CompTIA CS0-003 Practice Test 21

Question 200

A dynamic report lists registry persistence and network callbacks from an attachment. What is the MOST appropriate analyst action based on the evidence?

Supplement dynamic results with static analysis and alternative isolated analysis conditions.
Detonate the sample in an isolated sandbox with controlled network observation.
Use a simulated or tightly controlled network environment rather than unrestricted access.
Extract the process, registry and destination indicators for scoped threat hunting.

Explanation

Correct Answer

Observed behavior can produce actionable correlated indicators rather than a binary label alone. Operationalize sandbox behavior indicators.

Incorrect Answers

Environment-aware malware may suppress actions in automated sandboxes. It could help challenge sandbox evasion false negative, but it would not operationalize sandbox behavior indicators.

Safe dynamic analysis limits the effect of an untrusted executable. That is relevant to sandbox execution versus live environment, not to operationalize sandbox behavior indicators.

Controlled detonation preserves analytic visibility while minimizing external harm. It would safely observe network-dependent malware, but it would not operationalize sandbox behavior indicators.

Question 201

An intelligence report says a group uses scheduled tasks, but no exact hashes are provided. Which next step is MOST defensible for the security team?

Hunt for unusual task creation and execution patterns mapped to the reported technique.
Hunt for new executable content and unusual web-worker child processes.
Pivot to related process and network telemetry before escalating as confirmed compromise.
Measure telemetry coverage and document blind spots before calling the hypothesis disproved.

Explanation

Correct Answer

Behavior-based hunts remain useful when brittle exact indicators are unavailable. Hunt scheduled-task TTP without IOC.

Incorrect Answers

Combining filesystem change with process ancestry narrows web-shell hypotheses. It would investigate web-shell-like behavior hunt, but it would not hunt scheduled-task TTP without IOC.

Multiple independent data sources strengthen conclusions over one anomaly. It could help validate DNS hunt with endpoint evidence, but it would not hunt scheduled-task TTP without IOC.

No matches in incomplete telemetry do not prove absence of an adversary. That is relevant to proactive threat hunt techniques, not to hunt scheduled-task TTP without IOC.

Question 202

An abuse-report database shows reports from unrelated geographic regions for a shared hosting IP. Which action BEST aligns with sound security operations?

Inspect detections, sample behavior and false-positive history before escalation.
Check hosting context and target-specific behavior before using the score as conviction.
Evaluate last-seen time, current ownership and independent corroboration before blocking.
Correlate registration age with URL content, mail headers and endpoint requests.

Explanation

Correct Answer

Shared infrastructure reputation may not apply to every tenant on an address. Avoid shared-host reputation false positive.

Incorrect Answers

Aggregated antivirus verdicts vary and require evidentiary interpretation. It would interpret mixed multi-engine file verdict, but it would not avoid shared-host reputation false positive.

Stale IP reputation can create false positives as ownership changes. That is relevant to threat reputation services, not to avoid shared-host reputation false positive.

Recent registration raises suspicion but does not independently prove malice. It would contextualize WHOIS domain creation, but it would not avoid shared-host reputation false positive.

Question 203

A response workflow attempts to revoke tokens after a case is closed without an approved owner. Which response BEST addresses the security problem described?

Enrich the alert from authoritative identity and asset inventories before analyst review.
Normalize and deduplicate indicators while preserving source confidence and last-seen times.
Add authorization and audit checkpoints for token-revocation actions.
Add confidence and business-criticality gates requiring analyst approval for disruptive isolation.

Explanation

Correct Answer

Security orchestration must respect identity control privileges and traceability. Govern SOAR credential revocation.

Incorrect Answers

Verified context improves prioritization without manufacturing certainty. It could help automate asset-owner alert enrichment, but it would not govern SOAR credential revocation.

Duplicate data and stale lifetimes can distort enrichment decisions. That is relevant to soar action and enrichment boundaries, not to govern SOAR credential revocation.

High-impact automation should not trust a single weak signal. It could help prevent unsafe SOAR auto-isolation, but it would not govern SOAR credential revocation.

Question 204

The cloud API event timestamp differs from the application trace by a fixed offset. Which investigative or response action BEST fits the evidence?

Distinguish access attempts from successful data access using response codes and byte counts.
Preserve the change evidence and assess exposure window rather than asserting theft.
Correlate credential ID, source service and API actions to identify the actual principal.
Normalize all event timestamps and validate time source before building the incident chronology.

Explanation

Correct Answer

Clock and timezone differences can produce false event sequences. Reconcile cloud API versus app trace time.

Incorrect Answers

Denied operations are not proof that data was exfiltrated. That is relevant to cloud log and access interpretation, not to reconcile cloud API versus app trace time.

Misconfiguration creates risk even absent observed object download. It would assess cloud exposure without observed theft, but it would not reconcile cloud API versus app trace time.

Service credentials can be copied across environments without changing identity name. It could help detect cloud workload identity credential misuse, but it would not reconcile cloud API versus app trace time.

Question 205

EDR sensors disconnect at the same instant a local administrator disables security services. What is the MOST appropriate analyst action based on the evidence?

Correlate sensor-health events with privileged changes and network connectivity evidence.
Build a process and persistence timeline from EDR telemetry and related user sessions.
Validate the prevention outcome and inspect parent-child telemetry for successful follow-up.
Query EDR for the same hash, signer and execution paths across managed endpoints.

Explanation

Correct Answer

Security service tampering may masquerade as connectivity failure. Investigate deliberate EDR sensor disablement.

Incorrect Answers

Process lineage links initial execution to follow-on persistence. It could help investigate linked EDR process and task activity, but it would not investigate deliberate EDR sensor disablement.

Block alerts are not proof that code ran successfully. That is relevant to endpoint detection and response analysis, not to investigate deliberate EDR sensor disablement.

Enterprise-wide telemetry helps determine whether compromise is isolated. It would expand detection across fleet by file indicators, but it would not investigate deliberate EDR sensor disablement.

Question 206

An endpoint process uses `reg add` to set a Run key pointing to an unsigned payload. Which next step is MOST defensible for the security team?

Preserve command-line, downloaded content and account scope before containment.
Correlate the registry write with process ancestry and payload execution.
Request full process-tree and command-line enrichment before assigning malicious intent.
Verify actual file mode and associated execution records to investigate privilege risk.

Explanation

Correct Answer

Persistence requires both the autorun configuration and its associated file context. Analyze Run key creation from command evidence.

Incorrect Answers

Downloaded script plus privileged execution identity creates a concrete investigation chain. It could help interpret PowerShell web retrieval under service identity, but it would not analyze Run key creation from command evidence.

Command interpreter use is too common to classify without execution context. It would avoid unsupported conclusion from cmd.exe alone, but it would not analyze Run key creation from command evidence.

Setuid changes can elevate execution privileges when effective and executable semantics apply. It could help investigate suspicious setuid permission change, but it would not analyze Run key creation from command evidence.

Question 207

A SIEM rule looks for literal PowerShell `-enc` but attackers use case variations. Which action BEST aligns with sound security operations?

Test rule output against documented benign and malicious examples before enabling paging.
Normalize address types and representation before aggregation.
Implement case-insensitive matching and test equivalent command variants.
Anchor and constrain the expression to the actual malicious pattern with benign test cases.

Explanation

Correct Answer

Command-line switches can vary capitalization without changing behavior. Make PowerShell detection case-insensitive.

Incorrect Answers

Rule validation should measure signal quality, not just successful execution. That is relevant to regex and detection engineering, not to make PowerShell detection case-insensitive.

Text formatting mismatches can hide related network entities. It would normalize address formats in SIEM rule, but it would not make PowerShell detection case-insensitive.

Overly permissive expressions create broad false positives. That is relevant to regex and detection engineering, not to make PowerShell detection case-insensitive.

Question 208

A hash from an outbreak is known but filenames vary widely across endpoints. Which response BEST addresses the security problem described?

Correlate exercise identifiers and scope with detection evidence, preserving its test result.
Check telemetry retention and relevant NAT/proxy paths before declaring no exposure.
Check current DNS resolution and sinkhole notice before treating the IP as attacker infrastructure.
Query exact content hashes and execution evidence rather than filename matches.

Explanation

Correct Answer

Filenames are easy to change while the artifact digest remains stable. Hunt consistent binary under renamed files.

Incorrect Answers

Expected test activity still supplies valid detection coverage evidence. It would categorize approved emulation alert correctly, but it would not hunt consistent binary under renamed files.

Missing hits can reflect incomplete collection rather than clean endpoints. It could help test IOC hunt visibility limits, but it would not hunt consistent binary under renamed files.

Changed indicator context can reverse the meaning of later network hits. That is relevant to ioc handling and correlation, not to hunt consistent binary under renamed files.

Question 209

An IDS alert contains a timestamp but lacks the offending packet's interface direction. Which investigative or response action BEST fits the evidence?

Correlate device interface and flow records to determine inbound versus outbound origin.
Inspect application response bodies and authentication audit outcomes before treating 200 as successful access.
Join device GUID and reimage inventory instead of relying on hostname alone.
Verify actual backend execution and response evidence before concluding exploitation.

Explanation

Correct Answer

Direction matters for attributing source, victim and exfiltration. Restore network alert direction attribution.

Incorrect Answers

HTTP success codes can describe delivered pages rather than authenticated sessions. That is relevant to application response and normalizer choice, not to restore network alert direction attribution.

Stable identifiers prevent merging unrelated devices or splitting one historical host. It would correlate endpoint across hostname change, but it would not restore network alert direction attribution.

Detection of a malicious request does not establish that it succeeded. It could help assess blocked injection exploit outcome, but it would not restore network alert direction attribution.

Question 210

A security team risks capturing employee credentials during a broad full-packet investigation. What is the MOST appropriate analyst action based on the evidence?

Confirm mirror-port direction and packet-loss counters before inferring a failed response.
Minimize scope and restrict pcap access in accordance with evidence policy.
Use a scoped tcpdump capture filter and preserve the output pcap.
Apply a Wireshark stream filter and follow the matching TCP stream.

Explanation

Correct Answer

Packet payloads may contain sensitive authentication and personal data. Minimize sensitive packet evidence collection.

Incorrect Answers

Sensor vantage point can omit reverse traffic when mirroring is incomplete. That is relevant to wireshark and tcpdump operational choice, not to minimize sensitive packet evidence collection.

Command-line packet capture can collect targeted traffic on headless systems. It could help capture DNS evidence via tcpdump, but it would not minimize sensitive packet evidence collection.

Stream reassembly exposes application exchange across multiple packets. That is relevant to wireshark and tcpdump operational choice, not to minimize sensitive packet evidence collection.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 19 - 10 Questions (Last Reviewed 27-Oct-2026)
CompTIA CS0-003 Practice Test 20 - 10 Questions (Last Reviewed 26-Oct-2026)
CompTIA CS0-003 Practice Test 21 - 10 Questions (Last Reviewed 25-Oct-2026)
CompTIA CS0-003 Practice Test 22 - 10 Questions (Last Reviewed 24-Oct-2026)
CompTIA CS0-003 Practice Test 23 - 10 Questions (Last Reviewed 23-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 200

Explanation

Correct Answer

Incorrect Answers

Question 201

Explanation

Correct Answer

Incorrect Answers

Question 202

Explanation

Correct Answer

Incorrect Answers

Question 203

Explanation

Correct Answer

Incorrect Answers

Question 204

Explanation

Correct Answer

Incorrect Answers

Question 205

Explanation

Correct Answer

Incorrect Answers

Question 206

Explanation

Correct Answer

Incorrect Answers

Question 207

Explanation

Correct Answer

Incorrect Answers

Question 208

Explanation

Correct Answer

Incorrect Answers

Question 209

Explanation

Correct Answer

Incorrect Answers

Question 210

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests