CompTIA CS0-003 Practice Test 25

Question 240

A threat feed import duplicates identical indicators with inconsistent expiration timestamps. What is the MOST appropriate analyst action based on the evidence?

Add authorization and audit checkpoints for token-revocation actions.
Enrich the alert from authoritative identity and asset inventories before analyst review.
Add confidence and business-criticality gates requiring analyst approval for disruptive isolation.
Normalize and deduplicate indicators while preserving source confidence and last-seen times.

Explanation

Correct Answer

Duplicate data and stale lifetimes can distort enrichment decisions. Clean repeated intelligence indicators.

Incorrect Answers

Security orchestration must respect identity control privileges and traceability. That is relevant to soar action and enrichment boundaries, not to clean repeated intelligence indicators.

Verified context improves prioritization without manufacturing certainty. It would automate asset-owner alert enrichment, but it would not clean repeated intelligence indicators.

High-impact automation should not trust a single weak signal. It could help prevent unsafe SOAR auto-isolation, but it would not clean repeated intelligence indicators.

Question 241

A SOAR playbook automatically isolates every machine with a low-confidence reputation hit. Which next step is MOST defensible for the security team?

Add confidence and business-criticality gates requiring analyst approval for disruptive isolation.
Add authorization and audit checkpoints for token-revocation actions.
Enrich the alert from authoritative identity and asset inventories before analyst review.
Normalize and deduplicate indicators while preserving source confidence and last-seen times.

Explanation

Correct Answer

High-impact automation should not trust a single weak signal. Prevent unsafe SOAR auto-isolation.

Incorrect Answers

Security orchestration must respect identity control privileges and traceability. It could help govern SOAR credential revocation, but it would not prevent unsafe SOAR auto-isolation.

Verified context improves prioritization without manufacturing certainty. That is relevant to soar action and enrichment boundaries, not to prevent unsafe SOAR auto-isolation.

Duplicate data and stale lifetimes can distort enrichment decisions. It would clean repeated intelligence indicators, but it would not prevent unsafe SOAR auto-isolation.

Question 242

An endpoint prevention event contains a blocked injection but no evidence of executed payload. Which action BEST aligns with sound security operations?

Query EDR for the same hash, signer and execution paths across managed endpoints.
Validate the prevention outcome and inspect parent-child telemetry for successful follow-up.
Correlate sensor-health events with privileged changes and network connectivity evidence.
Build a process and persistence timeline from EDR telemetry and related user sessions.

Explanation

Correct Answer

Block alerts are not proof that code ran successfully. Assess actual EDR prevention efficacy.

Incorrect Answers

Enterprise-wide telemetry helps determine whether compromise is isolated. It could help expand detection across fleet by file indicators, but it would not assess actual EDR prevention efficacy.

Security service tampering may masquerade as connectivity failure. It would investigate deliberate EDR sensor disablement, but it would not assess actual EDR prevention efficacy.

Process lineage links initial execution to follow-on persistence. It could help investigate linked EDR process and task activity, but it would not assess actual EDR prevention efficacy.

Question 243

A capture on a SPAN port shows one-way traffic and no server responses. Which response BEST addresses the security problem described?

Use a scoped tcpdump capture filter and preserve the output pcap.
Apply a Wireshark stream filter and follow the matching TCP stream.
Confirm mirror-port direction and packet-loss counters before inferring a failed response.
Minimize scope and restrict pcap access in accordance with evidence policy.

Explanation

Correct Answer

Sensor vantage point can omit reverse traffic when mirroring is incomplete. Diagnose partial SPAN port visibility.

Incorrect Answers

Command-line packet capture can collect targeted traffic on headless systems. That is relevant to wireshark and tcpdump operational choice, not to diagnose partial SPAN port visibility.

Stream reassembly exposes application exchange across multiple packets. It would reconstruct single HTTP exchange from pcap, but it would not diagnose partial SPAN port visibility.

Packet payloads may contain sensitive authentication and personal data. That is relevant to wireshark and tcpdump operational choice, not to diagnose partial SPAN port visibility.

Question 244

Cloud control-plane logs show a public ACL change and no subsequent access records. Which investigative or response action BEST fits the evidence?

Correlate credential ID, source service and API actions to identify the actual principal.
Distinguish access attempts from successful data access using response codes and byte counts.
Normalize all event timestamps and validate time source before building the incident chronology.
Preserve the change evidence and assess exposure window rather than asserting theft.

Explanation

Correct Answer

Misconfiguration creates risk even absent observed object download. Assess cloud exposure without observed theft.

Incorrect Answers

Service credentials can be copied across environments without changing identity name. It would detect cloud workload identity credential misuse, but it would not assess cloud exposure without observed theft.

Denied operations are not proof that data was exfiltrated. It could help classify failed versus successful cloud reads, but it would not assess cloud exposure without observed theft.

Clock and timezone differences can produce false event sequences. That is relevant to cloud log and access interpretation, not to assess cloud exposure without observed theft.

Question 245

An EDR alert shows a signed browser spawning powershell and a new scheduled task. What is the MOST appropriate analyst action based on the evidence?

Build a process and persistence timeline from EDR telemetry and related user sessions.
Validate the prevention outcome and inspect parent-child telemetry for successful follow-up.
Query EDR for the same hash, signer and execution paths across managed endpoints.
Correlate sensor-health events with privileged changes and network connectivity evidence.

Explanation

Correct Answer

Process lineage links initial execution to follow-on persistence. Investigate linked EDR process and task activity.

Incorrect Answers

Block alerts are not proof that code ran successfully. That is relevant to endpoint detection and response analysis, not to investigate linked EDR process and task activity.

Enterprise-wide telemetry helps determine whether compromise is isolated. It would expand detection across fleet by file indicators, but it would not investigate linked EDR process and task activity.

Security service tampering may masquerade as connectivity failure. It could help investigate deliberate EDR sensor disablement, but it would not investigate linked EDR process and task activity.

Question 246

A Linux server log has thousands of lines and an analyst needs one IP's activity. Which next step is MOST defensible for the security team?

Parse JSON structurally and map source fields instead of using brittle text substring matches.
Use a bounded grep or awk filter against preserved copies of the original log.
Use an explicit decoding-error strategy and retain original bytes for forensic traceability.
Use an XML-aware parser with the correct namespace declarations.

Explanation

Correct Answer

Targeted text filtering accelerates triage without modifying primary evidence. Isolate events by IP in Linux logs.

Incorrect Answers

Correct structured parsing prevents loss or confusion of nested event attributes. That is relevant to shell and scripting for log extraction, not to isolate events by IP in Linux logs.

Silently dropping parse failures can remove key events from evidence. It could help handle invalid log encoding safely, but it would not isolate events by IP in Linux logs.

Namespace handling is needed to retrieve fields reliably from XML records. That is relevant to shell and scripting for log extraction, not to isolate events by IP in Linux logs.

Question 247

A suspicious binary was deleted but its execution record remains in OS artifacts. Which action BEST aligns with sound security operations?

Stop reliance on the copy and repeat a verified forensic acquisition.
Correlate injected memory mappings with parent processes and network connections.
Correlate prefetch or equivalent execution artifacts with system event logs.
Coordinate volatile-memory capture before reboot when safe and authorized.

Explanation

Correct Answer

Execution artifacts can survive file deletion and support timeline reconstruction. Prove historical execution after file deletion.

Incorrect Answers

Integrity mismatches undermine evidentiary confidence in the copied image. It would reject corrupted forensic disk copy, but it would not prove historical execution after file deletion.

Fileless payloads can be found through process-memory anomalies. It could help investigate fileless code from memory, but it would not prove historical execution after file deletion.

Reboot can destroy transient process and memory evidence. It would prioritize volatile memory preservation, but it would not prove historical execution after file deletion.

Question 248

A threat hunt returns several DNS anomalies but no endpoint evidence of execution. Which response BEST addresses the security problem described?

Hunt for new executable content and unusual web-worker child processes.
Measure telemetry coverage and document blind spots before calling the hypothesis disproved.
Hunt for unusual task creation and execution patterns mapped to the reported technique.
Pivot to related process and network telemetry before escalating as confirmed compromise.

Explanation

Correct Answer

Multiple independent data sources strengthen conclusions over one anomaly. Validate DNS hunt with endpoint evidence.

Incorrect Answers

Combining filesystem change with process ancestry narrows web-shell hypotheses. It could help investigate web-shell-like behavior hunt, but it would not validate DNS hunt with endpoint evidence.

No matches in incomplete telemetry do not prove absence of an adversary. That is relevant to proactive threat hunt techniques, not to validate DNS hunt with endpoint evidence.

Behavior-based hunts remain useful when brittle exact indicators are unavailable. It would hunt scheduled-task TTP without IOC, but it would not validate DNS hunt with endpoint evidence.

Question 249

A sector ISAC circulates a TLP:AMBER advisory to trusted member SOCs. Which investigative or response action BEST fits the evidence?

Honor TLP sharing limits and route only to authorized members who need the information.
Use approved distribution channels and provide defensive handling guidance.
Map and validate fields against the chosen structured exchange format before ingesting.
Remove identifying details and comply with incident disclosure policy.

Explanation

Correct Answer

Sharing designations restrict distribution without reducing internal actionability. Enforce threat-information sharing markings.

Incorrect Answers

Controlled sharing can reduce unintended offensive reuse and misinterpretation. It would distribute sensitive technical advisory responsibly, but it would not enforce threat-information sharing markings.

Interoperable threat sharing depends on correct type and confidence representation. It could help fix structured intelligence import schema, but it would not enforce threat-information sharing markings.

Threat collaboration should not expose victim identities or active response details. That is relevant to threat sharing permissions and safeguards, not to enforce threat-information sharing markings.

Question 250

New detections resemble an old actor's technique but use unrelated malware and infrastructure. What is the MOST appropriate analyst action based on the evidence?

Mark attribution as unconfirmed and seek independent campaign-specific behavioral corroboration.
Compare TTP sequence and targeting with multiple high-quality sources before grouping campaigns.
Distinguish hosting location from operator identity and require independent attribution evidence.
Amend internal intelligence records and notify consumers of the confidence change.

Explanation

Correct Answer

Single technique overlap can be coincidental across unrelated intrusions. Assess campaign clustering uncertainty.

Incorrect Answers

Commodity tools alone are insufficient to identify a unique threat actor. It would avoid false APT attribution from dual-use tooling, but it would not assess campaign clustering uncertainty.

Cloud hosting and proxy routing make geolocation weak evidence of attacker nationality. That is relevant to confidence-adjusted actor attribution, not to assess campaign clustering uncertainty.

Attribution corrections must propagate to downstream decisions. It would correct stale internal actor classification, but it would not assess campaign clustering uncertainty.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 23 - 10 Questions (Last Reviewed 23-Oct-2026)
CompTIA CS0-003 Practice Test 24 - 10 Questions (Last Reviewed 22-Oct-2026)
CompTIA CS0-003 Practice Test 25 - 10 Questions (Last Reviewed 21-Oct-2026)
CompTIA CS0-003 Practice Test 26 - 10 Questions (Last Reviewed 20-Oct-2026)
CompTIA CS0-003 Practice Test 27 - 10 Questions (Last Reviewed 19-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 240

Explanation

Correct Answer

Incorrect Answers

Question 241

Explanation

Correct Answer

Incorrect Answers

Question 242

Explanation

Correct Answer

Incorrect Answers

Question 243

Explanation

Correct Answer

Incorrect Answers

Question 244

Explanation

Correct Answer

Incorrect Answers

Question 245

Explanation

Correct Answer

Incorrect Answers

Question 246

Explanation

Correct Answer

Incorrect Answers

Question 247

Explanation

Correct Answer

Incorrect Answers

Question 248

Explanation

Correct Answer

Incorrect Answers

Question 249

Explanation

Correct Answer

Incorrect Answers

Question 250

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests