CompTIA CS0-003 Practice Test 19

Question 180

An account logs in before a malware execution but the SIEM joins events across a twelve-hour window. What is the MOST appropriate analyst action based on the evidence?

Validate normalized fields against raw source logs before trusting correlation results.
Normalize identity fields before running a time-bounded correlation.
Deduplicate source event IDs and validate ingestion pipelines before tuning severity.
Narrow correlation windows using observed attack timings and clock accuracy.

Explanation

Correct Answer

Overly broad joins can attribute unrelated user actions to execution. Reduce false joins from broad time window.

Incorrect Answers

Incorrect field extraction reverses directionality and contaminates detections. That is relevant to siem query correlation and time windows, not to reduce false joins from broad time window.

Field-format differences can hide otherwise related authentication and execution. It would normalize identities for event join, but it would not reduce false joins from broad time window.

Ingestion duplication inflates alert counts without new adversary activity. It could help correct duplicate SIEM alert source, but it would not reduce false joins from broad time window.

Question 181

An internal alert is triggered by an approved adversary emulation with the exact suspicious technique. Which next step is MOST defensible for the security team?

Correlate exercise identifiers and scope with detection evidence, preserving its test result.
Check current DNS resolution and sinkhole notice before treating the IP as attacker infrastructure.
Query exact content hashes and execution evidence rather than filename matches.
Check telemetry retention and relevant NAT/proxy paths before declaring no exposure.

Explanation

Correct Answer

Expected test activity still supplies valid detection coverage evidence. Categorize approved emulation alert correctly.

Incorrect Answers

Changed indicator context can reverse the meaning of later network hits. It could help avoid sinkhole IP false attribution, but it would not categorize approved emulation alert correctly.

Filenames are easy to change while the artifact digest remains stable. That is relevant to ioc handling and correlation, not to categorize approved emulation alert correctly.

Missing hits can reflect incomplete collection rather than clean endpoints. It would test IOC hunt visibility limits, but it would not categorize approved emulation alert correctly.

Question 182

A packet capture shows SYN packets without SYN-ACK replies between two internal zones. Which action BEST aligns with sound security operations?

Extract the payload from the capture safely and calculate its hash before analysis.
Check destination reachability and intervening ACLs using the complete three-way handshake context.
Review handshake metadata, SNI where available, certificate and endpoint process links.
Compare RST origin, sequence and network device logs before assigning cause.

Explanation

Correct Answer

A missing handshake response may signal filtering or service outage, not completed connection. Interpret incomplete TCP handshake.

Incorrect Answers

Reassembling the transferred object provides a reproducible artifact for inspection. It could help recover suspicious HTTP transferred file, but it would not interpret incomplete TCP handshake.

Encrypted sessions still provide useful connection metadata without payload decryption. It would analyze TLS session without plaintext, but it would not interpret incomplete TCP handshake.

TCP resets can originate at peers or middleboxes and require packet attribution. It could help trace post-login TCP connection resets, but it would not interpret incomplete TCP handshake.

Question 183

A workload identity has access keys used from an unfamiliar workload environment. Which response BEST addresses the security problem described?

Distinguish access attempts from successful data access using response codes and byte counts.
Preserve the change evidence and assess exposure window rather than asserting theft.
Correlate credential ID, source service and API actions to identify the actual principal.
Normalize all event timestamps and validate time source before building the incident chronology.

Explanation

Correct Answer

Service credentials can be copied across environments without changing identity name. Detect cloud workload identity credential misuse.

Incorrect Answers

Denied operations are not proof that data was exfiltrated. That is relevant to cloud log and access interpretation, not to detect cloud workload identity credential misuse.

Misconfiguration creates risk even absent observed object download. It would assess cloud exposure without observed theft, but it would not detect cloud workload identity credential misuse.

Clock and timezone differences can produce false event sequences. That is relevant to cloud log and access interpretation, not to detect cloud workload identity credential misuse.

Question 184

A sandbox report shows no suspicious behavior but the sample checks for virtualization. Which investigative or response action BEST fits the evidence?

Extract the process, registry and destination indicators for scoped threat hunting.
Detonate the sample in an isolated sandbox with controlled network observation.
Use a simulated or tightly controlled network environment rather than unrestricted access.
Supplement dynamic results with static analysis and alternative isolated analysis conditions.

Explanation

Correct Answer

Environment-aware malware may suppress actions in automated sandboxes. Challenge sandbox evasion false negative.

Incorrect Answers

Observed behavior can produce actionable correlated indicators rather than a binary label alone. It would operationalize sandbox behavior indicators, but it would not challenge sandbox evasion false negative.

Safe dynamic analysis limits the effect of an untrusted executable. It could help inspect suspicious attachment through sandbox, but it would not challenge sandbox evasion false negative.

Controlled detonation preserves analytic visibility while minimizing external harm. That is relevant to sandbox execution versus live environment, not to challenge sandbox evasion false negative.

Question 185

A regex detection for a suspicious URL triggers on every legitimate relative path. What is the MOST appropriate analyst action based on the evidence?

Anchor and constrain the expression to the actual malicious pattern with benign test cases.
Implement case-insensitive matching and test equivalent command variants.
Normalize address types and representation before aggregation.
Test rule output against documented benign and malicious examples before enabling paging.

Explanation

Correct Answer

Overly permissive expressions create broad false positives. Refine overly broad URL regex.

Incorrect Answers

Command-line switches can vary capitalization without changing behavior. That is relevant to regex and detection engineering, not to refine overly broad URL regex.

Text formatting mismatches can hide related network entities. It would normalize address formats in SIEM rule, but it would not refine overly broad URL regex.

Rule validation should measure signal quality, not just successful execution. It could help reduce untested alert noise in detection rollout, but it would not refine overly broad URL regex.

Question 186

One malware hash is flagged by a minority of engines in a multi-scanner service. Which next step is MOST defensible for the security team?

Check hosting context and target-specific behavior before using the score as conviction.
Inspect detections, sample behavior and false-positive history before escalation.
Evaluate last-seen time, current ownership and independent corroboration before blocking.
Correlate registration age with URL content, mail headers and endpoint requests.

Explanation

Correct Answer

Aggregated antivirus verdicts vary and require evidentiary interpretation. Interpret mixed multi-engine file verdict.

Incorrect Answers

Shared infrastructure reputation may not apply to every tenant on an address. That is relevant to threat reputation services, not to interpret mixed multi-engine file verdict.

Stale IP reputation can create false positives as ownership changes. It could help age and validate IP reputation data, but it would not interpret mixed multi-engine file verdict.

Recent registration raises suspicion but does not independently prove malice. That is relevant to threat reputation services, not to interpret mixed multi-engine file verdict.

Question 187

An investigation requires sharing a pcap with third-party responders and it contains credentials. Which action BEST aligns with sound security operations?

Use the approved isolated malware repository and restrict distribution by role.
Obtain authorization and use approved private analysis instead of public submission.
Redact or securely scope sensitive content before approved external transfer.
Keep immutable originals and perform analysis on verified working copies.

Explanation

Correct Answer

Packet evidence may include secrets beyond those necessary for analysis. Share sensitive pcap under least disclosure.

Incorrect Answers

Uncontrolled sample transfer risks execution, data disclosure and evidence loss. It would prevent unsafe malware sample distribution, but it would not share sensitive pcap under least disclosure.

Public scanning portals may redistribute samples and expose confidential material. It could help avoid public upload of proprietary executable, but it would not share sensitive pcap under least disclosure.

Editing source evidence undermines repeatability and integrity assertions. It would keep original forensic artifacts immutable, but it would not share sensitive pcap under least disclosure.

Question 188

An email attachment contains a macro requesting external template retrieval on first open. Which response BEST addresses the security problem described?

Expand the redirect chain safely and inspect the final destination and certificate.
Examine the document's embedded objects and hyperlinks without executing active content.
Decode punycode and examine the actual registered domain before trusting appearance.
Inspect macro and remote-template indicators in an isolated environment.

Explanation

Correct Answer

Document content can launch a payload chain without an obvious executable attachment. Analyze macro-driven remote template behavior.

Incorrect Answers

URL shorteners conceal the ultimate recipient of credentials. It could help analyze layered phishing redirects, but it would not analyze macro-driven remote template behavior.

Document metadata and annotations may carry concealed malicious destinations. That is relevant to email attachment and url analysis, not to analyze macro-driven remote template behavior.

Unicode confusables can conceal attacker-controlled web properties. It would identify homograph phishing domain, but it would not analyze macro-driven remote template behavior.

Question 189

A VirusTotal upload is proposed for an internal executable containing embedded proprietary strings. Which investigative or response action BEST fits the evidence?

Obtain authorization and use approved private analysis instead of public submission.
Redact or securely scope sensitive content before approved external transfer.
Keep immutable originals and perform analysis on verified working copies.
Use the approved isolated malware repository and restrict distribution by role.

Explanation

Correct Answer

Public scanning portals may redistribute samples and expose confidential material. Avoid public upload of proprietary executable.

Incorrect Answers

Packet evidence may include secrets beyond those necessary for analysis. It would share sensitive pcap under least disclosure, but it would not avoid public upload of proprietary executable.

Editing source evidence undermines repeatability and integrity assertions. It could help keep original forensic artifacts immutable, but it would not avoid public upload of proprietary executable.

Uncontrolled sample transfer risks execution, data disclosure and evidence loss. That is relevant to handling sensitive artifacts, not to avoid public upload of proprietary executable.

Question 190

A hunt query returns no results because only a subset of servers forwards the required audit field. What is the MOST appropriate analyst action based on the evidence?

Hunt for unusual task creation and execution patterns mapped to the reported technique.
Measure telemetry coverage and document blind spots before calling the hypothesis disproved.
Pivot to related process and network telemetry before escalating as confirmed compromise.
Hunt for new executable content and unusual web-worker child processes.

Explanation

Correct Answer

No matches in incomplete telemetry do not prove absence of an adversary. Assess evidence-coverage limits in threat hunt.

Incorrect Answers

Behavior-based hunts remain useful when brittle exact indicators are unavailable. It would hunt scheduled-task TTP without IOC, but it would not assess evidence-coverage limits in threat hunt.

Multiple independent data sources strengthen conclusions over one anomaly. That is relevant to proactive threat hunt techniques, not to assess evidence-coverage limits in threat hunt.

Combining filesystem change with process ancestry narrows web-shell hypotheses. It would investigate web-shell-like behavior hunt, but it would not assess evidence-coverage limits in threat hunt.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 17 - 10 Questions (Last Reviewed 29-Oct-2026)
CompTIA CS0-003 Practice Test 18 - 10 Questions (Last Reviewed 28-Oct-2026)
CompTIA CS0-003 Practice Test 19 - 10 Questions (Last Reviewed 27-Oct-2026)
CompTIA CS0-003 Practice Test 20 - 10 Questions (Last Reviewed 26-Oct-2026)
CompTIA CS0-003 Practice Test 21 - 10 Questions (Last Reviewed 25-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 180

Explanation

Correct Answer

Incorrect Answers

Question 181

Explanation

Correct Answer

Incorrect Answers

Question 182

Explanation

Correct Answer

Incorrect Answers

Question 183

Explanation

Correct Answer

Incorrect Answers

Question 184

Explanation

Correct Answer

Incorrect Answers

Question 185

Explanation

Correct Answer

Incorrect Answers

Question 186

Explanation

Correct Answer

Incorrect Answers

Question 187

Explanation

Correct Answer

Incorrect Answers

Question 188

Explanation

Correct Answer

Incorrect Answers

Question 189

Explanation

Correct Answer

Incorrect Answers

Question 190

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests