CompTIA CS0-003 Practice Test 20

Question 190

A hunt query returns no results because only a subset of servers forwards the required audit field. What is the MOST appropriate analyst action based on the evidence?

Hunt for unusual task creation and execution patterns mapped to the reported technique.
Measure telemetry coverage and document blind spots before calling the hypothesis disproved.
Pivot to related process and network telemetry before escalating as confirmed compromise.
Hunt for new executable content and unusual web-worker child processes.

Explanation

Correct Answer

No matches in incomplete telemetry do not prove absence of an adversary. Assess evidence-coverage limits in threat hunt.

Incorrect Answers

Behavior-based hunts remain useful when brittle exact indicators are unavailable. It would hunt scheduled-task TTP without IOC, but it would not assess evidence-coverage limits in threat hunt.

Multiple independent data sources strengthen conclusions over one anomaly. That is relevant to proactive threat hunt techniques, not to assess evidence-coverage limits in threat hunt.

Combining filesystem change with process ancestry narrows web-shell hypotheses. It would investigate web-shell-like behavior hunt, but it would not assess evidence-coverage limits in threat hunt.

Question 191

A malware sample requires internet access to reveal behavior but outbound communication is restricted. Which next step is MOST defensible for the security team?

Supplement dynamic results with static analysis and alternative isolated analysis conditions.
Detonate the sample in an isolated sandbox with controlled network observation.
Use a simulated or tightly controlled network environment rather than unrestricted access.
Extract the process, registry and destination indicators for scoped threat hunting.

Explanation

Correct Answer

Controlled detonation preserves analytic visibility while minimizing external harm. Safely observe network-dependent malware.

Incorrect Answers

Environment-aware malware may suppress actions in automated sandboxes. It could help challenge sandbox evasion false negative, but it would not safely observe network-dependent malware.

Safe dynamic analysis limits the effect of an untrusted executable. That is relevant to sandbox execution versus live environment, not to safely observe network-dependent malware.

Observed behavior can produce actionable correlated indicators rather than a binary label alone. It could help operationalize sandbox behavior indicators, but it would not safely observe network-dependent malware.

Question 192

A proxy logs `POST /login` with 200 status but users complain the login failed. Which action BEST aligns with sound security operations?

Correlate device interface and flow records to determine inbound versus outbound origin.
Join device GUID and reimage inventory instead of relying on hostname alone.
Verify actual backend execution and response evidence before concluding exploitation.
Inspect application response bodies and authentication audit outcomes before treating 200 as successful access.

Explanation

Correct Answer

HTTP success codes can describe delivered pages rather than authenticated sessions. Separate HTTP 200 from successful login.

Incorrect Answers

Direction matters for attributing source, victim and exfiltration. That is relevant to application response and normalizer choice, not to separate HTTP 200 from successful login.

Stable identifiers prevent merging unrelated devices or splitting one historical host. It would correlate endpoint across hostname change, but it would not separate HTTP 200 from successful login.

Detection of a malicious request does not establish that it succeeded. It could help assess blocked injection exploit outcome, but it would not separate HTTP 200 from successful login.

Question 193

A traveling administrator logs in from two distant cities through corporate VPN exits. Which response BEST addresses the security problem described?

Correlate device ID, VPN gateways and token history to test impossible-travel accuracy.
Compare behavior against historic role baselines and current approved change requests.
Correlate authorized job duties, file access volumes and time without assuming guilt.
Update the behavior baseline only after validating role change and legitimate scope.

Explanation

Correct Answer

VPN egress geography can differ from the user's physical location. Reduce VPN travel false positive.

Incorrect Answers

Behavioral deviation is useful when tied to permission and business context. It could help detect abnormal service-account data reach, but it would not reduce VPN travel false positive.

Insider-risk signals require contextual examination and privacy-aware handling. That is relevant to user behavior analytics, not to reduce VPN travel false positive.

Legitimate entitlement changes require contextual recalibration, not wholesale alert suppression. It would rebaseline authorized role transition, but it would not reduce VPN travel false positive.

Question 194

An embedded shortened link redirects through multiple domains before a fake sign-in page. Which investigative or response action BEST fits the evidence?

Decode punycode and examine the actual registered domain before trusting appearance.
Expand the redirect chain safely and inspect the final destination and certificate.
Examine the document's embedded objects and hyperlinks without executing active content.
Inspect macro and remote-template indicators in an isolated environment.

Explanation

Correct Answer

URL shorteners conceal the ultimate recipient of credentials. Analyze layered phishing redirects.

Incorrect Answers

Unicode confusables can conceal attacker-controlled web properties. It could help identify homograph phishing domain, but it would not analyze layered phishing redirects.

Document metadata and annotations may carry concealed malicious destinations. It would extract hidden PDF link without execution, but it would not analyze layered phishing redirects.

Document content can launch a payload chain without an obvious executable attachment. It could help analyze macro-driven remote template behavior, but it would not analyze layered phishing redirects.

Question 195

An analyst proposes emailing a malware sample to a personal mailbox for home analysis. What is the MOST appropriate analyst action based on the evidence?

Keep immutable originals and perform analysis on verified working copies.
Obtain authorization and use approved private analysis instead of public submission.
Use the approved isolated malware repository and restrict distribution by role.
Redact or securely scope sensitive content before approved external transfer.

Explanation

Correct Answer

Uncontrolled sample transfer risks execution, data disclosure and evidence loss. Prevent unsafe malware sample distribution.

Incorrect Answers

Editing source evidence undermines repeatability and integrity assertions. That is relevant to handling sensitive artifacts, not to prevent unsafe malware sample distribution.

Public scanning portals may redistribute samples and expose confidential material. It would avoid public upload of proprietary executable, but it would not prevent unsafe malware sample distribution.

Packet evidence may include secrets beyond those necessary for analysis. That is relevant to handling sensitive artifacts, not to prevent unsafe malware sample distribution.

Question 196

An IOC feed reports three related IPs but none appear in internal logs for the stated window. Which next step is MOST defensible for the security team?

Correlate exercise identifiers and scope with detection evidence, preserving its test result.
Query exact content hashes and execution evidence rather than filename matches.
Check current DNS resolution and sinkhole notice before treating the IP as attacker infrastructure.
Check telemetry retention and relevant NAT/proxy paths before declaring no exposure.

Explanation

Correct Answer

Missing hits can reflect incomplete collection rather than clean endpoints. Test IOC hunt visibility limits.

Incorrect Answers

Expected test activity still supplies valid detection coverage evidence. It would categorize approved emulation alert correctly, but it would not test IOC hunt visibility limits.

Filenames are easy to change while the artifact digest remains stable. It could help hunt consistent binary under renamed files, but it would not test IOC hunt visibility limits.

Changed indicator context can reverse the meaning of later network hits. That is relevant to ioc handling and correlation, not to test IOC hunt visibility limits.

Question 197

A malware feed marks a file hash malicious but the signed binary is an approved internal build. Which action BEST aligns with sound security operations?

Verify provenance and review behavior before creating an enterprise block rule.
Classify it as a likely blocked attempt pending any contradictory host evidence.
Compare actual event IDs and host identifiers before treating them as one infection.
Inspect underlying behavioral evidence and reproduction steps, not the label alone.

Explanation

Correct Answer

External intelligence may incorrectly classify internal custom binaries. Validate indicator before global blocking.

Incorrect Answers

Attack payload submission does not mean a vulnerability was exploited. That is relevant to detection evidence validation, not to validate indicator before global blocking.

Correlation group IDs can group separate activities and should not replace host evidence. It would distinguish grouped alert from single infected host, but it would not validate indicator before global blocking.

Automated verdicts require underlying artifacts for defensible conclusions. It could help challenge unsupported sandbox verdict, but it would not validate indicator before global blocking.

Question 198

JSON cloud audit records nest the source address under different fields across event types. Which response BEST addresses the security problem described?

Use an XML-aware parser with the correct namespace declarations.
Parse JSON structurally and map source fields instead of using brittle text substring matches.
Use an explicit decoding-error strategy and retain original bytes for forensic traceability.
Use a bounded grep or awk filter against preserved copies of the original log.

Explanation

Correct Answer

Correct structured parsing prevents loss or confusion of nested event attributes. Extract normalized source IP from JSON.

Incorrect Answers

Namespace handling is needed to retrieve fields reliably from XML records. That is relevant to shell and scripting for log extraction, not to extract normalized source IP from JSON.

Silently dropping parse failures can remove key events from evidence. It could help handle invalid log encoding safely, but it would not extract normalized source IP from JSON.

Targeted text filtering accelerates triage without modifying primary evidence. That is relevant to shell and scripting for log extraction, not to extract normalized source IP from JSON.

Question 199

An incident handler has a large pcap and needs to follow one reconstructed HTTP conversation. Which investigative or response action BEST fits the evidence?

Use a scoped tcpdump capture filter and preserve the output pcap.
Confirm mirror-port direction and packet-loss counters before inferring a failed response.
Apply a Wireshark stream filter and follow the matching TCP stream.
Minimize scope and restrict pcap access in accordance with evidence policy.

Explanation

Correct Answer

Stream reassembly exposes application exchange across multiple packets. Reconstruct single HTTP exchange from pcap.

Incorrect Answers

Command-line packet capture can collect targeted traffic on headless systems. It would capture DNS evidence via tcpdump, but it would not reconstruct single HTTP exchange from pcap.

Sensor vantage point can omit reverse traffic when mirroring is incomplete. It could help diagnose partial SPAN port visibility, but it would not reconstruct single HTTP exchange from pcap.

Packet payloads may contain sensitive authentication and personal data. It would minimize sensitive packet evidence collection, but it would not reconstruct single HTTP exchange from pcap.

Question 200

A dynamic report lists registry persistence and network callbacks from an attachment. What is the MOST appropriate analyst action based on the evidence?

Supplement dynamic results with static analysis and alternative isolated analysis conditions.
Detonate the sample in an isolated sandbox with controlled network observation.
Use a simulated or tightly controlled network environment rather than unrestricted access.
Extract the process, registry and destination indicators for scoped threat hunting.

Explanation

Correct Answer

Observed behavior can produce actionable correlated indicators rather than a binary label alone. Operationalize sandbox behavior indicators.

Incorrect Answers

Environment-aware malware may suppress actions in automated sandboxes. It could help challenge sandbox evasion false negative, but it would not operationalize sandbox behavior indicators.

Safe dynamic analysis limits the effect of an untrusted executable. That is relevant to sandbox execution versus live environment, not to operationalize sandbox behavior indicators.

Controlled detonation preserves analytic visibility while minimizing external harm. It would safely observe network-dependent malware, but it would not operationalize sandbox behavior indicators.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 18 - 10 Questions (Last Reviewed 28-Oct-2026)
CompTIA CS0-003 Practice Test 19 - 10 Questions (Last Reviewed 27-Oct-2026)
CompTIA CS0-003 Practice Test 20 - 10 Questions (Last Reviewed 26-Oct-2026)
CompTIA CS0-003 Practice Test 21 - 10 Questions (Last Reviewed 25-Oct-2026)
CompTIA CS0-003 Practice Test 22 - 10 Questions (Last Reviewed 24-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 190

Explanation

Correct Answer

Incorrect Answers

Question 191

Explanation

Correct Answer

Incorrect Answers

Question 192

Explanation

Correct Answer

Incorrect Answers

Question 193

Explanation

Correct Answer

Incorrect Answers

Question 194

Explanation

Correct Answer

Incorrect Answers

Question 195

Explanation

Correct Answer

Incorrect Answers

Question 196

Explanation

Correct Answer

Incorrect Answers

Question 197

Explanation

Correct Answer

Incorrect Answers

Question 198

Explanation

Correct Answer

Incorrect Answers

Question 199

Explanation

Correct Answer

Incorrect Answers

Question 200

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests