CompTIA CS0-003 Practice Test 34

Question 330

A new enrichment integration silently fails and leaves empty reputation fields. What is the MOST appropriate analyst action based on the evidence?

Add severity, confidence and business approval gates before disruptive blocking.
Monitor enrichment execution health and mark missing values explicitly in the case.
Enrich each case automatically from authoritative inventory and identity APIs.
Require data freshness and health checks before automatic close logic.

Explanation

Correct Answer

Missing context should not be interpreted as a clean reputation verdict. Detect failed SOAR enrichment gracefully.

Incorrect Answers

High-impact actions require stronger evidence and accountable authorization. That is relevant to soar enrichment design, not to detect failed SOAR enrichment gracefully.

Repeatable read-only context gathering is appropriate for controlled automation. It could help automate repetitive security context gathering, but it would not detect failed SOAR enrichment gracefully.

Incomplete telemetry must not become false evidence of safety. That is relevant to soar enrichment design, not to detect failed SOAR enrichment gracefully.

Question 331

An agentless scanner reports no issues because the firewall blocks its authenticated management protocol. Which next step is MOST defensible for the security team?

Consolidate approved scan windows and communicate operational change impact.
Reconcile address leases, MAC observations and owner records before deciding it is one device.
Restore authorized management reachability and repeat the incomplete checks.
Report reachable-target coverage and retry authorized unreachable groups through approved paths.

Explanation

Correct Answer

Scanning a blocked service cannot validate the underlying configuration. Remediate blocked credentialed scan coverage.

Incorrect Answers

Duplicated intrusive assessments create avoidable load and business interruption risk. It would eliminate uncoordinated overlapping scans, but it would not remediate blocked credentialed scan coverage.

IP reuse and sensor vantage can produce ambiguous asset identities. It could help resolve ambiguous discovered device identity, but it would not remediate blocked credentialed scan coverage.

Job completion does not establish exhaustive asset assessment. It would distinguish scan job completion from coverage, but it would not remediate blocked credentialed scan coverage.

Question 332

A newly isolated office VLAN has no traffic baseline and passive sensors see no devices. Which action BEST aligns with sound security operations?

Throttle scan concurrency and schedule a scoped assessment with network owners.
Rely on passive traffic observation and vendor-approved OT discovery methods.
Verify asset presence and firmware through approved current inventory before prioritizing.
Arrange approved active discovery within a bounded maintenance window.

Explanation

Correct Answer

Passive discovery cannot identify silent assets absent observed network transmissions. Discover quiet hosts when passive fails.

Incorrect Answers

Scan-rate limits prevent assessment traffic from exhausting constrained links. It could help adjust scan rate for constrained network, but it would not discover quiet hosts when passive fails.

Legacy controllers may not tolerate ordinary active scan traffic. That is relevant to passive network versus active discovery, not to discover quiet hosts when passive fails.

Passive observations can become stale when devices are replaced or upgraded. It would validate stale passive fingerprint, but it would not discover quiet hosts when passive fails.

Question 333

A CIS baseline reports an exception approved by the risk owner with an expiration date. Which response BEST addresses the security problem described?

Record the compensating control and revalidation schedule with the exception.
Obtain the required authorized external scan evidence for the cardholder-data environment.
Separate policy or configuration exposure from software-specific CVE identification.
Run credentialed benchmark configuration checks and document deviations.

Explanation

Correct Answer

Governed baseline exceptions require documented risk acceptance and periodic review. Manage approved CIS benchmark exception.

Incorrect Answers

External and internal PCI scanning obligations are distinct. It would satisfy required PCI external scan evidence, but it would not manage approved CIS benchmark exception.

A weak setting is not automatically evidence of a particular software vulnerability. It could help classify baseline misconfiguration versus CVE, but it would not manage approved CIS benchmark exception.

Compliance baseline assessment evaluates settings beyond CVE presence. That is relevant to industry hardening benchmarks, not to manage approved CIS benchmark exception.

Question 334

Developers want to identify insecure code paths before a feature is deployed. Which investigative or response action BEST fits the evidence?

Use approved reverse engineering and debug analysis on isolated copies.
Run static application security testing against the relevant source and build artifacts.
Run authorized dynamic application security testing against a controlled environment.
Apply controlled fuzzing to explore boundary cases and collect crash evidence.

Explanation

Correct Answer

SAST can inspect code patterns before the application is running. Choose SAST for predeployment code analysis.

Incorrect Answers

Static binary inspection can reveal relevant implementation paths. It would assess closed-source executable logic, but it would not choose SAST for predeployment code analysis.

DAST exercises deployed behavior and runtime controls. That is relevant to static and dynamic application checks, not to choose SAST for predeployment code analysis.

Malformed input generation can reveal unanticipated input-handling defects. It would use fuzzing to find parser crash, but it would not choose SAST for predeployment code analysis.

Question 335

The scanner counts one load-balanced service as a single host despite multiple outdated backends. What is the MOST appropriate analyst action based on the evidence?

Integrate image assessment and orchestration inventory into the scanning workflow.
Expand authorized assessment to IPv6 address space and firewall policies.
Map backend pool members and scan each in authorized scope.
Record third-party service inventory and assess vendor assurances through agreed channels.

Explanation

Correct Answer

A shared virtual IP can hide different underlying versions. Enumerate behind load balancer.

Incorrect Answers

Ephemeral containers can disappear before ordinary network scans reach them. It could help include ephemeral container assets, but it would not enumerate behind load balancer.

IPv6-only exposure remains invisible to an IPv4-only scan. That is relevant to asset discovery completeness, not to enumerate behind load balancer.

Asset management extends to externally hosted dependencies, subject to contractual authority. It could help include SaaS dependencies in vulnerability program, but it would not enumerate behind load balancer.

Question 336

A scanner begins testing live payment systems with exploit modules rather than nonintrusive checks. Which next step is MOST defensible for the security team?

Agree on maintenance windows, throttling and rollback procedures with service owners.
Remove the unauthorized targets and obtain explicit scope approval first.
Test in representative staging and use less disruptive authenticated checks until an approved window.
Disable intrusive plugins until owner-authorized testing is approved and controlled.

Explanation

Correct Answer

Exploit validation can alter state or disrupt regulated workloads. Gate intrusive scan plugins.

Incorrect Answers

Vulnerability assessment should not jeopardize patient service availability. That is relevant to scan planning and availability, not to gate intrusive scan plugins.

Scanner authorization is mandatory even for defensive testing. It would stop out-of-scope vulnerability scans, but it would not gate intrusive scan plugins.

Risk-based scheduling balances visibility with operational change restrictions. It could help assess during retail production freeze, but it would not gate intrusive scan plugins.

Question 337

A vulnerability scan's target list includes production and lab hosts with identical names. Which action BEST aligns with sound security operations?

Resolve stable asset identifiers and IP ownership before launching probes.
Disable state-changing tests until safe authorization and data-reset conditions exist.
Seek written permission or use contractually available security assurance evidence.
Update the scanning scope and required reporting obligations with governance approval.

Explanation

Correct Answer

Name ambiguity can result in probing unintended critical systems. Prevent wrong-target scan from name collision.

Incorrect Answers

API security testing can delete real records when methods are misused. It could help avoid destructive API fuzzing, but it would not prevent wrong-target scan from name collision.

Defensive intent does not authorize probing another organization's systems. That is relevant to scope drift and legal constraints, not to prevent wrong-target scan from name collision.

Scan coverage must reflect current regulated system boundaries. It would incorporate newly scoped regulated subnet, but it would not prevent wrong-target scan from name collision.

Question 338

A security analyst needs to understand an opaque executable's file-format handling without its source. Which response BEST addresses the security problem described?

Run authorized dynamic application security testing against a controlled environment.
Use approved reverse engineering and debug analysis on isolated copies.
Apply controlled fuzzing to explore boundary cases and collect crash evidence.
Run static application security testing against the relevant source and build artifacts.

Explanation

Correct Answer

Static binary inspection can reveal relevant implementation paths. Assess closed-source executable logic.

Incorrect Answers

DAST exercises deployed behavior and runtime controls. It could help detect runtime session flaw with DAST, but it would not assess closed-source executable logic.

Malformed input generation can reveal unanticipated input-handling defects. It would use fuzzing to find parser crash, but it would not assess closed-source executable logic.

SAST can inspect code patterns before the application is running. It could help choose SAST for predeployment code analysis, but it would not assess closed-source executable logic.

Question 339

A remote SaaS vendor is excluded because it is not on-premises. Which investigative or response action BEST fits the evidence?

Expand authorized assessment to IPv6 address space and firewall policies.
Map backend pool members and scan each in authorized scope.
Record third-party service inventory and assess vendor assurances through agreed channels.
Integrate image assessment and orchestration inventory into the scanning workflow.

Explanation

Correct Answer

Asset management extends to externally hosted dependencies, subject to contractual authority. Include SaaS dependencies in vulnerability program.

Incorrect Answers

IPv6-only exposure remains invisible to an IPv4-only scan. That is relevant to asset discovery completeness, not to include SaaS dependencies in vulnerability program.

A shared virtual IP can hide different underlying versions. It would enumerate behind load balancer, but it would not include SaaS dependencies in vulnerability program.

Ephemeral containers can disappear before ordinary network scans reach them. That is relevant to asset discovery completeness, not to include SaaS dependencies in vulnerability program.

Question 340

An API fuzzing job includes destructive DELETE operations in production. What is the MOST appropriate analyst action based on the evidence?

Resolve stable asset identifiers and IP ownership before launching probes.
Update the scanning scope and required reporting obligations with governance approval.
Seek written permission or use contractually available security assurance evidence.
Disable state-changing tests until safe authorization and data-reset conditions exist.

Explanation

Correct Answer

API security testing can delete real records when methods are misused. Avoid destructive API fuzzing.

Incorrect Answers

Name ambiguity can result in probing unintended critical systems. It would prevent wrong-target scan from name collision, but it would not avoid destructive API fuzzing.

Scan coverage must reflect current regulated system boundaries. It could help incorporate newly scoped regulated subnet, but it would not avoid destructive API fuzzing.

Defensive intent does not authorize probing another organization's systems. That is relevant to scope drift and legal constraints, not to avoid destructive API fuzzing.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 32 - 10 Questions (Last Reviewed 14-Oct-2026)
CompTIA CS0-003 Practice Test 33 - 10 Questions (Last Reviewed 13-Oct-2026)
CompTIA CS0-003 Practice Test 34 - 10 Questions (Last Reviewed 12-Oct-2026)
CompTIA CS0-003 Practice Test 35 - 10 Questions (Last Reviewed 11-Oct-2026)
CompTIA CS0-003 Practice Test 36 - 10 Questions (Last Reviewed 10-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 330

Explanation

Correct Answer

Incorrect Answers

Question 331

Explanation

Correct Answer

Incorrect Answers

Question 332

Explanation

Correct Answer

Incorrect Answers

Question 333

Explanation

Correct Answer

Incorrect Answers

Question 334

Explanation

Correct Answer

Incorrect Answers

Question 335

Explanation

Correct Answer

Incorrect Answers

Question 336

Explanation

Correct Answer

Incorrect Answers

Question 337

Explanation

Correct Answer

Incorrect Answers

Question 338

Explanation

Correct Answer

Incorrect Answers

Question 339

Explanation

Correct Answer

Incorrect Answers

Question 340

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests