CompTIA CS0-003 Practice Test 23

Question 220

A sandbox produces a credential-theft label but the report has no evidence of credential access. What is the MOST appropriate analyst action based on the evidence?

Compare actual event IDs and host identifiers before treating them as one infection.
Verify provenance and review behavior before creating an enterprise block rule.
Classify it as a likely blocked attempt pending any contradictory host evidence.
Inspect underlying behavioral evidence and reproduction steps, not the label alone.

Explanation

Correct Answer

Automated verdicts require underlying artifacts for defensible conclusions. Challenge unsupported sandbox verdict.

Incorrect Answers

Correlation group IDs can group separate activities and should not replace host evidence. It would distinguish grouped alert from single infected host, but it would not challenge unsupported sandbox verdict.

External intelligence may incorrectly classify internal custom binaries. It could help validate indicator before global blocking, but it would not challenge unsupported sandbox verdict.

Attack payload submission does not mean a vulnerability was exploited. That is relevant to detection evidence validation, not to challenge unsupported sandbox verdict.

Question 221

A phishing URL embeds an internationalized lookalike hostname resembling a corporate login. Which next step is MOST defensible for the security team?

Decode punycode and examine the actual registered domain before trusting appearance.
Expand the redirect chain safely and inspect the final destination and certificate.
Examine the document's embedded objects and hyperlinks without executing active content.
Inspect macro and remote-template indicators in an isolated environment.

Explanation

Correct Answer

Unicode confusables can conceal attacker-controlled web properties. Identify homograph phishing domain.

Incorrect Answers

URL shorteners conceal the ultimate recipient of credentials. That is relevant to email attachment and url analysis, not to identify homograph phishing domain.

Document metadata and annotations may carry concealed malicious destinations. It would extract hidden PDF link without execution, but it would not identify homograph phishing domain.

Document content can launch a payload chain without an obvious executable attachment. It could help analyze macro-driven remote template behavior, but it would not identify homograph phishing domain.

Question 222

A finance user downloads hundreds of confidential files after accepting a resignation offer. Which action BEST aligns with sound security operations?

Compare behavior against historic role baselines and current approved change requests.
Correlate authorized job duties, file access volumes and time without assuming guilt.
Update the behavior baseline only after validating role change and legitimate scope.
Correlate device ID, VPN gateways and token history to test impossible-travel accuracy.

Explanation

Correct Answer

Insider-risk signals require contextual examination and privacy-aware handling. Assess potential insider mass download.

Incorrect Answers

Behavioral deviation is useful when tied to permission and business context. That is relevant to user behavior analytics, not to assess potential insider mass download.

Legitimate entitlement changes require contextual recalibration, not wholesale alert suppression. It could help rebaseline authorized role transition, but it would not assess potential insider mass download.

VPN egress geography can differ from the user's physical location. That is relevant to user behavior analytics, not to assess potential insider mass download.

Question 223

A sensor sees TLS traffic to a new host but no readable application payload. Which response BEST addresses the security problem described?

Extract the payload from the capture safely and calculate its hash before analysis.
Check destination reachability and intervening ACLs using the complete three-way handshake context.
Review handshake metadata, SNI where available, certificate and endpoint process links.
Compare RST origin, sequence and network device logs before assigning cause.

Explanation

Correct Answer

Encrypted sessions still provide useful connection metadata without payload decryption. Analyze TLS session without plaintext.

Incorrect Answers

Reassembling the transferred object provides a reproducible artifact for inspection. It would recover suspicious HTTP transferred file, but it would not analyze TLS session without plaintext.

A missing handshake response may signal filtering or service outage, not completed connection. It could help interpret incomplete TCP handshake, but it would not analyze TLS session without plaintext.

TCP resets can originate at peers or middleboxes and require packet attribution. It would trace post-login TCP connection resets, but it would not analyze TLS session without plaintext.

Question 224

Two binaries share an SHA-256 digest even though their file names differ. Which investigative or response action BEST fits the evidence?

Use static strings analysis and verify whether the markers appear in related artifacts.
Continue behavior-based analysis instead of clearing the file as benign.
Compare signer, build pipeline and behavior rather than relying solely on hash equality.
Treat them as the same byte content pending verified acquisition and compare provenance.

Explanation

Correct Answer

A cryptographic digest identifies content regardless of filename, assuming sound collection. Interpret matching file hashes.

Incorrect Answers

Embedded text provides hypotheses without proving the code used every string. It could help interpret static strings as leads, but it would not interpret matching file hashes.

Reputation lookup absence is not proof of safety, especially for novel malware. That is relevant to file strings and hashing interpretation, not to interpret matching file hashes.

Compilation and packaging changes alter hashes even without hostile intent. It would prevent overreliance on file hash change, but it would not interpret matching file hashes.

Question 225

An analyst's query shows a spike only because the ingestion timestamp was used after a backlog drained. What is the MOST appropriate analyst action based on the evidence?

Chart source event time separately from ingestion time.
Resolve the asset's stable ID and current ownership before paging the wrong team.
Distinguish stored exposure from active execution when setting response severity.
Correlate NAT session identifiers before counting distinct attack paths.

Explanation

Correct Answer

Late ingestion can create artificial apparent incident bursts. Avoid ingestion-time spike misinterpretation.

Incorrect Answers

Stale hostnames can misroute urgent security work. It would attribute alert to correct current asset owner, but it would not avoid ingestion-time spike misinterpretation.

File presence does not necessarily imply a running compromise. It could help prioritize historical artifact versus active compromise, but it would not avoid ingestion-time spike misinterpretation.

A translated flow can appear twice under different address pairs. That is relevant to asset and log correlation under pressure, not to avoid ingestion-time spike misinterpretation.

Question 226

An analyst wants only outbound connections to TCP 4444 from one endpoint during suspected C2. Which next step is MOST defensible for the security team?

Document the recording interval and avoid claiming the DNS event initiated the session.
Set a narrow BPF capture filter for the host, destination direction and TCP port.
Repeat capture with protocol-aware wider criteria and retain precise acquisition notes.
Measure capture loss and supplement with NetFlow and endpoint byte counters.

Explanation

Correct Answer

Capture filters minimize irrelevant packets while preserving suspected C2 transactions. Target forensic packet capture by host and port.

Incorrect Answers

A partial trace cannot establish the true first event. It would recognize incomplete packet chronology, but it would not target forensic packet capture by host and port.

Multi-channel protocols may use additional ports beyond their control connection. That is relevant to network filtering capture choices, not to target forensic packet capture by host and port.

Packet loss invalidates assumptions about complete content or transfer volume. It would corroborate network transfer amid capture loss, but it would not target forensic packet capture by host and port.

Question 227

The From and Reply-To fields differ and payment instructions request a new bank account. Which action BEST aligns with sound security operations?

Inspect SPF authenticated domain and DMARC alignment to evaluate sender legitimacy.
Interpret DMARC alignment and quarantine according to approved policy.
Validate the payment change through an independent trusted channel.
Continue attachment and sender-behavior analysis rather than treating signature as safety.

Explanation

Correct Answer

Reply-To manipulation and business process change create a high-risk impersonation pattern. Investigate payment fraud reply-to change.

Incorrect Answers

SPF pass alone does not authenticate the user-visible From domain. It could help validate SPF identifier alignment, but it would not investigate payment fraud reply-to change.

DMARC requires alignment with the visible From identity for SPF or DKIM. That is relevant to email authentication headers, not to investigate payment fraud reply-to change.

DKIM verifies signed origin/integrity, not benevolent content. It could help distinguish DKIM authenticity from malware safety, but it would not investigate payment fraud reply-to change.

Question 228

A newly promoted employee starts using approved administrative features that trigger old anomaly rules. Which response BEST addresses the security problem described?

Compare behavior against historic role baselines and current approved change requests.
Correlate authorized job duties, file access volumes and time without assuming guilt.
Correlate device ID, VPN gateways and token history to test impossible-travel accuracy.
Update the behavior baseline only after validating role change and legitimate scope.

Explanation

Correct Answer

Legitimate entitlement changes require contextual recalibration, not wholesale alert suppression. Rebaseline authorized role transition.

Incorrect Answers

Behavioral deviation is useful when tied to permission and business context. That is relevant to user behavior analytics, not to rebaseline authorized role transition.

Insider-risk signals require contextual examination and privacy-aware handling. It would assess potential insider mass download, but it would not rebaseline authorized role transition.

VPN egress geography can differ from the user's physical location. It could help reduce VPN travel false positive, but it would not rebaseline authorized role transition.

Question 229

A suspicious PowerShell process launched from a service account uses `Invoke-WebRequest` to fetch a script. Which investigative or response action BEST fits the evidence?

Preserve command-line, downloaded content and account scope before containment.
Request full process-tree and command-line enrichment before assigning malicious intent.
Verify actual file mode and associated execution records to investigate privilege risk.
Correlate the registry write with process ancestry and payload execution.

Explanation

Correct Answer

Downloaded script plus privileged execution identity creates a concrete investigation chain. Interpret PowerShell web retrieval under service identity.

Incorrect Answers

Command interpreter use is too common to classify without execution context. It could help avoid unsupported conclusion from cmd.exe alone, but it would not interpret PowerShell web retrieval under service identity.

Setuid changes can elevate execution privileges when effective and executable semantics apply. That is relevant to malware triage with command history, not to interpret PowerShell web retrieval under service identity.

Persistence requires both the autorun configuration and its associated file context. It would analyze Run key creation from command evidence, but it would not interpret PowerShell web retrieval under service identity.

Question 230

A memory image reveals an injected shellcode region while no suspicious executable exists on disk. What is the MOST appropriate analyst action based on the evidence?

Correlate prefetch or equivalent execution artifacts with system event logs.
Correlate injected memory mappings with parent processes and network connections.
Coordinate volatile-memory capture before reboot when safe and authorized.
Stop reliance on the copy and repeat a verified forensic acquisition.

Explanation

Correct Answer

Fileless payloads can be found through process-memory anomalies. Investigate fileless code from memory.

Incorrect Answers

Execution artifacts can survive file deletion and support timeline reconstruction. It could help prove historical execution after file deletion, but it would not investigate fileless code from memory.

Reboot can destroy transient process and memory evidence. It would prioritize volatile memory preservation, but it would not investigate fileless code from memory.

Integrity mismatches undermine evidentiary confidence in the copied image. It could help reject corrupted forensic disk copy, but it would not investigate fileless code from memory.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 21 - 10 Questions (Last Reviewed 25-Oct-2026)
CompTIA CS0-003 Practice Test 22 - 10 Questions (Last Reviewed 24-Oct-2026)
CompTIA CS0-003 Practice Test 23 - 10 Questions (Last Reviewed 23-Oct-2026)
CompTIA CS0-003 Practice Test 24 - 10 Questions (Last Reviewed 22-Oct-2026)
CompTIA CS0-003 Practice Test 25 - 10 Questions (Last Reviewed 21-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 220

Explanation

Correct Answer

Incorrect Answers

Question 221

Explanation

Correct Answer

Incorrect Answers

Question 222

Explanation

Correct Answer

Incorrect Answers

Question 223

Explanation

Correct Answer

Incorrect Answers

Question 224

Explanation

Correct Answer

Incorrect Answers

Question 225

Explanation

Correct Answer

Incorrect Answers

Question 226

Explanation

Correct Answer

Incorrect Answers

Question 227

Explanation

Correct Answer

Incorrect Answers

Question 228

Explanation

Correct Answer

Incorrect Answers

Question 229

Explanation

Correct Answer

Incorrect Answers

Question 230

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests