CompTIA CS0-003 Practice Test 37

Question 360

A hospital scheduling database cannot tolerate resource-heavy assessment during clinics. What is the MOST appropriate analyst action based on the evidence?

Test in representative staging and use less disruptive authenticated checks until an approved window.
Disable intrusive plugins until owner-authorized testing is approved and controlled.
Remove the unauthorized targets and obtain explicit scope approval first.
Agree on maintenance windows, throttling and rollback procedures with service owners.

Explanation

Correct Answer

Vulnerability assessment should not jeopardize patient service availability. Schedule safe clinical system assessment.

Incorrect Answers

Risk-based scheduling balances visibility with operational change restrictions. That is relevant to scan planning and availability, not to schedule safe clinical system assessment.

Exploit validation can alter state or disrupt regulated workloads. It would gate intrusive scan plugins, but it would not schedule safe clinical system assessment.

Scanner authorization is mandatory even for defensive testing. It could help stop out-of-scope vulnerability scans, but it would not schedule safe clinical system assessment.

Question 361

An audit requires proof that Windows server configurations meet a published baseline. Which next step is MOST defensible for the security team?

Run credentialed benchmark configuration checks and document deviations.
Record the compensating control and revalidation schedule with the exception.
Obtain the required authorized external scan evidence for the cardholder-data environment.
Separate policy or configuration exposure from software-specific CVE identification.

Explanation

Correct Answer

Compliance baseline assessment evaluates settings beyond CVE presence. Assess configuration against hardening benchmark.

Incorrect Answers

Governed baseline exceptions require documented risk acceptance and periodic review. It could help manage approved CIS benchmark exception, but it would not assess configuration against hardening benchmark.

External and internal PCI scanning obligations are distinct. That is relevant to industry hardening benchmarks, not to assess configuration against hardening benchmark.

A weak setting is not automatically evidence of a particular software vulnerability. It would classify baseline misconfiguration versus CVE, but it would not assess configuration against hardening benchmark.

Question 362

A scan completes with 100% task status but only half of the intended targets responded. Which action BEST aligns with sound security operations?

Reconcile address leases, MAC observations and owner records before deciding it is one device.
Report reachable-target coverage and retry authorized unreachable groups through approved paths.
Restore authorized management reachability and repeat the incomplete checks.
Consolidate approved scan windows and communicate operational change impact.

Explanation

Correct Answer

Job completion does not establish exhaustive asset assessment. Distinguish scan job completion from coverage.

Incorrect Answers

IP reuse and sensor vantage can produce ambiguous asset identities. It could help resolve ambiguous discovered device identity, but it would not distinguish scan job completion from coverage.

Scanning a blocked service cannot validate the underlying configuration. It would remediate blocked credentialed scan coverage, but it would not distinguish scan job completion from coverage.

Duplicated intrusive assessments create avoidable load and business interruption risk. It could help eliminate uncoordinated overlapping scans, but it would not distinguish scan job completion from coverage.

Question 363

A scanning agent duplicates host findings after VMs are cloned with identical agent identifiers. Which response BEST addresses the security problem described?

Scan deployed instances and review bootstrap configuration, not just base images.
Move credentials to approved encrypted vault integration with rotation.
Regenerate unique agent identities and reconcile duplicate asset records.
Include the authorized hypervisor control plane in the scope and assess it separately.

Explanation

Correct Answer

Shared agent IDs collapse or duplicate evidence across distinct machines. Correct cloned VM scanner identity collision.

Incorrect Answers

Post-boot automation can reintroduce vulnerabilities. That is relevant to virtual assets and scanning credentials, not to correct cloned VM scanner identity collision.

Assessment credentials themselves require protection and controlled access. It would secure stored scan credentials, but it would not correct cloned VM scanner identity collision.

Virtualization host security is not covered by scanning guests alone. That is relevant to virtual assets and scanning credentials, not to correct cloned VM scanner identity collision.

Question 364

A PCI audit asks for external vulnerability scans but the team only supplies internal results. Which investigative or response action BEST fits the evidence?

Separate policy or configuration exposure from software-specific CVE identification.
Run credentialed benchmark configuration checks and document deviations.
Record the compensating control and revalidation schedule with the exception.
Obtain the required authorized external scan evidence for the cardholder-data environment.

Explanation

Correct Answer

External and internal PCI scanning obligations are distinct. Satisfy required PCI external scan evidence.

Incorrect Answers

A weak setting is not automatically evidence of a particular software vulnerability. It would classify baseline misconfiguration versus CVE, but it would not satisfy required PCI external scan evidence.

Compliance baseline assessment evaluates settings beyond CVE presence. It could help assess configuration against hardening benchmark, but it would not satisfy required PCI external scan evidence.

Governed baseline exceptions require documented risk acceptance and periodic review. That is relevant to industry hardening benchmarks, not to satisfy required PCI external scan evidence.

Question 365

An unauthenticated scan reports no missing packages on a Linux server with an obsolete kernel. What is the MOST appropriate analyst action based on the evidence?

Perform a credentialed operating-system scan using approved read-only credentials.
Report incomplete scan coverage and repair account permissions before interpreting the result.
Restrict scanning credentials to the minimal read and query permissions.
Use authorized external unauthenticated assessment to establish visible attack surface.

Explanation

Correct Answer

Local package inventory reveals vulnerabilities invisible from unauthenticated port probes. Find missing OS patches with authenticated scanning.

Incorrect Answers

Missing authenticated checks create false assurance when results are incomplete. That is relevant to credentialed versus unauthenticated scans, not to find missing OS patches with authenticated scanning.

Credentialed assessment need not grant broad administrative write authority. It would reduce scanner credential privilege, but it would not find missing OS patches with authenticated scanning.

An external vantage reveals exposure but cannot replace internal configuration assessment. It could help assess internet-facing view without host credentials, but it would not find missing OS patches with authenticated scanning.

Question 366

A scanner account can modify server configurations although only assessment is authorized. Which next step is MOST defensible for the security team?

Report incomplete scan coverage and repair account permissions before interpreting the result.
Restrict scanning credentials to the minimal read and query permissions.
Use authorized external unauthenticated assessment to establish visible attack surface.
Perform a credentialed operating-system scan using approved read-only credentials.

Explanation

Correct Answer

Credentialed assessment need not grant broad administrative write authority. Reduce scanner credential privilege.

Incorrect Answers

Missing authenticated checks create false assurance when results are incomplete. That is relevant to credentialed versus unauthenticated scans, not to reduce scanner credential privilege.

Local package inventory reveals vulnerabilities invisible from unauthenticated port probes. That is relevant to credentialed versus unauthenticated scans, not to reduce scanner credential privilege.

Question 367

A fix deploys across a fleet but scanner reports 80% completion without coverage metadata. Which action BEST aligns with sound security operations?

Validate vendor advisory and package revision rather than treating the banner alone as vulnerable.
Record the finding and evaluate reachable paths and compensating controls for priority.
Compare actual target inventory and successful scan coverage before asserting closure.
Verify installed package build, plugin currency and reboot state before closing or reopening.

Explanation

Correct Answer

Coverage gaps can hide unverified machines behind impressive percentages. Evaluate patch verification coverage.

Incorrect Answers

Backported security fixes may not change visible upstream version strings. It would account for backported vendor fixes, but it would not evaluate patch verification coverage.

Vulnerability existence and exploitability in a deployment are separate judgments. It could help assess reachable exposure for verified CVE, but it would not evaluate patch verification coverage.

Stale signatures or incomplete activation can produce inconsistent patch observations. It would validate post-patch vulnerability recurrence, but it would not evaluate patch verification coverage.

Question 368

A segmented plant zone only allows a brokered scanner via a monitored jump point. Which response BEST addresses the security problem described?

Pause noncritical scans under incident-change coordination and record coverage exceptions.
Identify asset owner and criticality before scheduling intrusive tests.
Document assessment limits and rely on vendor advisories and authorized observable checks.
Use the approved jump path rather than bypassing segmentation controls.

Explanation

Correct Answer

Assessment access must follow established security boundaries. Scan isolated zone through approved gateway.

Incorrect Answers

Response operations may take precedence over routine scheduled assessment. It could help suspend scanning during active emergency, but it would not scan isolated zone through approved gateway.

Risk and maintenance approval depend on service responsibility. That is relevant to scanning priority and dependencies, not to scan isolated zone through approved gateway.

Lack of credentials limits assurance and cannot be disguised as a full assessment. It would handle proprietary appliance scan limitation, but it would not scan isolated zone through approved gateway.

Question 369

A network appliance fix uses a backported patch but retains the old upstream version number. Which investigative or response action BEST fits the evidence?

Validate vendor advisory and package revision rather than treating the banner alone as vulnerable.
Compare actual target inventory and successful scan coverage before asserting closure.
Record the finding and evaluate reachable paths and compensating controls for priority.
Verify installed package build, plugin currency and reboot state before closing or reopening.

Explanation

Correct Answer

Backported security fixes may not change visible upstream version strings. Account for backported vendor fixes.

Incorrect Answers

Coverage gaps can hide unverified machines behind impressive percentages. It would evaluate patch verification coverage, but it would not account for backported vendor fixes.

Vulnerability existence and exploitability in a deployment are separate judgments. It could help assess reachable exposure for verified CVE, but it would not account for backported vendor fixes.

Stale signatures or incomplete activation can produce inconsistent patch observations. That is relevant to patch validation scanning, not to account for backported vendor fixes.

Question 370

A scan plan includes systems owned by another organization without permission. What is the MOST appropriate analyst action based on the evidence?

Disable intrusive plugins until owner-authorized testing is approved and controlled.
Remove the unauthorized targets and obtain explicit scope approval first.
Test in representative staging and use less disruptive authenticated checks until an approved window.
Agree on maintenance windows, throttling and rollback procedures with service owners.

Explanation

Correct Answer

Scanner authorization is mandatory even for defensive testing. Stop out-of-scope vulnerability scans.

Incorrect Answers

Exploit validation can alter state or disrupt regulated workloads. It would gate intrusive scan plugins, but it would not stop out-of-scope vulnerability scans.

Risk-based scheduling balances visibility with operational change restrictions. That is relevant to scan planning and availability, not to stop out-of-scope vulnerability scans.

Vulnerability assessment should not jeopardize patient service availability. It would schedule safe clinical system assessment, but it would not stop out-of-scope vulnerability scans.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 35 - 10 Questions (Last Reviewed 11-Oct-2026)
CompTIA CS0-003 Practice Test 36 - 10 Questions (Last Reviewed 10-Oct-2026)
CompTIA CS0-003 Practice Test 37 - 10 Questions (Last Reviewed 09-Oct-2026)
CompTIA CS0-003 Practice Test 38 - 10 Questions (Last Reviewed 08-Oct-2026)
CompTIA CS0-003 Practice Test 39 - 10 Questions (Last Reviewed 07-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 360

Explanation

Correct Answer

Incorrect Answers

Question 361

Explanation

Correct Answer

Incorrect Answers

Question 362

Explanation

Correct Answer

Incorrect Answers

Question 363

Explanation

Correct Answer

Incorrect Answers

Question 364

Explanation

Correct Answer

Incorrect Answers

Question 365

Explanation

Correct Answer

Incorrect Answers

Question 366

Explanation

Correct Answer

Incorrect Answers

Question 367

Explanation

Correct Answer

Incorrect Answers

Question 368

Explanation

Correct Answer

Incorrect Answers

Question 369

Explanation

Correct Answer

Incorrect Answers

Question 370

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests