Pass Your CompTIA CS0-003 Exam Easy!

Registry startup entries can provide persistence and warrant source validation. It would investigate registry autorun persistence, but it would not remediate disabled kernel audit.

Encoded text alone is not proof, but linked execution context exposes intent. That is relevant to os persistence and baseline evidence, not to remediate disabled kernel audit.

Service persistence can blend into normal boot behavior unless baselined. It would investigate suspicious Linux service installation, but it would not remediate disabled kernel audit.

Entity enrichment allows cross-environment activity to be correlated. It could help link identities across cloud and data center, but it would not observe short-lived serverless actions.

Hypervisor hardening alone does not ensure guest operating-system integrity. That is relevant to cloud and on-prem telemetry boundaries, not to observe short-lived serverless actions.

External log persistence preserves evidence when containers are replaced. It could help preserve container telemetry across redeployments, but it would not observe short-lived serverless actions.

Broad flat connectivity defeats the intended tier separation. That is relevant to network boundaries and segmentation, not to restrict east-west administrative exposure.

Encryption boundaries require alternate evidence rather than invisible payload assumptions. It would investigate encrypted traffic without payload access, but it would not restrict east-west administrative exposure.

A bypass defeats centrally enforced access and security controls. It could help close SASE application bypass, but it would not restrict east-west administrative exposure.

Zero trust should reassess device state rather than rely on a one-time grant. It could help continuously evaluate device trust, but it would not reduce standing administrator privilege.

Valid authentication does not imply authorization for every target role. That is relevant to zero-trust access interpretation, not to reduce standing administrator privilege.

Strong step-up authentication protects higher-risk privileged access. It would enforce high-assurance privileged authentication, but it would not reduce standing administrator privilege.

Segmented control access reduces the blast radius of corporate compromise. It could help restrict unsafe IT-to-OT connectivity, but it would not use safe OT asset visibility method.

Security event preservation must tolerate disconnected control networks. It would protect OT telemetry across disconnections, but it would not use safe OT asset visibility method.

Controlled remote support gives accountability and reduces persistent exposure. It could help govern external OT maintenance sessions, but it would not use safe OT asset visibility method.

Shared elevated identities increase lateral movement exposure and reduce attribution. That is relevant to endpoint controls and data paths, not to distinguish file detection from executed process.

Controls at the endpoint can enforce transfer restrictions before data leaves. It would enforce removable-media data controls, but it would not distinguish file detection from executed process.

Privileged group drift can stem from faulty automation or abuse. That is relevant to endpoint controls and data paths, not to distinguish file detection from executed process.

Strong step-up authentication protects higher-risk privileged access. It would enforce high-assurance privileged authentication, but it would not continuously evaluate device trust.

Limited elevation windows reduce persistent credential exposure. It could help reduce standing administrator privilege, but it would not continuously evaluate device trust.

Valid authentication does not imply authorization for every target role. That is relevant to zero-trust access interpretation, not to continuously evaluate device trust.

Segmented control access reduces the blast radius of corporate compromise. That is relevant to segregated ot monitoring, not to govern external OT maintenance sessions.

Fragile real-time devices can be disrupted by aggressive probes. It would use safe OT asset visibility method, but it would not govern external OT maintenance sessions.

Security event preservation must tolerate disconnected control networks. It could help protect OT telemetry across disconnections, but it would not govern external OT maintenance sessions.

DLP action should prevent likely CHD leakage while preserving review. That is relevant to data classification and handling, not to remove secrets from diagnostic logs.

Sensitive-data controls depend on the actual content, not an inaccurate label. It could help correct mislabeled personally identifiable data, but it would not remove secrets from diagnostic logs.

Combining datasets can turn apparently anonymous records into personal data. That is relevant to data classification and handling, not to remove secrets from diagnostic logs.

Encryption boundaries require alternate evidence rather than invisible payload assumptions. It would investigate encrypted traffic without payload access, but it would not close SASE application bypass.

Internal zone boundaries reduce attacker movement after initial compromise. It could help restrict east-west administrative exposure, but it would not close SASE application bypass.

Broad flat connectivity defeats the intended tier separation. It would implement least-privilege network tiers, but it would not close SASE application bypass.

Security logs can themselves contain sensitive infrastructure intelligence. It could help stop unauthorized DNS-log forwarding, but it would not isolate network-device management plane.

Unexpected attachment may represent rogue access or maintenance drift. That is relevant to network device and service context, not to isolate network-device management plane.

Terminating TLS at the edge does not secure exposed backend traffic. It would remediate unencrypted backend service hop, but it would not isolate network-device management plane.