CompTIA CS0-003 Practice Test 38

Question 370

A scan plan includes systems owned by another organization without permission. What is the MOST appropriate analyst action based on the evidence?

Disable intrusive plugins until owner-authorized testing is approved and controlled.
Remove the unauthorized targets and obtain explicit scope approval first.
Test in representative staging and use less disruptive authenticated checks until an approved window.
Agree on maintenance windows, throttling and rollback procedures with service owners.

Explanation

Correct Answer

Scanner authorization is mandatory even for defensive testing. Stop out-of-scope vulnerability scans.

Incorrect Answers

Exploit validation can alter state or disrupt regulated workloads. It would gate intrusive scan plugins, but it would not stop out-of-scope vulnerability scans.

Risk-based scheduling balances visibility with operational change restrictions. That is relevant to scan planning and availability, not to stop out-of-scope vulnerability scans.

Vulnerability assessment should not jeopardize patient service availability. It would schedule safe clinical system assessment, but it would not stop out-of-scope vulnerability scans.

Question 371

An employee suggests scanning a partner's public network because it may affect enterprise customers. Which next step is MOST defensible for the security team?

Update the scanning scope and required reporting obligations with governance approval.
Resolve stable asset identifiers and IP ownership before launching probes.
Seek written permission or use contractually available security assurance evidence.
Disable state-changing tests until safe authorization and data-reset conditions exist.

Explanation

Correct Answer

Defensive intent does not authorize probing another organization's systems. Obtain third-party scan authorization.

Incorrect Answers

Scan coverage must reflect current regulated system boundaries. It could help incorporate newly scoped regulated subnet, but it would not obtain third-party scan authorization.

Name ambiguity can result in probing unintended critical systems. That is relevant to scope drift and legal constraints, not to obtain third-party scan authorization.

API security testing can delete real records when methods are misused. It could help avoid destructive API fuzzing, but it would not obtain third-party scan authorization.

Question 372

A scan proves a service version is vulnerable but no exploit path is exposed to users. Which action BEST aligns with sound security operations?

Compare actual target inventory and successful scan coverage before asserting closure.
Validate vendor advisory and package revision rather than treating the banner alone as vulnerable.
Verify installed package build, plugin currency and reboot state before closing or reopening.
Record the finding and evaluate reachable paths and compensating controls for priority.

Explanation

Correct Answer

Vulnerability existence and exploitability in a deployment are separate judgments. Assess reachable exposure for verified CVE.

Incorrect Answers

Coverage gaps can hide unverified machines behind impressive percentages. That is relevant to patch validation scanning, not to assess reachable exposure for verified CVE.

Backported security fixes may not change visible upstream version strings. It would account for backported vendor fixes, but it would not assess reachable exposure for verified CVE.

Stale signatures or incomplete activation can produce inconsistent patch observations. It could help validate post-patch vulnerability recurrence, but it would not assess reachable exposure for verified CVE.

Question 373

A new scanning agent causes CPU spikes on low-power kiosks during trading hours. Which response BEST addresses the security problem described?

Tune agent scheduling and resource usage with kiosk owners.
Deploy approved endpoint agents that report over sanctioned cloud management channels.
Supplement agent findings with authorized dynamic application testing.
Reconcile agent identity and disposal evidence in authoritative asset inventory.

Explanation

Correct Answer

Endpoint assessment must consider business performance impact. Reduce agent scanner operational disruption.

Incorrect Answers

Agents can assess roaming endpoints without requiring internal network reachability. It could help cover remote roaming assets with agents, but it would not reduce agent scanner operational disruption.

Host package inspection does not cover every application-layer vulnerability. That is relevant to agent-based scanning design, not to reduce agent scanner operational disruption.

Old agent records can falsely inflate active exposure. It would remove stale decommissioned scan agent, but it would not reduce agent scanner operational disruption.

Question 374

A scan result differs across locations because one site uses TLS interception. Which investigative or response action BEST fits the evidence?

Validate from an authorized external partner vantage, then narrow source controls.
Document scan vantage and intermediary certificates before comparing vulnerability findings.
Perform approved inside-segment assessment and correct inappropriate trust exposure.
Include sanctioned external DNS and virtual-host context in the assessment scope.

Explanation

Correct Answer

Middleboxes can modify observed service and certificate characteristics. Reconcile scan findings across proxies.

Incorrect Answers

Cloud reachability depends on network policy and source address. It could help assess partner-reachable SSH exposure, but it would not reconcile scan findings across proxies.

External results do not measure lateral movement opportunities inside the network. It would reveal internally exposed admin service, but it would not reconcile scan findings across proxies.

Host-header routing changes which application attack surface is tested. It could help test public virtual-host exposure, but it would not reconcile scan findings across proxies.

Question 375

A credentialed scanner saves administrator passwords in plaintext job parameters. What is the MOST appropriate analyst action based on the evidence?

Regenerate unique agent identities and reconcile duplicate asset records.
Include the authorized hypervisor control plane in the scope and assess it separately.
Move credentials to approved encrypted vault integration with rotation.
Scan deployed instances and review bootstrap configuration, not just base images.

Explanation

Correct Answer

Assessment credentials themselves require protection and controlled access. Secure stored scan credentials.

Incorrect Answers

Shared agent IDs collapse or duplicate evidence across distinct machines. That is relevant to virtual assets and scanning credentials, not to secure stored scan credentials.

Virtualization host security is not covered by scanning guests alone. It would include hypervisor management plane in scanning, but it would not secure stored scan credentials.

Post-boot automation can reintroduce vulnerabilities. That is relevant to virtual assets and scanning credentials, not to secure stored scan credentials.

Question 376

A new asset appears on a network but its business owner is not known. Which next step is MOST defensible for the security team?

Document assessment limits and rely on vendor advisories and authorized observable checks.
Use the approved jump path rather than bypassing segmentation controls.
Pause noncritical scans under incident-change coordination and record coverage exceptions.
Identify asset owner and criticality before scheduling intrusive tests.

Explanation

Correct Answer

Risk and maintenance approval depend on service responsibility. Attribute newly discovered scan target.

Incorrect Answers

Lack of credentials limits assurance and cannot be disguised as a full assessment. It would handle proprietary appliance scan limitation, but it would not attribute newly discovered scan target.

Assessment access must follow established security boundaries. It could help scan isolated zone through approved gateway, but it would not attribute newly discovered scan target.

Response operations may take precedence over routine scheduled assessment. That is relevant to scanning priority and dependencies, not to attribute newly discovered scan target.

Question 377

A parser crashes on unexpected structured inputs but has no known CVE. Which action BEST aligns with sound security operations?

Apply controlled fuzzing to explore boundary cases and collect crash evidence.
Use approved reverse engineering and debug analysis on isolated copies.
Run static application security testing against the relevant source and build artifacts.
Run authorized dynamic application security testing against a controlled environment.

Explanation

Correct Answer

Malformed input generation can reveal unanticipated input-handling defects. Use fuzzing to find parser crash.

Incorrect Answers

Static binary inspection can reveal relevant implementation paths. That is relevant to static and dynamic application checks, not to use fuzzing to find parser crash.

SAST can inspect code patterns before the application is running. It would choose SAST for predeployment code analysis, but it would not use fuzzing to find parser crash.

DAST exercises deployed behavior and runtime controls. It could help detect runtime session flaw with DAST, but it would not use fuzzing to find parser crash.

Question 378

A cloud security tool suggests disabling all logging to save cost. Which response BEST addresses the security problem described?

Validate effective runtime network configuration after deployment.
Reject the recommendation and optimize retention or filtering under monitoring requirements.
Review cloud IAM and control-plane posture with authorized configuration assessment.
Assess endpoint access controls and private connectivity independently of IAM privileges.

Explanation

Correct Answer

Cost controls should not erase mandatory audit visibility. Preserve cloud audit coverage during optimization.

Incorrect Answers

Secure images cannot compensate for permissive cloud network policy. That is relevant to cloud assessment approaches, not to preserve cloud audit coverage during optimization.

Network probes alone cannot enumerate cloud account policies and entitlements. It could help assess cloud permission posture, but it would not preserve cloud audit coverage during optimization.

Network reachability is a separate security boundary from database role grants. That is relevant to cloud assessment approaches, not to preserve cloud audit coverage during optimization.

Question 379

A configuration tool classifies an open administrative port as a CVE without version evidence. Which investigative or response action BEST fits the evidence?

Record the compensating control and revalidation schedule with the exception.
Run credentialed benchmark configuration checks and document deviations.
Separate policy or configuration exposure from software-specific CVE identification.
Obtain the required authorized external scan evidence for the cardholder-data environment.

Explanation

Correct Answer

A weak setting is not automatically evidence of a particular software vulnerability. Classify baseline misconfiguration versus CVE.

Incorrect Answers

Governed baseline exceptions require documented risk acceptance and periodic review. It would manage approved CIS benchmark exception, but it would not classify baseline misconfiguration versus CVE.

Compliance baseline assessment evaluates settings beyond CVE presence. It could help assess configuration against hardening benchmark, but it would not classify baseline misconfiguration versus CVE.

External and internal PCI scanning obligations are distinct. It would satisfy required PCI external scan evidence, but it would not classify baseline misconfiguration versus CVE.

Question 380

A test scanner sees 403 errors from an API and reports all endpoints as secure. What is the MOST appropriate analyst action based on the evidence?

Limit payload creation and use dedicated sandbox accounts or staging where equivalent.
Adjust crawl authentication and excluded paths with application owners.
Configure stateful token handling and retest representative workflows.
Authenticate with approved API credentials and verify intended endpoint coverage.

Explanation

Correct Answer

Denied scanning traffic does not test the business logic behind protected routes. Improve API scanner coverage beyond 403.

Incorrect Answers

Active scanning must avoid destructive business-record side effects. It could help constrain DAST test-account creation, but it would not improve API scanner coverage beyond 403.

Stateful apps need controlled scan paths to avoid destructive session effects. That is relevant to web scanning scope and safety, not to improve API scanner coverage beyond 403.

Dynamic testing must maintain valid session and form state to reach functionality. It would account for anti-CSRF token in DAST, but it would not improve API scanner coverage beyond 403.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 36 - 10 Questions (Last Reviewed 10-Oct-2026)
CompTIA CS0-003 Practice Test 37 - 10 Questions (Last Reviewed 09-Oct-2026)
CompTIA CS0-003 Practice Test 38 - 10 Questions (Last Reviewed 08-Oct-2026)
CompTIA CS0-003 Practice Test 39 - 10 Questions (Last Reviewed 07-Oct-2026)
CompTIA CS0-003 Practice Test 40 - 10 Questions (Last Reviewed 06-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 370

Explanation

Correct Answer

Incorrect Answers

Question 371

Explanation

Correct Answer

Incorrect Answers

Question 372

Explanation

Correct Answer

Incorrect Answers

Question 373

Explanation

Correct Answer

Incorrect Answers

Question 374

Explanation

Correct Answer

Incorrect Answers

Question 375

Explanation

Correct Answer

Incorrect Answers

Question 376

Explanation

Correct Answer

Incorrect Answers

Question 377

Explanation

Correct Answer

Incorrect Answers

Question 378

Explanation

Correct Answer

Incorrect Answers

Question 379

Explanation

Correct Answer

Incorrect Answers

Question 380

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests