CompTIA CS0-003 Practice Test 4

Question 30

Two collectors ingest the same syslog stream, doubling alert volume. What is the MOST appropriate analyst action based on the evidence?

Restore buffered collection where available and label the evidence gap explicitly.
Deduplicate on source event identifiers before correlation.
Use authenticated encrypted log transport and protected receiver access.
Fix and test parsing of the destination field using representative source events.

Explanation

Correct Answer

Duplicate ingestion inflates counts and obscures actual incident scope. Remove duplicate SIEM events.

Incorrect Answers

Gaps must be recognized instead of inventing a complete timeline. That is relevant to log ingestion integrity, not to remove duplicate SIEM events.

Integrity and confidentiality prevent interception or tampering in transit. It could help secure telemetry transport, but it would not remove duplicate SIEM events.

A parser losing essential fields breaks downstream detection conditions. That is relevant to log ingestion integrity, not to remove duplicate SIEM events.

Question 31

A virtual machine image is hardened but individual guest instances drift after deployment. Which next step is MOST defensible for the security team?

Enable function execution and cloud control-plane logging with a protected central sink.
Map workload and account identifiers during central SIEM normalization.
Apply configuration monitoring inside each guest and compare against the approved baseline.
Forward container stdout and security events outside the ephemeral container filesystem.

Explanation

Correct Answer

Hypervisor hardening alone does not ensure guest operating-system integrity. Detect drift within virtualized guests.

Incorrect Answers

Ephemeral workloads need centrally retained logs beyond their short lifetime. It would observe short-lived serverless actions, but it would not detect drift within virtualized guests.

Entity enrichment allows cross-environment activity to be correlated. It could help link identities across cloud and data center, but it would not detect drift within virtualized guests.

External log persistence preserves evidence when containers are replaced. It would preserve container telemetry across redeployments, but it would not detect drift within virtualized guests.

Question 32

A federated partner login suddenly maps several distinct users to a single subject ID. Which action BEST aligns with sound security operations?

Revoke application tokens and assess any actions after the deprovision timestamp.
Join SID mappings to identity inventory and preserve mapping timestamps.
Check device-compliance and conditional-access decisions before resetting credentials.
Investigate assertion mapping and reject nonunique identities until corrected.

Explanation

Correct Answer

Identity collisions undermine attribution and can cross authorization boundaries. Correct SAML subject mapping collision.

Incorrect Answers

Disabling interactive sign-in may not cancel prior API credentials. It could help remediate stale application tokens, but it would not correct SAML subject mapping collision.

Identity enrichment makes cross-system activity attributable without conflating users. That is relevant to alert identity enrichment and authentication gaps, not to correct SAML subject mapping collision.

Authorization can fail on device posture after successful authentication. It would distinguish posture denial from bad password, but it would not correct SAML subject mapping collision.

Question 33

An engineering workstation directly reaches a safety-control VLAN from office Wi-Fi. Which response BEST addresses the security problem described?

Enforce approved jump-host access and isolate the safety network from office clients.
Switch to passive traffic discovery and schedule any authenticated checks with OT owners.
Route privileged maintenance through approved monitored remote access with time-bound grants.
Establish resilient out-of-band collection with buffering for intermittent links.

Explanation

Correct Answer

Segmented control access reduces the blast radius of corporate compromise. Restrict unsafe IT-to-OT connectivity.

Incorrect Answers

Fragile real-time devices can be disrupted by aggressive probes. It would use safe OT asset visibility method, but it would not restrict unsafe IT-to-OT connectivity.

Controlled remote support gives accountability and reduces persistent exposure. It could help govern external OT maintenance sessions, but it would not restrict unsafe IT-to-OT connectivity.

Security event preservation must tolerate disconnected control networks. That is relevant to segregated ot monitoring, not to restrict unsafe IT-to-OT connectivity.

Question 34

An alert reports root-level cloud API use outside an approved break-glass procedure. Which investigative or response action BEST fits the evidence?

Block public access and investigate policy changes using control-plane logs.
Validate source identity and session evidence, then investigate and disable unauthorized use.
Replace wildcard permissions with resource- and action-scoped service-role policy.
Ingest cloud activity and configuration audit logs in addition to guest telemetry.

Explanation

Correct Answer

Root activity is high-impact and cannot be accepted solely because MFA was present. Triage abnormal cloud root API session.

Incorrect Answers

Exposure is an authorization problem requiring containment and attribution. It would contain misconfigured public cloud storage, but it would not triage abnormal cloud root API session.

Narrow entitlements limit the impact of a compromised automation identity. That is relevant to cloud entitlement and control-plane coverage, not to triage abnormal cloud root API session.

Cloud security-group edits occur in the control plane outside guest logging. It would add cloud control-plane monitoring, but it would not triage abnormal cloud root API session.

Question 35

A deprovisioned user's sessions still produce API requests through an old token. What is the MOST appropriate analyst action based on the evidence?

Join SID mappings to identity inventory and preserve mapping timestamps.
Investigate assertion mapping and reject nonunique identities until corrected.
Revoke application tokens and assess any actions after the deprovision timestamp.
Check device-compliance and conditional-access decisions before resetting credentials.

Explanation

Correct Answer

Disabling interactive sign-in may not cancel prior API credentials. Remediate stale application tokens.

Incorrect Answers

Identity enrichment makes cross-system activity attributable without conflating users. It could help map local SID to enterprise identity, but it would not remediate stale application tokens.

Identity collisions undermine attribution and can cross authorization boundaries. That is relevant to alert identity enrichment and authentication gaps, not to remediate stale application tokens.

Authorization can fail on device posture after successful authentication. It could help distinguish posture denial from bad password, but it would not remediate stale application tokens.

Question 36

PowerShell logs show encoded command use immediately after a new scheduled task. Which next step is MOST defensible for the security team?

Compare the change with authorized configuration management and restore audit enforcement.
Review the unit file, executable path and deployment history.
Inspect the autorun value, signer and process ancestry against the approved baseline.
Decode the command safely and correlate task creator, process tree and network activity.

Explanation

Correct Answer

Encoded text alone is not proof, but linked execution context exposes intent. Correlate PowerShell encoded execution.

Incorrect Answers

Unapproved audit weakening removes visibility into subsequent activity. That is relevant to os persistence and baseline evidence, not to correlate PowerShell encoded execution.

Service persistence can blend into normal boot behavior unless baselined. It would investigate suspicious Linux service installation, but it would not correlate PowerShell encoded execution.

Registry startup entries can provide persistence and warrant source validation. It could help investigate registry autorun persistence, but it would not correlate PowerShell encoded execution.

Question 37

Email gateway logs show card numbers in an outbound attachment to a personal address. Which action BEST aligns with sound security operations?

Quarantine the outbound transfer and validate the DLP match against approved business need.
Reassess classification and data sharing because reidentification risk has changed.
Redact secrets at the logging source and rotate credentials already exposed.
Reclassify the data and apply access and retention restrictions for regulated PII.

Explanation

Correct Answer

DLP action should prevent likely CHD leakage while preserving review. Block suspected cardholder data exfiltration.

Incorrect Answers

Combining datasets can turn apparently anonymous records into personal data. It could help detect new reidentification risk, but it would not block suspected cardholder data exfiltration.

Reducing log retention does not mitigate tokens copied into log events. That is relevant to data classification and handling, not to block suspected cardholder data exfiltration.

Sensitive-data controls depend on the actual content, not an inaccurate label. It would correct mislabeled personally identifiable data, but it would not block suspected cardholder data exfiltration.

Question 38

A partner's federated identity claim grants a role unrelated to its approved contract. Which response BEST addresses the security problem described?

Enforce appropriate MFA or passwordless policy for the privileged resource.
Validate claim-to-role mappings and apply least-privilege authorization at the relying party.
Require continuous device posture evaluation for conditional application access.
Move the identity to just-in-time privileged access with approval and auditing.

Explanation

Correct Answer

Valid authentication does not imply authorization for every target role. Distinguish federation authentication from role authorization.

Incorrect Answers

Strong step-up authentication protects higher-risk privileged access. It could help enforce high-assurance privileged authentication, but it would not distinguish federation authentication from role authorization.

Zero trust should reassess device state rather than rely on a one-time grant. It would continuously evaluate device trust, but it would not distinguish federation authentication from role authorization.

Limited elevation windows reduce persistent credential exposure. It could help reduce standing administrator privilege, but it would not distinguish federation authentication from role authorization.

Question 39

Disaster recovery drills restore services but central logging misses the standby subnet. Which investigative or response action BEST fits the evidence?

Enforce boot-time enrollment and reject noncompliant nodes from sensitive workloads.
Preserve immutable versioned backups and verify recovery points preceding encryption.
Add the recovery environment to log ingestion and test detection in DR exercises.
Configure equivalent log forwarding on active and standby units and test failover.

Explanation

Correct Answer

Monitoring continuity is part of operational recovery readiness. Validate monitoring in DR environment.

Incorrect Answers

Dynamic infrastructure requires automated baseline enforcement. That is relevant to data-center resilience and visibility, not to validate monitoring in DR environment.

Synchronous replication is not a substitute for clean historical recovery. It would keep recoverable backup versions, but it would not validate monitoring in DR environment.

High availability must preserve security telemetry across failover events. That is relevant to data-center resilience and visibility, not to validate monitoring in DR environment.

Question 40

A SOC loses seven hours of endpoint telemetry during a collector outage. What is the MOST appropriate analyst action based on the evidence?

Use authenticated encrypted log transport and protected receiver access.
Fix and test parsing of the destination field using representative source events.
Deduplicate on source event identifiers before correlation.
Restore buffered collection where available and label the evidence gap explicitly.

Explanation

Correct Answer

Gaps must be recognized instead of inventing a complete timeline. Assess incomplete event collection.

Incorrect Answers

Integrity and confidentiality prevent interception or tampering in transit. It would secure telemetry transport, but it would not assess incomplete event collection.

A parser losing essential fields breaks downstream detection conditions. It could help repair normalized destination field, but it would not assess incomplete event collection.

Duplicate ingestion inflates counts and obscures actual incident scope. That is relevant to log ingestion integrity, not to assess incomplete event collection.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 2 - 10 Questions (Last Reviewed 13-Nov-2026)
CompTIA CS0-003 Practice Test 3 - 10 Questions (Last Reviewed 12-Nov-2026)
CompTIA CS0-003 Practice Test 4 - 10 Questions (Last Reviewed 11-Nov-2026)
CompTIA CS0-003 Practice Test 5 - 10 Questions (Last Reviewed 10-Nov-2026)
CompTIA CS0-003 Practice Test 6 - 10 Questions (Last Reviewed 09-Nov-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 30

Explanation

Correct Answer

Incorrect Answers

Question 31

Explanation

Correct Answer

Incorrect Answers

Question 32

Explanation

Correct Answer

Incorrect Answers

Question 33

Explanation

Correct Answer

Incorrect Answers

Question 34

Explanation

Correct Answer

Incorrect Answers

Question 35

Explanation

Correct Answer

Incorrect Answers

Question 36

Explanation

Correct Answer

Incorrect Answers

Question 37

Explanation

Correct Answer

Incorrect Answers

Question 38

Explanation

Correct Answer

Incorrect Answers

Question 39

Explanation

Correct Answer

Incorrect Answers

Question 40

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests