CompTIA CS0-003 Practice Test 36

Question 350

A compliance boundary changes and a previously excluded storage subnet now holds regulated records. What is the MOST appropriate analyst action based on the evidence?

Disable state-changing tests until safe authorization and data-reset conditions exist.
Update the scanning scope and required reporting obligations with governance approval.
Resolve stable asset identifiers and IP ownership before launching probes.
Seek written permission or use contractually available security assurance evidence.

Explanation

Correct Answer

Scan coverage must reflect current regulated system boundaries. Incorporate newly scoped regulated subnet.

Incorrect Answers

API security testing can delete real records when methods are misused. It could help avoid destructive API fuzzing, but it would not incorporate newly scoped regulated subnet.

Name ambiguity can result in probing unintended critical systems. It would prevent wrong-target scan from name collision, but it would not incorporate newly scoped regulated subnet.

Defensive intent does not authorize probing another organization's systems. It could help obtain third-party scan authorization, but it would not incorporate newly scoped regulated subnet.

Question 351

An agent reports package versions but cannot evaluate an externally exposed web application's controls. Which next step is MOST defensible for the security team?

Reconcile agent identity and disposal evidence in authoritative asset inventory.
Deploy approved endpoint agents that report over sanctioned cloud management channels.
Supplement agent findings with authorized dynamic application testing.
Tune agent scheduling and resource usage with kiosk owners.

Explanation

Correct Answer

Host package inspection does not cover every application-layer vulnerability. Pair host agent scans with app tests.

Incorrect Answers

Old agent records can falsely inflate active exposure. That is relevant to agent-based scanning design, not to pair host agent scans with app tests.

Agents can assess roaming endpoints without requiring internal network reachability. It would cover remote roaming assets with agents, but it would not pair host agent scans with app tests.

Endpoint assessment must consider business performance impact. That is relevant to agent-based scanning design, not to pair host agent scans with app tests.

Question 352

A network inventory reports an unknown device fingerprint from three disconnected monitoring segments. Which action BEST aligns with sound security operations?

Report reachable-target coverage and retry authorized unreachable groups through approved paths.
Consolidate approved scan windows and communicate operational change impact.
Restore authorized management reachability and repeat the incomplete checks.
Reconcile address leases, MAC observations and owner records before deciding it is one device.

Explanation

Correct Answer

IP reuse and sensor vantage can produce ambiguous asset identities. Resolve ambiguous discovered device identity.

Incorrect Answers

Job completion does not establish exhaustive asset assessment. It would distinguish scan job completion from coverage, but it would not resolve ambiguous discovered device identity.

Duplicated intrusive assessments create avoidable load and business interruption risk. It could help eliminate uncoordinated overlapping scans, but it would not resolve ambiguous discovered device identity.

Scanning a blocked service cannot validate the underlying configuration. That is relevant to maturity of scan evidence, not to resolve ambiguous discovered device identity.

Question 353

A public cloud security group opens port 22 only to a broad partner range. Which response BEST addresses the security problem described?

Validate from an authorized external partner vantage, then narrow source controls.
Document scan vantage and intermediary certificates before comparing vulnerability findings.
Perform approved inside-segment assessment and correct inappropriate trust exposure.
Include sanctioned external DNS and virtual-host context in the assessment scope.

Explanation

Correct Answer

Cloud reachability depends on network policy and source address. Assess partner-reachable SSH exposure.

Incorrect Answers

Middleboxes can modify observed service and certificate characteristics. That is relevant to internal and external scan differences, not to assess partner-reachable SSH exposure.

External results do not measure lateral movement opportunities inside the network. It would reveal internally exposed admin service, but it would not assess partner-reachable SSH exposure.

Host-header routing changes which application attack surface is tested. It could help test public virtual-host exposure, but it would not assess partner-reachable SSH exposure.

Question 354

A production signup scanner creates thousands of test customers unintentionally. Which investigative or response action BEST fits the evidence?

Configure stateful token handling and retest representative workflows.
Limit payload creation and use dedicated sandbox accounts or staging where equivalent.
Authenticate with approved API credentials and verify intended endpoint coverage.
Adjust crawl authentication and excluded paths with application owners.

Explanation

Correct Answer

Active scanning must avoid destructive business-record side effects. Constrain DAST test-account creation.

Incorrect Answers

Dynamic testing must maintain valid session and form state to reach functionality. That is relevant to web scanning scope and safety, not to constrain DAST test-account creation.

Denied scanning traffic does not test the business logic behind protected routes. It could help improve API scanner coverage beyond 403, but it would not constrain DAST test-account creation.

Stateful apps need controlled scan paths to avoid destructive session effects. That is relevant to web scanning scope and safety, not to constrain DAST test-account creation.

Question 355

A cloud tenant has excessive identity privileges invisible to network service scanning. What is the MOST appropriate analyst action based on the evidence?

Validate effective runtime network configuration after deployment.
Reject the recommendation and optimize retention or filtering under monitoring requirements.
Review cloud IAM and control-plane posture with authorized configuration assessment.
Assess endpoint access controls and private connectivity independently of IAM privileges.

Explanation

Correct Answer

Network probes alone cannot enumerate cloud account policies and entitlements. Assess cloud permission posture.

Incorrect Answers

Secure images cannot compensate for permissive cloud network policy. It would verify deployment-time external exposure, but it would not assess cloud permission posture.

Cost controls should not erase mandatory audit visibility. It could help preserve cloud audit coverage during optimization, but it would not assess cloud permission posture.

Network reachability is a separate security boundary from database role grants. It would restrict public PaaS database access, but it would not assess cloud permission posture.

Question 356

A live web application passes code scans but exhibits session handling flaws only during execution. Which next step is MOST defensible for the security team?

Apply controlled fuzzing to explore boundary cases and collect crash evidence.
Use approved reverse engineering and debug analysis on isolated copies.
Run static application security testing against the relevant source and build artifacts.
Run authorized dynamic application security testing against a controlled environment.

Explanation

Correct Answer

DAST exercises deployed behavior and runtime controls. Detect runtime session flaw with DAST.

Incorrect Answers

Malformed input generation can reveal unanticipated input-handling defects. It could help use fuzzing to find parser crash, but it would not detect runtime session flaw with DAST.

Static binary inspection can reveal relevant implementation paths. That is relevant to static and dynamic application checks, not to detect runtime session flaw with DAST.

SAST can inspect code patterns before the application is running. It would choose SAST for predeployment code analysis, but it would not detect runtime session flaw with DAST.

Question 357

A PaaS database exposes a public endpoint while its service account is minimally privileged. Which action BEST aligns with sound security operations?

Assess endpoint access controls and private connectivity independently of IAM privileges.
Validate effective runtime network configuration after deployment.
Reject the recommendation and optimize retention or filtering under monitoring requirements.
Review cloud IAM and control-plane posture with authorized configuration assessment.

Explanation

Correct Answer

Network reachability is a separate security boundary from database role grants. Restrict public PaaS database access.

Incorrect Answers

Secure images cannot compensate for permissive cloud network policy. It would verify deployment-time external exposure, but it would not restrict public PaaS database access.

Cost controls should not erase mandatory audit visibility. It could help preserve cloud audit coverage during optimization, but it would not restrict public PaaS database access.

Network probes alone cannot enumerate cloud account policies and entitlements. That is relevant to cloud assessment approaches, not to restrict public PaaS database access.

Question 358

A scanner flags a previously patched CVE immediately after reboot on one node. Which response BEST addresses the security problem described?

Validate vendor advisory and package revision rather than treating the banner alone as vulnerable.
Verify installed package build, plugin currency and reboot state before closing or reopening.
Record the finding and evaluate reachable paths and compensating controls for priority.
Compare actual target inventory and successful scan coverage before asserting closure.

Explanation

Correct Answer

Stale signatures or incomplete activation can produce inconsistent patch observations. Validate post-patch vulnerability recurrence.

Incorrect Answers

Backported security fixes may not change visible upstream version strings. It would account for backported vendor fixes, but it would not validate post-patch vulnerability recurrence.

Vulnerability existence and exploitability in a deployment are separate judgments. That is relevant to patch validation scanning, not to validate post-patch vulnerability recurrence.

Coverage gaps can hide unverified machines behind impressive percentages. It would evaluate patch verification coverage, but it would not validate post-patch vulnerability recurrence.

Question 359

A vulnerability dashboard excludes containers that scale for less than five minutes. Which investigative or response action BEST fits the evidence?

Map backend pool members and scan each in authorized scope.
Record third-party service inventory and assess vendor assurances through agreed channels.
Integrate image assessment and orchestration inventory into the scanning workflow.
Expand authorized assessment to IPv6 address space and firewall policies.

Explanation

Correct Answer

Ephemeral containers can disappear before ordinary network scans reach them. Include ephemeral container assets.

Incorrect Answers

A shared virtual IP can hide different underlying versions. It could help enumerate behind load balancer, but it would not include ephemeral container assets.

Asset management extends to externally hosted dependencies, subject to contractual authority. That is relevant to asset discovery completeness, not to include ephemeral container assets.

IPv6-only exposure remains invisible to an IPv4-only scan. It could help include IPv6 in asset discovery, but it would not include ephemeral container assets.

Question 360

A hospital scheduling database cannot tolerate resource-heavy assessment during clinics. What is the MOST appropriate analyst action based on the evidence?

Test in representative staging and use less disruptive authenticated checks until an approved window.
Disable intrusive plugins until owner-authorized testing is approved and controlled.
Remove the unauthorized targets and obtain explicit scope approval first.
Agree on maintenance windows, throttling and rollback procedures with service owners.

Explanation

Correct Answer

Vulnerability assessment should not jeopardize patient service availability. Schedule safe clinical system assessment.

Incorrect Answers

Risk-based scheduling balances visibility with operational change restrictions. That is relevant to scan planning and availability, not to schedule safe clinical system assessment.

Exploit validation can alter state or disrupt regulated workloads. It would gate intrusive scan plugins, but it would not schedule safe clinical system assessment.

Scanner authorization is mandatory even for defensive testing. It could help stop out-of-scope vulnerability scans, but it would not schedule safe clinical system assessment.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 34 - 10 Questions (Last Reviewed 12-Oct-2026)
CompTIA CS0-003 Practice Test 35 - 10 Questions (Last Reviewed 11-Oct-2026)
CompTIA CS0-003 Practice Test 36 - 10 Questions (Last Reviewed 10-Oct-2026)
CompTIA CS0-003 Practice Test 37 - 10 Questions (Last Reviewed 09-Oct-2026)
CompTIA CS0-003 Practice Test 38 - 10 Questions (Last Reviewed 08-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 350

Explanation

Correct Answer

Incorrect Answers

Question 351

Explanation

Correct Answer

Incorrect Answers

Question 352

Explanation

Correct Answer

Incorrect Answers

Question 353

Explanation

Correct Answer

Incorrect Answers

Question 354

Explanation

Correct Answer

Incorrect Answers

Question 355

Explanation

Correct Answer

Incorrect Answers

Question 356

Explanation

Correct Answer

Incorrect Answers

Question 357

Explanation

Correct Answer

Incorrect Answers

Question 358

Explanation

Correct Answer

Incorrect Answers

Question 359

Explanation

Correct Answer

Incorrect Answers

Question 360

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests