would contain misconfigured public cloud storage, but it would not remediate overbroad cloud service permissions.

Cloud security-group edits occur in the control plane outside guest logging. That is relevant to cloud entitlement and control-plane coverage, not to remediate overbroad cloud service permissions.

Question 4

A new storage bucket is publicly readable despite the approved private-data standard. Which investigative or response action BEST fits the evidence?

Ingest cloud activity and configuration audit logs in addition to guest telemetry.
Replace wildcard permissions with resource- and action-scoped service-role policy.
Validate source identity and session evidence, then investigate and disable unauthorized use.
Block public access and investigate policy changes using control-plane logs.

Explanation

Correct Answer

Exposure is an authorization problem requiring containment and attribution. Contain misconfigured public cloud storage.

Incorrect Answers

Cloud security-group edits occur in the control plane outside guest logging. It would add cloud control-plane monitoring, but it would not contain misconfigured public cloud storage.

Narrow entitlements limit the impact of a compromised automation identity. It could help remediate overbroad cloud service permissions, but it would not contain misconfigured public cloud storage.

Root activity is high-impact and cannot be accepted solely because MFA was present. That is relevant to cloud entitlement and control-plane coverage, not to contain misconfigured public cloud storage.

Question 5

Containers disappear after a deployment and incident investigators lose their application logs. What is the MOST appropriate analyst action based on the evidence?

Forward container stdout and security events outside the ephemeral container filesystem.
Apply configuration monitoring inside each guest and compare against the approved baseline.
Map workload and account identifiers during central SIEM normalization.
Enable function execution and cloud control-plane logging with a protected central sink.

Explanation

Correct Answer

External log persistence preserves evidence when containers are replaced. Preserve container telemetry across redeployments.

Incorrect Answers

Hypervisor hardening alone does not ensure guest operating-system integrity. That is relevant to cloud and on-prem telemetry boundaries, not to preserve container telemetry across redeployments.

Entity enrichment allows cross-environment activity to be correlated. It would link identities across cloud and data center, but it would not preserve container telemetry across redeployments.

Ephemeral workloads need centrally retained logs beyond their short lifetime. It could help observe short-lived serverless actions, but it would not preserve container telemetry across redeployments.

Question 6

Plant historians forward logs only while their engineering console remains connected. Which next step is MOST defensible for the security team?

Switch to passive traffic discovery and schedule any authenticated checks with OT owners.
Establish resilient out-of-band collection with buffering for intermittent links.
Enforce approved jump-host access and isolate the safety network from office clients.
Route privileged maintenance through approved monitored remote access with time-bound grants.

Explanation

Correct Answer

Security event preservation must tolerate disconnected control networks. Protect OT telemetry across disconnections.

Incorrect Answers

Fragile real-time devices can be disrupted by aggressive probes. That is relevant to segregated ot monitoring, not to protect OT telemetry across disconnections.

Segmented control access reduces the blast radius of corporate compromise. It could help restrict unsafe IT-to-OT connectivity, but it would not protect OT telemetry across disconnections.

Controlled remote support gives accountability and reduces persistent exposure. That is relevant to segregated ot monitoring, not to protect OT telemetry across disconnections.

Question 7

A DNS resolver starts forwarding internal query logs to an unknown external sink. Which action BEST aligns with sound security operations?

Validate inventory and enforce port or network access control for the approved device.
Restrict management access to a segregated administrative network.
Verify forwarding configuration and block unauthorized telemetry export.
Protect the internal hop with appropriate transport encryption or segmented trust boundary.

Explanation

Correct Answer

Security logs can themselves contain sensitive infrastructure intelligence. Stop unauthorized DNS-log forwarding.

Incorrect Answers

Unexpected attachment may represent rogue access or maintenance drift. It would investigate unauthorized switch port attachment, but it would not stop unauthorized DNS-log forwarding.

Guest access to device control planes increases privilege-escalation opportunity. It could help isolate network-device management plane, but it would not stop unauthorized DNS-log forwarding.

Terminating TLS at the edge does not secure exposed backend traffic. It would remediate unencrypted backend service hop, but it would not stop unauthorized DNS-log forwarding.

Question 8

A branch's secure web gateway reports encrypted traffic it cannot inspect by policy. Which response BEST addresses the security problem described?

Restrict lateral traffic with workload segmentation and allow only approved management paths.
Apply identity- and application-specific deny-by-default microsegmentation policy.
Fix the sanctioned access policy and confirm traffic follows the approved SASE path.
Document the visibility gap and correlate permitted metadata with endpoint telemetry.

Explanation

Correct Answer

Encryption boundaries require alternate evidence rather than invisible payload assumptions. Investigate encrypted traffic without payload access.

Incorrect Answers

Internal zone boundaries reduce attacker movement after initial compromise. It could help restrict east-west administrative exposure, but it would not investigate encrypted traffic without payload access.

Broad flat connectivity defeats the intended tier separation. That is relevant to network boundaries and segmentation, not to investigate encrypted traffic without payload access.

A bypass defeats centrally enforced access and security controls. It would close SASE application bypass, but it would not investigate encrypted traffic without payload access.

Question 9

An SSO session remains valid even after the underlying employee account is suspended. Which investigative or response action BEST fits the evidence?

Revoke active sessions and verify token revocation or conditional access behavior.
Correlate the source, user, MFA result and subsequent activity before declaring compromise.
Validate emergency authorization and record the privileged session for review.
Review and revoke excessive consent and restrict high-risk app grants.

Explanation

Correct Answer

Existing issued tokens can outlive an identity state change. Invalidate persistent access tokens.

Incorrect Answers

Authentication success after failures needs contextual validation rather than automatic certainty. It would triage password-spray-like authentication, but it would not invalidate persistent access tokens.

Emergency accounts require explicit high-signal governance despite legitimate uses. It could help investigate break-glass account use, but it would not invalidate persistent access tokens.

OAuth delegation can expose data without new password sign-ins. That is relevant to identity telemetry and session anomalies, not to invalidate persistent access tokens.

Question 10

A security baseline scan shows kernel auditing disabled after a package rollout. What is the MOST appropriate analyst action based on the evidence?

Inspect the autorun value, signer and process ancestry against the approved baseline.
Compare the change with authorized configuration management and restore audit enforcement.
Decode the command safely and correlate task creator, process tree and network activity.
Review the unit file, executable path and deployment history.

Explanation

Correct Answer

Unapproved audit weakening removes visibility into subsequent activity. Remediate disabled kernel audit.

Incorrect Answers

Registry startup entries can provide persistence and warrant source validation. It would investigate registry autorun persistence, but it would not remediate disabled kernel audit.

Encoded text alone is not proof, but linked execution context exposes intent. That is relevant to os persistence and baseline evidence, not to remediate disabled kernel audit.

Service persistence can blend into normal boot behavior unless baselined. It would investigate suspicious Linux service installation, but it would not remediate disabled kernel audit.