CompTIA CS0-003 Practice Test 39

Question 380

A test scanner sees 403 errors from an API and reports all endpoints as secure. What is the MOST appropriate analyst action based on the evidence?

Limit payload creation and use dedicated sandbox accounts or staging where equivalent.
Adjust crawl authentication and excluded paths with application owners.
Configure stateful token handling and retest representative workflows.
Authenticate with approved API credentials and verify intended endpoint coverage.

Explanation

Correct Answer

Denied scanning traffic does not test the business logic behind protected routes. Improve API scanner coverage beyond 403.

Incorrect Answers

Active scanning must avoid destructive business-record side effects. It could help constrain DAST test-account creation, but it would not improve API scanner coverage beyond 403.

Stateful apps need controlled scan paths to avoid destructive session effects. That is relevant to web scanning scope and safety, not to improve API scanner coverage beyond 403.

Dynamic testing must maintain valid session and form state to reach functionality. It would account for anti-CSRF token in DAST, but it would not improve API scanner coverage beyond 403.

Question 381

A hypervisor management service is excluded from guest scans because it sits outside guest OS. Which next step is MOST defensible for the security team?

Include the authorized hypervisor control plane in the scope and assess it separately.
Regenerate unique agent identities and reconcile duplicate asset records.
Move credentials to approved encrypted vault integration with rotation.
Scan deployed instances and review bootstrap configuration, not just base images.

Explanation

Correct Answer

Virtualization host security is not covered by scanning guests alone. Include hypervisor management plane in scanning.

Incorrect Answers

Shared agent IDs collapse or duplicate evidence across distinct machines. It would correct cloned VM scanner identity collision, but it would not include hypervisor management plane in scanning.

Assessment credentials themselves require protection and controlled access. It could help secure stored scan credentials, but it would not include hypervisor management plane in scanning.

Post-boot automation can reintroduce vulnerabilities. That is relevant to virtual assets and scanning credentials, not to include hypervisor management plane in scanning.

Question 382

An internal-only database exposes management ports but the perimeter scan lists none. Which action BEST aligns with sound security operations?

Document scan vantage and intermediary certificates before comparing vulnerability findings.
Perform approved inside-segment assessment and correct inappropriate trust exposure.
Include sanctioned external DNS and virtual-host context in the assessment scope.
Validate from an authorized external partner vantage, then narrow source controls.

Explanation

Correct Answer

External results do not measure lateral movement opportunities inside the network. Reveal internally exposed admin service.

Incorrect Answers

Middleboxes can modify observed service and certificate characteristics. It would reconcile scan findings across proxies, but it would not reveal internally exposed admin service.

Host-header routing changes which application attack surface is tested. That is relevant to internal and external scan differences, not to reveal internally exposed admin service.

Cloud reachability depends on network policy and source address. It would assess partner-reachable SSH exposure, but it would not reveal internally exposed admin service.

Question 383

A vendor refuses credentials for a proprietary embedded appliance. Which response BEST addresses the security problem described?

Use the approved jump path rather than bypassing segmentation controls.
Identify asset owner and criticality before scheduling intrusive tests.
Document assessment limits and rely on vendor advisories and authorized observable checks.
Pause noncritical scans under incident-change coordination and record coverage exceptions.

Explanation

Correct Answer

Lack of credentials limits assurance and cannot be disguised as a full assessment. Handle proprietary appliance scan limitation.

Incorrect Answers

Assessment access must follow established security boundaries. It could help scan isolated zone through approved gateway, but it would not handle proprietary appliance scan limitation.

Risk and maintenance approval depend on service responsibility. That is relevant to scanning priority and dependencies, not to handle proprietary appliance scan limitation.

Response operations may take precedence over routine scheduled assessment. It could help suspend scanning during active emergency, but it would not handle proprietary appliance scan limitation.

Question 384

A passive network sensor reports an old printer firmware string observed months ago. Which investigative or response action BEST fits the evidence?

Throttle scan concurrency and schedule a scoped assessment with network owners.
Arrange approved active discovery within a bounded maintenance window.
Rely on passive traffic observation and vendor-approved OT discovery methods.
Verify asset presence and firmware through approved current inventory before prioritizing.

Explanation

Correct Answer

Passive observations can become stale when devices are replaced or upgraded. Validate stale passive fingerprint.

Incorrect Answers

Scan-rate limits prevent assessment traffic from exhausting constrained links. That is relevant to passive network versus active discovery, not to validate stale passive fingerprint.

Passive discovery cannot identify silent assets absent observed network transmissions. It would discover quiet hosts when passive fails, but it would not validate stale passive fingerprint.

Legacy controllers may not tolerate ordinary active scan traffic. It could help scan fragile industrial systems safely, but it would not validate stale passive fingerprint.

Question 385

A public-facing API is reachable from the internet but protected host inventory is unavailable to scanners. What is the MOST appropriate analyst action based on the evidence?

Use authorized external unauthenticated assessment to establish visible attack surface.
Perform a credentialed operating-system scan using approved read-only credentials.
Report incomplete scan coverage and repair account permissions before interpreting the result.
Restrict scanning credentials to the minimal read and query permissions.

Explanation

Correct Answer

An external vantage reveals exposure but cannot replace internal configuration assessment. Assess internet-facing view without host credentials.

Incorrect Answers

Local package inventory reveals vulnerabilities invisible from unauthenticated port probes. It could help find missing OS patches with authenticated scanning, but it would not assess internet-facing view without host credentials.

Missing authenticated checks create false assurance when results are incomplete. That is relevant to credentialed versus unauthenticated scans, not to assess internet-facing view without host credentials.

Credentialed assessment need not grant broad administrative write authority. It would reduce scanner credential privilege, but it would not assess internet-facing view without host credentials.

Question 386

An active vulnerability scan saturates a metered satellite link and disrupts operations. Which next step is MOST defensible for the security team?

Rely on passive traffic observation and vendor-approved OT discovery methods.
Throttle scan concurrency and schedule a scoped assessment with network owners.
Verify asset presence and firmware through approved current inventory before prioritizing.
Arrange approved active discovery within a bounded maintenance window.

Explanation

Correct Answer

Scan-rate limits prevent assessment traffic from exhausting constrained links. Adjust scan rate for constrained network.

Incorrect Answers

Legacy controllers may not tolerate ordinary active scan traffic. It could help scan fragile industrial systems safely, but it would not adjust scan rate for constrained network.

Passive observations can become stale when devices are replaced or upgraded. It would validate stale passive fingerprint, but it would not adjust scan rate for constrained network.

Passive discovery cannot identify silent assets absent observed network transmissions. It could help discover quiet hosts when passive fails, but it would not adjust scan rate for constrained network.

Question 387

A seasonal retail platform has a freeze that blocks intrusive production scans. Which action BEST aligns with sound security operations?

Remove the unauthorized targets and obtain explicit scope approval first.
Disable intrusive plugins until owner-authorized testing is approved and controlled.
Test in representative staging and use less disruptive authenticated checks until an approved window.
Agree on maintenance windows, throttling and rollback procedures with service owners.

Explanation

Correct Answer

Risk-based scheduling balances visibility with operational change restrictions. Assess during retail production freeze.

Incorrect Answers

Scanner authorization is mandatory even for defensive testing. That is relevant to scan planning and availability, not to assess during retail production freeze.

Exploit validation can alter state or disrupt regulated workloads. It would gate intrusive scan plugins, but it would not assess during retail production freeze.

Vulnerability assessment should not jeopardize patient service availability. That is relevant to scan planning and availability, not to assess during retail production freeze.

Question 388

A global scan begins during a major incident and saturates analyst resources. Which response BEST addresses the security problem described?

Identify asset owner and criticality before scheduling intrusive tests.
Use the approved jump path rather than bypassing segmentation controls.
Document assessment limits and rely on vendor advisories and authorized observable checks.
Pause noncritical scans under incident-change coordination and record coverage exceptions.

Explanation

Correct Answer

Response operations may take precedence over routine scheduled assessment. Suspend scanning during active emergency.

Incorrect Answers

Risk and maintenance approval depend on service responsibility. It would attribute newly discovered scan target, but it would not suspend scanning during active emergency.

Assessment access must follow established security boundaries. It could help scan isolated zone through approved gateway, but it would not suspend scanning during active emergency.

Lack of credentials limits assurance and cannot be disguised as a full assessment. That is relevant to scanning priority and dependencies, not to suspend scanning during active emergency.

Question 389

Remote laptops rarely connect to corporate VPN and miss network scans. Which investigative or response action BEST fits the evidence?

Deploy approved endpoint agents that report over sanctioned cloud management channels.
Supplement agent findings with authorized dynamic application testing.
Reconcile agent identity and disposal evidence in authoritative asset inventory.
Tune agent scheduling and resource usage with kiosk owners.

Explanation

Correct Answer

Agents can assess roaming endpoints without requiring internal network reachability. Cover remote roaming assets with agents.

Incorrect Answers

Host package inspection does not cover every application-layer vulnerability. That is relevant to agent-based scanning design, not to cover remote roaming assets with agents.

Old agent records can falsely inflate active exposure. It would remove stale decommissioned scan agent, but it would not cover remote roaming assets with agents.

Endpoint assessment must consider business performance impact. It could help reduce agent scanner operational disruption, but it would not cover remote roaming assets with agents.

Question 390

A credentialed scan returns access denied on registry checks but marks the host clean. What is the MOST appropriate analyst action based on the evidence?

Perform a credentialed operating-system scan using approved read-only credentials.
Report incomplete scan coverage and repair account permissions before interpreting the result.
Restrict scanning credentials to the minimal read and query permissions.
Use authorized external unauthenticated assessment to establish visible attack surface.

Explanation

Correct Answer

Missing authenticated checks create false assurance when results are incomplete. Identify partial credentialed scan falsely clean.

Incorrect Answers

Local package inventory reveals vulnerabilities invisible from unauthenticated port probes. That is relevant to credentialed versus unauthenticated scans, not to identify partial credentialed scan falsely clean.

Credentialed assessment need not grant broad administrative write authority. It could help reduce scanner credential privilege, but it would not identify partial credentialed scan falsely clean.

An external vantage reveals exposure but cannot replace internal configuration assessment. That is relevant to credentialed versus unauthenticated scans, not to identify partial credentialed scan falsely clean.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 37 - 10 Questions (Last Reviewed 09-Oct-2026)
CompTIA CS0-003 Practice Test 38 - 10 Questions (Last Reviewed 08-Oct-2026)
CompTIA CS0-003 Practice Test 39 - 10 Questions (Last Reviewed 07-Oct-2026)
CompTIA CS0-003 Practice Test 40 - 10 Questions (Last Reviewed 06-Oct-2026)
CompTIA CS0-003 Practice Test 41 - 10 Questions (Last Reviewed 05-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 380

Explanation

Correct Answer

Incorrect Answers

Question 381

Explanation

Correct Answer

Incorrect Answers

Question 382

Explanation

Correct Answer

Incorrect Answers

Question 383

Explanation

Correct Answer

Incorrect Answers

Question 384

Explanation

Correct Answer

Incorrect Answers

Question 385

Explanation

Correct Answer

Incorrect Answers

Question 386

Explanation

Correct Answer

Incorrect Answers

Question 387

Explanation

Correct Answer

Incorrect Answers

Question 388

Explanation

Correct Answer

Incorrect Answers

Question 389

Explanation

Correct Answer

Incorrect Answers

Question 390

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests