CompTIA CS0-003 Practice Test 24

Question 230

A memory image reveals an injected shellcode region while no suspicious executable exists on disk. What is the MOST appropriate analyst action based on the evidence?

Correlate prefetch or equivalent execution artifacts with system event logs.
Correlate injected memory mappings with parent processes and network connections.
Coordinate volatile-memory capture before reboot when safe and authorized.
Stop reliance on the copy and repeat a verified forensic acquisition.

Explanation

Correct Answer

Fileless payloads can be found through process-memory anomalies. Investigate fileless code from memory.

Incorrect Answers

Execution artifacts can survive file deletion and support timeline reconstruction. It could help prove historical execution after file deletion, but it would not investigate fileless code from memory.

Reboot can destroy transient process and memory evidence. It would prioritize volatile memory preservation, but it would not investigate fileless code from memory.

Integrity mismatches undermine evidentiary confidence in the copied image. It could help reject corrupted forensic disk copy, but it would not investigate fileless code from memory.

Question 231

The same IOC triggers hundreds of alerts from duplicated ingestion across two collectors. Which next step is MOST defensible for the security team?

Narrow correlation windows using observed attack timings and clock accuracy.
Validate normalized fields against raw source logs before trusting correlation results.
Deduplicate source event IDs and validate ingestion pipelines before tuning severity.
Normalize identity fields before running a time-bounded correlation.

Explanation

Correct Answer

Ingestion duplication inflates alert counts without new adversary activity. Correct duplicate SIEM alert source.

Incorrect Answers

Overly broad joins can attribute unrelated user actions to execution. That is relevant to siem query correlation and time windows, not to correct duplicate SIEM alert source.

Incorrect field extraction reverses directionality and contaminates detections. It would repair reversed SIEM network fields, but it would not correct duplicate SIEM alert source.

Field-format differences can hide otherwise related authentication and execution. That is relevant to siem query correlation and time windows, not to correct duplicate SIEM alert source.

Question 232

An alert lacks user department and asset owner, delaying triage. Which action BEST aligns with sound security operations?

Add confidence and business-criticality gates requiring analyst approval for disruptive isolation.
Add authorization and audit checkpoints for token-revocation actions.
Normalize and deduplicate indicators while preserving source confidence and last-seen times.
Enrich the alert from authoritative identity and asset inventories before analyst review.

Explanation

Correct Answer

Verified context improves prioritization without manufacturing certainty. Automate asset-owner alert enrichment.

Incorrect Answers

High-impact automation should not trust a single weak signal. It would prevent unsafe SOAR auto-isolation, but it would not automate asset-owner alert enrichment.

Security orchestration must respect identity control privileges and traceability. It could help govern SOAR credential revocation, but it would not automate asset-owner alert enrichment.

Duplicate data and stale lifetimes can distort enrichment decisions. That is relevant to soar action and enrichment boundaries, not to automate asset-owner alert enrichment.

Question 233

A packet trace shows an outbound DNS query but capture starts after earlier application connections. Which response BEST addresses the security problem described?

Document the recording interval and avoid claiming the DNS event initiated the session.
Repeat capture with protocol-aware wider criteria and retain precise acquisition notes.
Set a narrow BPF capture filter for the host, destination direction and TCP port.
Measure capture loss and supplement with NetFlow and endpoint byte counters.

Explanation

Correct Answer

A partial trace cannot establish the true first event. Recognize incomplete packet chronology.

Incorrect Answers

Multi-channel protocols may use additional ports beyond their control connection. That is relevant to network filtering capture choices, not to recognize incomplete packet chronology.

Capture filters minimize irrelevant packets while preserving suspected C2 transactions. It would target forensic packet capture by host and port, but it would not recognize incomplete packet chronology.

Packet loss invalidates assumptions about complete content or transfer volume. It could help corroborate network transfer amid capture loss, but it would not recognize incomplete packet chronology.

Question 234

A domain IOC has been sinkholed and now resolves to a security research IP. Which investigative or response action BEST fits the evidence?

Query exact content hashes and execution evidence rather than filename matches.
Check current DNS resolution and sinkhole notice before treating the IP as attacker infrastructure.
Check telemetry retention and relevant NAT/proxy paths before declaring no exposure.
Correlate exercise identifiers and scope with detection evidence, preserving its test result.

Explanation

Correct Answer

Changed indicator context can reverse the meaning of later network hits. Avoid sinkhole IP false attribution.

Incorrect Answers

Filenames are easy to change while the artifact digest remains stable. That is relevant to ioc handling and correlation, not to avoid sinkhole IP false attribution.

Missing hits can reflect incomplete collection rather than clean endpoints. It could help test IOC hunt visibility limits, but it would not avoid sinkhole IP false attribution.

Expected test activity still supplies valid detection coverage evidence. That is relevant to ioc handling and correlation, not to avoid sinkhole IP false attribution.

Question 235

A defender notices repeated TCP RST packets precisely after authentication to a legacy service. What is the MOST appropriate analyst action based on the evidence?

Extract the payload from the capture safely and calculate its hash before analysis.
Review handshake metadata, SNI where available, certificate and endpoint process links.
Compare RST origin, sequence and network device logs before assigning cause.
Check destination reachability and intervening ACLs using the complete three-way handshake context.

Explanation

Correct Answer

TCP resets can originate at peers or middleboxes and require packet attribution. Trace post-login TCP connection resets.

Incorrect Answers

Reassembling the transferred object provides a reproducible artifact for inspection. It would recover suspicious HTTP transferred file, but it would not trace post-login TCP connection resets.

Encrypted sessions still provide useful connection metadata without payload decryption. It could help analyze TLS session without plaintext, but it would not trace post-login TCP connection resets.

A missing handshake response may signal filtering or service outage, not completed connection. It would interpret incomplete TCP handshake, but it would not trace post-login TCP connection resets.

Question 236

A SIEM shows multiple endpoint alarms with identical case IDs but different hosts. Which next step is MOST defensible for the security team?

Inspect underlying behavioral evidence and reproduction steps, not the label alone.
Classify it as a likely blocked attempt pending any contradictory host evidence.
Verify provenance and review behavior before creating an enterprise block rule.
Compare actual event IDs and host identifiers before treating them as one infection.

Explanation

Correct Answer

Correlation group IDs can group separate activities and should not replace host evidence. Distinguish grouped alert from single infected host.

Incorrect Answers

Automated verdicts require underlying artifacts for defensible conclusions. It could help challenge unsupported sandbox verdict, but it would not distinguish grouped alert from single infected host.

Attack payload submission does not mean a vulnerability was exploited. That is relevant to detection evidence validation, not to distinguish grouped alert from single infected host.

External intelligence may incorrectly classify internal custom binaries. It would validate indicator before global blocking, but it would not distinguish grouped alert from single infected host.

Question 237

Several sensors flag one connection as inbound and outbound due to mirrored NAT flows. Which action BEST aligns with sound security operations?

Correlate NAT session identifiers before counting distinct attack paths.
Resolve the asset's stable ID and current ownership before paging the wrong team.
Distinguish stored exposure from active execution when setting response severity.
Chart source event time separately from ingestion time.

Explanation

Correct Answer

A translated flow can appear twice under different address pairs. Deduplicate NAT observation of same session.

Incorrect Answers

Stale hostnames can misroute urgent security work. It would attribute alert to correct current asset owner, but it would not deduplicate NAT observation of same session.

File presence does not necessarily imply a running compromise. It could help prioritize historical artifact versus active compromise, but it would not deduplicate NAT observation of same session.

Late ingestion can create artificial apparent incident bursts. That is relevant to asset and log correlation under pressure, not to deduplicate NAT observation of same session.

Question 238

Endpoint logs show suspicious executable use but hostname changed following reimaging. Which response BEST addresses the security problem described?

Verify actual backend execution and response evidence before concluding exploitation.
Join device GUID and reimage inventory instead of relying on hostname alone.
Correlate device interface and flow records to determine inbound versus outbound origin.
Inspect application response bodies and authentication audit outcomes before treating 200 as successful access.

Explanation

Correct Answer

Stable identifiers prevent merging unrelated devices or splitting one historical host. Correlate endpoint across hostname change.

Incorrect Answers

Detection of a malicious request does not establish that it succeeded. It would assess blocked injection exploit outcome, but it would not correlate endpoint across hostname change.

Direction matters for attributing source, victim and exfiltration. That is relevant to application response and normalizer choice, not to correlate endpoint across hostname change.

HTTP success codes can describe delivered pages rather than authenticated sessions. It would separate HTTP 200 from successful login, but it would not correlate endpoint across hostname change.

Question 239

An inbound message has valid aligned DKIM despite a malicious attachment. Which investigative or response action BEST fits the evidence?

Validate the payment change through an independent trusted channel.
Inspect SPF authenticated domain and DMARC alignment to evaluate sender legitimacy.
Continue attachment and sender-behavior analysis rather than treating signature as safety.
Interpret DMARC alignment and quarantine according to approved policy.

Explanation

Correct Answer

DKIM verifies signed origin/integrity, not benevolent content. Distinguish DKIM authenticity from malware safety.

Incorrect Answers

Reply-To manipulation and business process change create a high-risk impersonation pattern. It could help investigate payment fraud reply-to change, but it would not distinguish DKIM authenticity from malware safety.

SPF pass alone does not authenticate the user-visible From domain. That is relevant to email authentication headers, not to distinguish DKIM authenticity from malware safety.

DMARC requires alignment with the visible From identity for SPF or DKIM. It could help apply DMARC to mismatched signer, but it would not distinguish DKIM authenticity from malware safety.

Question 240

A threat feed import duplicates identical indicators with inconsistent expiration timestamps. What is the MOST appropriate analyst action based on the evidence?

Add authorization and audit checkpoints for token-revocation actions.
Enrich the alert from authoritative identity and asset inventories before analyst review.
Add confidence and business-criticality gates requiring analyst approval for disruptive isolation.
Normalize and deduplicate indicators while preserving source confidence and last-seen times.

Explanation

Correct Answer

Duplicate data and stale lifetimes can distort enrichment decisions. Clean repeated intelligence indicators.

Incorrect Answers

Security orchestration must respect identity control privileges and traceability. That is relevant to soar action and enrichment boundaries, not to clean repeated intelligence indicators.

Verified context improves prioritization without manufacturing certainty. It would automate asset-owner alert enrichment, but it would not clean repeated intelligence indicators.

High-impact automation should not trust a single weak signal. It could help prevent unsafe SOAR auto-isolation, but it would not clean repeated intelligence indicators.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 22 - 10 Questions (Last Reviewed 24-Oct-2026)
CompTIA CS0-003 Practice Test 23 - 10 Questions (Last Reviewed 23-Oct-2026)
CompTIA CS0-003 Practice Test 24 - 10 Questions (Last Reviewed 22-Oct-2026)
CompTIA CS0-003 Practice Test 25 - 10 Questions (Last Reviewed 21-Oct-2026)
CompTIA CS0-003 Practice Test 26 - 10 Questions (Last Reviewed 20-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 230

Explanation

Correct Answer

Incorrect Answers

Question 231

Explanation

Correct Answer

Incorrect Answers

Question 232

Explanation

Correct Answer

Incorrect Answers

Question 233

Explanation

Correct Answer

Incorrect Answers

Question 234

Explanation

Correct Answer

Incorrect Answers

Question 235

Explanation

Correct Answer

Incorrect Answers

Question 236

Explanation

Correct Answer

Incorrect Answers

Question 237

Explanation

Correct Answer

Incorrect Answers

Question 238

Explanation

Correct Answer

Incorrect Answers

Question 239

Explanation

Correct Answer

Incorrect Answers

Question 240

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests