CompTIA CS0-003 Practice Test 15

Question 140

An API gateway sees a sudden request surge from thousands of unrelated addresses with high error rates. What is the MOST appropriate analyst action based on the evidence?

Examine SYN backlog and source distribution, then activate appropriate SYN-flood protection.
Isolate the rogue bridge and validate spanning-tree and loop prevention telemetry.
Correlate database change time, pool errors and transaction latency before calling it an attack.
Assess traffic distribution and application resource saturation before applying rate limits.

Explanation

Correct Answer

Distributed request floods require distinction from legitimate demand spikes. Triage distributed application-layer denial.

Incorrect Answers

Unfinished TCP handshakes can exhaust connection state resources. It could help identify TCP SYN flooding, but it would not triage distributed application-layer denial.

Layer-two loops can overwhelm a LAN without any attacker C2 traffic. That is relevant to network denial and disruption, not to triage distributed application-layer denial.

Service interruption alone is insufficient to prove hostile traffic. It would distinguish deployment outage from attack, but it would not triage distributed application-layer denial.

Question 141

An API accepts many valid tokens but one token enumerates all customers' records sequentially. Which next step is MOST defensible for the security team?

Review per-object authorization and token activity for broken object-level access control.
Inspect reflected parameters and output encoding for cross-site scripting.
Correlate request payloads with database errors and investigate possible injection.
Inspect web server request logs and test whether path canonicalization permits traversal.

Explanation

Correct Answer

Authentication alone does not ensure authorization for each requested object. Detect API object authorization abuse.

Incorrect Answers

Unescaped user input rendered into pages can enable script execution. It would detect reflected XSS in search responses, but it would not detect API object authorization abuse.

Error-based SQL injection may expose query construction weaknesses. It could help triage SQL injection probe behavior, but it would not detect API object authorization abuse.

Encoded traversal attempts target files outside the intended web root. That is relevant to web application abnormal activity, not to detect API object authorization abuse.

Question 142

An IDS flags a base64 string in HTTP traffic but the application routinely sends encoded thumbnails. Which action BEST aligns with sound security operations?

Inspect protocol fingerprints and identify the initiating process for tunneling.
Decode a representative sample and inspect content plus destination and process context.
Check whether scripting tools or web crawlers are approved, then inspect request targets.
Correlate user session, destination and process launch before blocking the outbound session.

Explanation

Correct Answer

Encoding is a transport convention and not proof of malware by itself. Distinguish base64 application data from obfuscation.

Incorrect Answers

Port number alone does not establish that the protocol is HTTPS. It would detect protocol mismatch on common port, but it would not distinguish base64 application data from obfuscation.

Automated scanning behavior may indicate reconnaissance or legitimate testing. That is relevant to malicious network payload clues, not to distinguish base64 application data from obfuscation.

Unexpected interactive remote control can signal unauthorized support or intrusion. It would investigate external RDP session, but it would not distinguish base64 application data from obfuscation.

Question 143

A workstation suddenly uses RDP to connect to an unapproved external host. Which response BEST addresses the security problem described?

Inspect protocol fingerprints and identify the initiating process for tunneling.
Check whether scripting tools or web crawlers are approved, then inspect request targets.
Correlate user session, destination and process launch before blocking the outbound session.
Decode a representative sample and inspect content plus destination and process context.

Explanation

Correct Answer

Unexpected interactive remote control can signal unauthorized support or intrusion. Investigate external RDP session.

Incorrect Answers

Port number alone does not establish that the protocol is HTTPS. It could help detect protocol mismatch on common port, but it would not investigate external RDP session.

Automated scanning behavior may indicate reconnaissance or legitimate testing. That is relevant to malicious network payload clues, not to investigate external RDP session.

Encoding is a transport convention and not proof of malware by itself. It could help distinguish base64 application data from obfuscation, but it would not investigate external RDP session.

Question 144

An application deployment changes the checksum of a production binary outside the approved window. Which investigative or response action BEST fits the evidence?

Validate the signature chain and approved transformation before accepting integrity.
Preserve transaction records and compare changes with authorized application workflows.
Check audit service state, event deletion and privilege changes before assuming sensor failure.
Compare the hash with trusted build artifacts and inspect deployment provenance.

Explanation

Correct Answer

Hash mismatches flag changed bytes but require authoritative baseline context. Investigate unapproved application binary change.

Incorrect Answers

Recomputed content hashes reveal modification even if the file remains readable. That is relevant to data integrity and tampering, not to investigate unapproved application binary change.

Broad integrity-changing writes may signify fraud or compromised automation. It would investigate unauthorized database modification, but it would not investigate unapproved application binary change.

Selective logging gaps may indicate deliberate defense evasion. It could help triage suspicious audit-log suppression, but it would not investigate unapproved application binary change.

Question 145

A Windows host uses `certutil -urlcache` followed by an executable appearing in temp. What is the MOST appropriate analyst action based on the evidence?

Correlate certutil command parameters with downloaded file hashes and execution events.
Decode safely and correlate the child command with destination reputation and signer.
Identify the downloaded script and execution history; block unapproved privileged execution.
Confirm process ownership and documented testing scope before treating enumeration as hostile.

Explanation

Correct Answer

Certificate utilities can be abused to stage payloads outside normal installers. Triage certutil download abuse.

Incorrect Answers

Obfuscation plus unapproved network retrieval increases maliciousness suspicion. It could help analyze encoded PowerShell download, but it would not triage certutil download abuse.

Executing remote content without validation risks immediate host compromise. That is relevant to unusual command-line activity, not to triage certutil download abuse.

Reconnaissance commands are dual-use and require execution context. It would evaluate legitimate admin command enumeration, but it would not triage certutil download abuse.

Question 146

A database audit records mass updates to account balances by an unexpected service identity. Which next step is MOST defensible for the security team?

Compare the hash with trusted build artifacts and inspect deployment provenance.
Preserve transaction records and compare changes with authorized application workflows.
Validate the signature chain and approved transformation before accepting integrity.
Check audit service state, event deletion and privilege changes before assuming sensor failure.

Explanation

Correct Answer

Broad integrity-changing writes may signify fraud or compromised automation. Investigate unauthorized database modification.

Incorrect Answers

Hash mismatches flag changed bytes but require authoritative baseline context. It could help investigate unapproved application binary change, but it would not investigate unauthorized database modification.

Recomputed content hashes reveal modification even if the file remains readable. It would assess document tampering after conversion, but it would not investigate unauthorized database modification.

Selective logging gaps may indicate deliberate defense evasion. It could help triage suspicious audit-log suppression, but it would not investigate unauthorized database modification.

Question 147

A container host exhibits unexplained CPU spikes due to many compute-heavy unapproved processes. Which action BEST aligns with sound security operations?

Inspect process ancestry, accepted sessions and destination network flow for shell access.
Check cron change audit logs, file ownership and binary hash against change records.
Inspect process arguments, image provenance and external mining-pool connections.
Correlate HTTP request parameters with process executions and application vulnerability evidence.

Explanation

Correct Answer

Sustained compute consumption can reflect cryptojacking, but resource evidence needs attribution. Investigate suspected cryptominer activity.

Incorrect Answers

Service-child behavior can indicate exploit-driven command execution or abused SSH sessions. That is relevant to linux compromise indicators, not to investigate suspected cryptominer activity.

Privileged persistence in writable locations is high risk without authorization. It would triage malicious root cron persistence, but it would not investigate suspected cryptominer activity.

Web-server children executing shells suggest possible command injection. That is relevant to linux compromise indicators, not to investigate suspected cryptominer activity.

Question 148

A cloud audit reports repeated object-list and bulk-read APIs from a new ASN. Which response BEST addresses the security problem described?

Review API audit caller and admission policy exceptions for privilege escalation.
Link cloud API creation, instance metadata and process telemetry to the initiating identity.
Check consent grants, effective scopes and outbound message records for abuse.
Correlate the access-key identity, source network, bucket permissions and downloaded bytes.

Explanation

Correct Answer

Unexpected mass object access may indicate stolen cloud credentials. Triage suspicious cloud object enumeration.

Incorrect Answers

Container privilege requests are meaningful only with RBAC and admission context. It would investigate unauthorized privileged pod launch, but it would not triage suspicious cloud object enumeration.

Abuse can cross control-plane provisioning and guest execution. It could help correlate suspicious cloud provisioning, but it would not triage suspicious cloud object enumeration.

Delegated app permissions enable mailbox operations without interactive sign-ins. That is relevant to cloud abuse patterns, not to triage suspicious cloud object enumeration.

Question 149

A proxy logs hundreds of requests with rotating user agents from one device. Which investigative or response action BEST fits the evidence?

Check whether scripting tools or web crawlers are approved, then inspect request targets.
Decode a representative sample and inspect content plus destination and process context.
Inspect protocol fingerprints and identify the initiating process for tunneling.
Correlate user session, destination and process launch before blocking the outbound session.

Explanation

Correct Answer

Automated scanning behavior may indicate reconnaissance or legitimate testing. Triage suspicious HTTP user-agent rotation.

Incorrect Answers

Encoding is a transport convention and not proof of malware by itself. That is relevant to malicious network payload clues, not to triage suspicious HTTP user-agent rotation.

Port number alone does not establish that the protocol is HTTPS. It would detect protocol mismatch on common port, but it would not triage suspicious HTTP user-agent rotation.

Unexpected interactive remote control can signal unauthorized support or intrusion. It could help investigate external RDP session, but it would not triage suspicious HTTP user-agent rotation.

Question 150

A legitimate updater runs from the vendor directory but a child process loads a DLL from user temp. What is the MOST appropriate analyst action based on the evidence?

Trace browser download, child process and task creation to establish the execution chain.
Validate the DLL path, signature and parent load behavior for possible sideloading.
Capture command arguments and mapped module evidence before host isolation.
Examine the document macro, child command and network destination in the EDR timeline.

Explanation

Correct Answer

Trusted parent processes can execute malicious libraries through unsafe search paths. Detect potential DLL sideloading.

Incorrect Answers

Signed system tools can be abused for persistence after browser compromise. That is relevant to suspicious windows process trees, not to detect potential DLL sideloading.

Living-off-the-land utilities can load unexpected content through valid binaries. It could help triage rundll32 remote module execution, but it would not detect potential DLL sideloading.

Office-to-shell ancestry is suspicious when followed by external communication. That is relevant to suspicious windows process trees, not to detect potential DLL sideloading.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 13 - 10 Questions (Last Reviewed 02-Nov-2026)
CompTIA CS0-003 Practice Test 14 - 10 Questions (Last Reviewed 01-Nov-2026)
CompTIA CS0-003 Practice Test 15 - 10 Questions (Last Reviewed 31-Oct-2026)
CompTIA CS0-003 Practice Test 16 - 10 Questions (Last Reviewed 30-Oct-2026)
CompTIA CS0-003 Practice Test 17 - 10 Questions (Last Reviewed 29-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 140

Explanation

Correct Answer

Incorrect Answers

Question 141

Explanation

Correct Answer

Incorrect Answers

Question 142

Explanation

Correct Answer

Incorrect Answers

Question 143

Explanation

Correct Answer

Incorrect Answers

Question 144

Explanation

Correct Answer

Incorrect Answers

Question 145

Explanation

Correct Answer

Incorrect Answers

Question 146

Explanation

Correct Answer

Incorrect Answers

Question 147

Explanation

Correct Answer

Incorrect Answers

Question 148

Explanation

Correct Answer

Incorrect Answers

Question 149

Explanation

Correct Answer

Incorrect Answers

Question 150

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests