CompTIA CS0-003 Practice Test 31

Question 300

A playbook automatically blocks customer production IPs after one low-confidence feed hit. What is the MOST appropriate analyst action based on the evidence?

Monitor enrichment execution health and mark missing values explicitly in the case.
Enrich each case automatically from authoritative inventory and identity APIs.
Require data freshness and health checks before automatic close logic.
Add severity, confidence and business approval gates before disruptive blocking.

Explanation

Correct Answer

High-impact actions require stronger evidence and accountable authorization. Prevent risky auto-block from weak indicator.

Incorrect Answers

Missing context should not be interpreted as a clean reputation verdict. That is relevant to soar enrichment design, not to prevent risky auto-block from weak indicator.

Repeatable read-only context gathering is appropriate for controlled automation. It would automate repetitive security context gathering, but it would not prevent risky auto-block from weak indicator.

Incomplete telemetry must not become false evidence of safety. It could help prevent unsafe automated incident closure, but it would not prevent risky auto-block from weak indicator.

Question 301

A SOC playbook retries a token-revocation API repeatedly after a timeout. Which next step is MOST defensible for the security team?

Make the operation idempotent and inspect actual token status before retrying.
Poll operation completion and verify device state before recording successful containment.
Restrict the integration to read-specific scopes and managed secret rotation.
Require authenticated signed webhook messages and validate schema before ingestion.

Explanation

Correct Answer

Blind retries can cause noisy failures and inconsistent incident records. Design safe SOAR retry handling.

Incorrect Answers

Accepted asynchronous requests are not proof that the security action finished. It could help verify asynchronous containment API success, but it would not design safe SOAR retry handling.

Excess privilege expands an integration's compromise impact. That is relevant to api, webhook and plugin trust, not to design safe SOAR retry handling.

External payloads can be spoofed to trigger destructive response workflows. It would secure alert ingestion webhook, but it would not design safe SOAR retry handling.

Question 302

An analyst uses a checklist for common malware triage but case ownership varies by shift. Which action BEST aligns with sound security operations?

Route the decision to authorized legal and incident leadership rather than auto-classifying.
Standardize required fields and routing within a documented SOC playbook.
Reorder workflow to capture evidence and approval before destructive remediation.
Use approved SOAR adapters to distribute standardized indicators with change tracking.

Explanation

Correct Answer

Consistent workflow reduces handoff omissions between operators. Standardize cross-shift incident intake.

Incorrect Answers

Regulatory and materiality judgments often require accountable human review. It could help reserve legal disclosure decisions for humans, but it would not standardize cross-shift incident intake.

Early destruction can eliminate the artifacts needed to confirm scope. It would preserve evidence ahead of automated deletion, but it would not standardize cross-shift incident intake.

Orchestration reduces repetitive entry while preserving auditability. It could help automate approved indicator propagation, but it would not standardize cross-shift incident intake.

Question 303

Enrichment makes triage faster but adds excessive costly external API calls. Which response BEST addresses the security problem described?

Enforce stable incident identifiers and idempotent case creation.
Measure end-to-end elapsed time from detection through completed containment.
Cache reusable low-risk context with freshness and rate-limit safeguards.
Compare missed detections and true-positive rate before labeling suppression a success.

Explanation

Correct Answer

Controlled caching reduces redundant calls without making stale evidence look current. Optimize enrichment API efficiency.

Incorrect Answers

Duplicate workflow execution wastes staff time and fragments evidence. That is relevant to soc throughput and automation metrics, not to optimize enrichment API efficiency.

Partial automation metrics can hide remaining human queue bottlenecks. It would measure true automated containment latency, but it would not optimize enrichment API efficiency.

Fewer alerts alone can conceal weakened detection coverage. That is relevant to soc throughput and automation metrics, not to optimize enrichment API efficiency.

Question 304

A playbook makes case notes but omits original source event IDs. Which investigative or response action BEST fits the evidence?

Automate safe hash extraction and standard enrichment while retaining analyst verdict ownership.
Require human verification and release authorization for external incident statements.
Apply documented severity-and-impact triage with dedicated high-priority routing.
Preserve immutable source references in the case record for reproducible investigation.

Explanation

Correct Answer

Analysts must be able to reconnect conclusions to original telemetry. Improve evidence traceability in automated case.

Incorrect Answers

Deterministic repeated data collection can be automated without handing over final judgment. It would automate reproducible tier-one enrichment, but it would not improve evidence traceability in automated case.

Incorrect automated summaries can disclose inaccuracies and sensitive data. It could help gate externally distributed automated incident summaries, but it would not improve evidence traceability in automated case.

Stable prioritization protects urgent work under workload bursts. That is relevant to triage workflow in small soc, not to improve evidence traceability in automated case.

Question 305

An alert closes automatically when a vendor scanner returns no current result despite data-source outage. What is the MOST appropriate analyst action based on the evidence?

Require data freshness and health checks before automatic close logic.
Monitor enrichment execution health and mark missing values explicitly in the case.
Add severity, confidence and business approval gates before disruptive blocking.
Enrich each case automatically from authoritative inventory and identity APIs.

Explanation

Correct Answer

Incomplete telemetry must not become false evidence of safety. Prevent unsafe automated incident closure.

Incorrect Answers

Missing context should not be interpreted as a clean reputation verdict. That is relevant to soar enrichment design, not to prevent unsafe automated incident closure.

High-impact actions require stronger evidence and accountable authorization. It would prevent risky auto-block from weak indicator, but it would not prevent unsafe automated incident closure.

Repeatable read-only context gathering is appropriate for controlled automation. It could help automate repetitive security context gathering, but it would not prevent unsafe automated incident closure.

Question 306

A case escalates to incident response but an automated rule immediately closes it as noise. Which next step is MOST defensible for the security team?

Record per-target acknowledgments and reconcile failed deployments.
Exempt active escalations from auto-closure pending accountable resolution.
Assign one incident commander and orchestrate actions through a shared record.
Use tenant and stable workload identifiers for routing assignments.

Explanation

Correct Answer

Workflow state gates protect investigations from premature termination. Protect escalated cases from automation override.

Incorrect Answers

Partial orchestration success must not be reported as universal protection. That is relevant to playbook incident ownership, not to protect escalated cases from automation override.

Coordinated response prevents conflicting remediation and lost evidence. It could help prevent competing duplicate containment actions, but it would not protect escalated cases from automation override.

Dynamic cloud names are insufficient for durable case ownership. That is relevant to playbook incident ownership, not to protect escalated cases from automation override.

Question 307

A triage task involves legal interpretation of breach notification obligations. Which action BEST aligns with sound security operations?

Standardize required fields and routing within a documented SOC playbook.
Use approved SOAR adapters to distribute standardized indicators with change tracking.
Route the decision to authorized legal and incident leadership rather than auto-classifying.
Reorder workflow to capture evidence and approval before destructive remediation.

Explanation

Correct Answer

Regulatory and materiality judgments often require accountable human review. Reserve legal disclosure decisions for humans.

Incorrect Answers

Consistent workflow reduces handoff omissions between operators. It would standardize cross-shift incident intake, but it would not reserve legal disclosure decisions for humans.

Orchestration reduces repetitive entry while preserving auditability. It could help automate approved indicator propagation, but it would not reserve legal disclosure decisions for humans.

Early destruction can eliminate the artifacts needed to confirm scope. It would preserve evidence ahead of automated deletion, but it would not reserve legal disclosure decisions for humans.

Question 308

A scripted case-summary report is sent without review to external customers. Which response BEST addresses the security problem described?

Preserve immutable source references in the case record for reproducible investigation.
Automate safe hash extraction and standard enrichment while retaining analyst verdict ownership.
Apply documented severity-and-impact triage with dedicated high-priority routing.
Require human verification and release authorization for external incident statements.

Explanation

Correct Answer

Incorrect automated summaries can disclose inaccuracies and sensitive data. Gate externally distributed automated incident summaries.

Incorrect Answers

Analysts must be able to reconnect conclusions to original telemetry. It could help improve evidence traceability in automated case, but it would not gate externally distributed automated incident summaries.

Deterministic repeated data collection can be automated without handing over final judgment. That is relevant to triage workflow in small soc, not to gate externally distributed automated incident summaries.

Stable prioritization protects urgent work under workload bursts. It would streamline high-severity queue handling, but it would not gate externally distributed automated incident summaries.

Question 309

A SOC webhook receives unauthenticated event payloads claiming critical severity. Which investigative or response action BEST fits the evidence?

Require authenticated signed webhook messages and validate schema before ingestion.
Restrict the integration to read-specific scopes and managed secret rotation.
Poll operation completion and verify device state before recording successful containment.
Make the operation idempotent and inspect actual token status before retrying.

Explanation

Correct Answer

External payloads can be spoofed to trigger destructive response workflows. Secure alert ingestion webhook.

Incorrect Answers

Excess privilege expands an integration's compromise impact. It would least privilege SOAR API integration, but it would not secure alert ingestion webhook.

Accepted asynchronous requests are not proof that the security action finished. It could help verify asynchronous containment API success, but it would not secure alert ingestion webhook.

Blind retries can cause noisy failures and inconsistent incident records. That is relevant to api, webhook and plugin trust, not to secure alert ingestion webhook.

Question 310

An enrichment service fetches geolocation but ignores proxy and VPN routing. What is the MOST appropriate analyst action based on the evidence?

Apply source-based validity periods and scheduled expiration review.
Add proxy or known egress metadata before interpreting unusual country alerts.
Flag missing criticality and request asset ownership instead of defaulting to low risk.
Correlate campaign and entity identifiers to group related evidence without discarding details.

Explanation

Correct Answer

Geolocation without egress context exaggerates travel anomalies. Enrich location alerts with proxy context.

Incorrect Answers

Stale blocks can harm legitimate users after malicious infrastructure changes. It would expire outdated automated IOC controls, but it would not enrich location alerts with proxy context.

Unknown impact should not be silently treated as negligible. That is relevant to risk-based alert enrichment improvements, not to enrich location alerts with proxy context.

Case fusion reduces duplicate work while preserving distinct observations. It would consolidate related multi-sensor alerts, but it would not enrich location alerts with proxy context.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 29 - 10 Questions (Last Reviewed 17-Oct-2026)
CompTIA CS0-003 Practice Test 30 - 10 Questions (Last Reviewed 16-Oct-2026)
CompTIA CS0-003 Practice Test 31 - 10 Questions (Last Reviewed 15-Oct-2026)
CompTIA CS0-003 Practice Test 32 - 10 Questions (Last Reviewed 14-Oct-2026)
CompTIA CS0-003 Practice Test 33 - 10 Questions (Last Reviewed 13-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 300

Explanation

Correct Answer

Incorrect Answers

Question 301

Explanation

Correct Answer

Incorrect Answers

Question 302

Explanation

Correct Answer

Incorrect Answers

Question 303

Explanation

Correct Answer

Incorrect Answers

Question 304

Explanation

Correct Answer

Incorrect Answers

Question 305

Explanation

Correct Answer

Incorrect Answers

Question 306

Explanation

Correct Answer

Incorrect Answers

Question 307

Explanation

Correct Answer

Incorrect Answers

Question 308

Explanation

Correct Answer

Incorrect Answers

Question 309

Explanation

Correct Answer

Incorrect Answers

Question 310

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests