CompTIA CS0-003 Practice Test 33

Question 320

An automation deletes flagged files before an analyst can preserve their hashes. What is the MOST appropriate analyst action based on the evidence?

Standardize required fields and routing within a documented SOC playbook.
Route the decision to authorized legal and incident leadership rather than auto-classifying.
Use approved SOAR adapters to distribute standardized indicators with change tracking.
Reorder workflow to capture evidence and approval before destructive remediation.

Explanation

Correct Answer

Early destruction can eliminate the artifacts needed to confirm scope. Preserve evidence ahead of automated deletion.

Incorrect Answers

Consistent workflow reduces handoff omissions between operators. It could help standardize cross-shift incident intake, but it would not preserve evidence ahead of automated deletion.

Regulatory and materiality judgments often require accountable human review. That is relevant to repeatable process and human decisions, not to preserve evidence ahead of automated deletion.

Orchestration reduces repetitive entry while preserving auditability. It would automate approved indicator propagation, but it would not preserve evidence ahead of automated deletion.

Question 321

High-priority alerts lack business criticality because the CMDB field is empty. Which next step is MOST defensible for the security team?

Flag missing criticality and request asset ownership instead of defaulting to low risk.
Add proxy or known egress metadata before interpreting unusual country alerts.
Apply source-based validity periods and scheduled expiration review.
Correlate campaign and entity identifiers to group related evidence without discarding details.

Explanation

Correct Answer

Unknown impact should not be silently treated as negligible. Handle missing asset criticality safely.

Incorrect Answers

Geolocation without egress context exaggerates travel anomalies. It would enrich location alerts with proxy context, but it would not handle missing asset criticality safely.

Stale blocks can harm legitimate users after malicious infrastructure changes. It could help expire outdated automated IOC controls, but it would not handle missing asset criticality safely.

Case fusion reduces duplicate work while preserving distinct observations. That is relevant to risk-based alert enrichment improvements, not to handle missing asset criticality safely.

Question 322

An analyst can trigger a playbook that disables accounts but its operator identity is not logged. Which action BEST aligns with sound security operations?

Restore the enforced approval step and audit attempted use.
Record initiating analyst, delegated authority and action outcomes in immutable audit logs.
Validate in a sandbox with benign and malicious samples before enabling automation.
Check approved data processing and location requirements before enabling export.

Explanation

Correct Answer

Accountability is required for high-impact identity actions. Attribute human-triggered automated account suspension.

Incorrect Answers

Privileged bulk changes should honor separation of duties. It would preserve two-person approval for bulk isolation, but it would not attribute human-triggered automated account suspension.

Untested response logic risks disrupting legitimate operations. That is relevant to automation authorization and audit, not to attribute human-triggered automated account suspension.

Orchestration integrations can move regulated evidence beyond trusted boundaries. It would govern SOAR cross-border data export, but it would not attribute human-triggered automated account suspension.

Question 323

An automated response API returns HTTP 202 but the target device remains online. Which response BEST addresses the security problem described?

Restrict the integration to read-specific scopes and managed secret rotation.
Make the operation idempotent and inspect actual token status before retrying.
Poll operation completion and verify device state before recording successful containment.
Require authenticated signed webhook messages and validate schema before ingestion.

Explanation

Correct Answer

Accepted asynchronous requests are not proof that the security action finished. Verify asynchronous containment API success.

Incorrect Answers

Excess privilege expands an integration's compromise impact. It could help least privilege SOAR API integration, but it would not verify asynchronous containment API success.

Blind retries can cause noisy failures and inconsistent incident records. That is relevant to api, webhook and plugin trust, not to verify asynchronous containment API success.

External payloads can be spoofed to trigger destructive response workflows. It could help secure alert ingestion webhook, but it would not verify asynchronous containment API success.

Question 324

Alert volume drops sharply after a new suppression rule but confirmed incidents rise. Which investigative or response action BEST fits the evidence?

Enforce stable incident identifiers and idempotent case creation.
Cache reusable low-risk context with freshness and rate-limit safeguards.
Measure end-to-end elapsed time from detection through completed containment.
Compare missed detections and true-positive rate before labeling suppression a success.

Explanation

Correct Answer

Fewer alerts alone can conceal weakened detection coverage. Validate alert suppression against incident outcomes.

Incorrect Answers

Duplicate workflow execution wastes staff time and fragments evidence. That is relevant to soc throughput and automation metrics, not to validate alert suppression against incident outcomes.

Controlled caching reduces redundant calls without making stale evidence look current. It would optimize enrichment API efficiency, but it would not validate alert suppression against incident outcomes.

Partial automation metrics can hide remaining human queue bottlenecks. It could help measure true automated containment latency, but it would not validate alert suppression against incident outcomes.

Question 325

Automation updates a malicious-domain block list but never removes entries after expiry. What is the MOST appropriate analyst action based on the evidence?

Apply source-based validity periods and scheduled expiration review.
Flag missing criticality and request asset ownership instead of defaulting to low risk.
Add proxy or known egress metadata before interpreting unusual country alerts.
Correlate campaign and entity identifiers to group related evidence without discarding details.

Explanation

Correct Answer

Stale blocks can harm legitimate users after malicious infrastructure changes. Expire outdated automated IOC controls.

Incorrect Answers

Unknown impact should not be silently treated as negligible. It could help handle missing asset criticality safely, but it would not expire outdated automated IOC controls.

Geolocation without egress context exaggerates travel anomalies. That is relevant to risk-based alert enrichment improvements, not to expire outdated automated IOC controls.

Case fusion reduces duplicate work while preserving distinct observations. It would consolidate related multi-sensor alerts, but it would not expire outdated automated IOC controls.

Question 326

Analysts manually copy the same validated IOC into several sensor formats. Which next step is MOST defensible for the security team?

Reorder workflow to capture evidence and approval before destructive remediation.
Use approved SOAR adapters to distribute standardized indicators with change tracking.
Route the decision to authorized legal and incident leadership rather than auto-classifying.
Standardize required fields and routing within a documented SOC playbook.

Explanation

Correct Answer

Orchestration reduces repetitive entry while preserving auditability. Automate approved indicator propagation.

Incorrect Answers

Early destruction can eliminate the artifacts needed to confirm scope. It could help preserve evidence ahead of automated deletion, but it would not automate approved indicator propagation.

Regulatory and materiality judgments often require accountable human review. It would reserve legal disclosure decisions for humans, but it would not automate approved indicator propagation.

Consistent workflow reduces handoff omissions between operators. It could help standardize cross-shift incident intake, but it would not automate approved indicator propagation.

Question 327

A playbook claims to shorten response time but timestamps exclude manual handoff delays. Which action BEST aligns with sound security operations?

Enforce stable incident identifiers and idempotent case creation.
Cache reusable low-risk context with freshness and rate-limit safeguards.
Measure end-to-end elapsed time from detection through completed containment.
Compare missed detections and true-positive rate before labeling suppression a success.

Explanation

Correct Answer

Partial automation metrics can hide remaining human queue bottlenecks. Measure true automated containment latency.

Incorrect Answers

Duplicate workflow execution wastes staff time and fragments evidence. That is relevant to soc throughput and automation metrics, not to measure true automated containment latency.

Controlled caching reduces redundant calls without making stale evidence look current. It would optimize enrichment API efficiency, but it would not measure true automated containment latency.

Fewer alerts alone can conceal weakened detection coverage. That is relevant to soc throughput and automation metrics, not to measure true automated containment latency.

Question 328

A five-person SOC repeats manual packet hashes and reputation lookups for every incident. Which response BEST addresses the security problem described?

Apply documented severity-and-impact triage with dedicated high-priority routing.
Require human verification and release authorization for external incident statements.
Preserve immutable source references in the case record for reproducible investigation.
Automate safe hash extraction and standard enrichment while retaining analyst verdict ownership.

Explanation

Correct Answer

Deterministic repeated data collection can be automated without handing over final judgment. Automate reproducible tier-one enrichment.

Incorrect Answers

Stable prioritization protects urgent work under workload bursts. It would streamline high-severity queue handling, but it would not automate reproducible tier-one enrichment.

Incorrect automated summaries can disclose inaccuracies and sensitive data. It could help gate externally distributed automated incident summaries, but it would not automate reproducible tier-one enrichment.

Analysts must be able to reconnect conclusions to original telemetry. That is relevant to triage workflow in small soc, not to automate reproducible tier-one enrichment.

Question 329

A SOC dashboard mixes response-time units across vendors, displaying milliseconds as seconds. Which investigative or response action BEST fits the evidence?

Normalize telemetry units and verify derived dashboard calculations.
Use stable asset identifiers and recency-aware mapping for enrichment.
Require observation freshness metadata or mark confidence limited.
Deduplicate on verified asset and finding identifiers before reporting volumes.

Explanation

Correct Answer

Unit mismatches invalidate operational performance conclusions. Correct inconsistent SOC time metrics.

Incorrect Answers

Reassigned hostnames can misattribute historical incident evidence. That is relevant to triage integration failure modes, not to correct inconsistent SOC time metrics.

Reputation decisions depend on when the underlying evidence was true. It would handle undated threat reputation response, but it would not correct inconsistent SOC time metrics.

Duplicate records inflate exposure totals and distort prioritization. It could help repair duplicated scanner integration records, but it would not correct inconsistent SOC time metrics.

Question 330

A new enrichment integration silently fails and leaves empty reputation fields. What is the MOST appropriate analyst action based on the evidence?

Add severity, confidence and business approval gates before disruptive blocking.
Monitor enrichment execution health and mark missing values explicitly in the case.
Enrich each case automatically from authoritative inventory and identity APIs.
Require data freshness and health checks before automatic close logic.

Explanation

Correct Answer

Missing context should not be interpreted as a clean reputation verdict. Detect failed SOAR enrichment gracefully.

Incorrect Answers

High-impact actions require stronger evidence and accountable authorization. That is relevant to soar enrichment design, not to detect failed SOAR enrichment gracefully.

Repeatable read-only context gathering is appropriate for controlled automation. It could help automate repetitive security context gathering, but it would not detect failed SOAR enrichment gracefully.

Incomplete telemetry must not become false evidence of safety. That is relevant to soar enrichment design, not to detect failed SOAR enrichment gracefully.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 31 - 10 Questions (Last Reviewed 15-Oct-2026)
CompTIA CS0-003 Practice Test 32 - 10 Questions (Last Reviewed 14-Oct-2026)
CompTIA CS0-003 Practice Test 33 - 10 Questions (Last Reviewed 13-Oct-2026)
CompTIA CS0-003 Practice Test 34 - 10 Questions (Last Reviewed 12-Oct-2026)
CompTIA CS0-003 Practice Test 35 - 10 Questions (Last Reviewed 11-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 320

Explanation

Correct Answer

Incorrect Answers

Question 321

Explanation

Correct Answer

Incorrect Answers

Question 322

Explanation

Correct Answer

Incorrect Answers

Question 323

Explanation

Correct Answer

Incorrect Answers

Question 324

Explanation

Correct Answer

Incorrect Answers

Question 325

Explanation

Correct Answer

Incorrect Answers

Question 326

Explanation

Correct Answer

Incorrect Answers

Question 327

Explanation

Correct Answer

Incorrect Answers

Question 328

Explanation

Correct Answer

Incorrect Answers

Question 329

Explanation

Correct Answer

Incorrect Answers

Question 330

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests