CompTIA CS0-003 Practice Test 48

Question 470

A remediation team reports SLA compliance based on ticket closure dates without verification. What is the MOST appropriate analyst action based on the evidence?

Compare coverage, normalized findings per asset and verified resolution trend.
Measure time to validated closure and separately report overdue unverified findings.
Escalate for timely reevaluation or renewed mitigation before expiration.
Investigate root cause in build and configuration pipelines.

Explanation

Correct Answer

Administrative closure is not equivalent to confirmed risk reduction. Measure verified vulnerability remediation time.

Incorrect Answers

Larger detection scope can inflate counts without equivalent deterioration in controls. It could help interpret backlog growth versus scanning expansion, but it would not measure verified vulnerability remediation time.

Exceptions cannot silently become permanent avoidance of accountability. It would enforce expiring vulnerability exception, but it would not measure verified vulnerability remediation time.

Reappearance suggests a systemic process defect rather than independent isolated tickets. It could help identify recurring vulnerability reintroduction, but it would not measure verified vulnerability remediation time.

Question 471

A log-storage vulnerability allows disclosure of access tokens, not just public event metadata. Which next step is MOST defensible for the security team?

Prioritize resilience and compensating monitoring before service remediation.
Confirm effective disabled state and plan an upgrade with bounded residual risk.
Raise confidentiality and credential-reuse impact in risk assessment.
Escalate confidential material exposure and plan key rotation if access is confirmed.

Explanation

Correct Answer

Exposed tokens can enable follow-on account access beyond log disclosure. Prioritize credentials exposed through logs.

Incorrect Answers

Loss of security telemetry increases detection and response risk. That is relevant to data exposure and vulnerability scope, not to prioritize credentials exposed through logs.

Installed code may not be reachable if the dependent feature is inactive. It would account for disabled embedded feature, but it would not prioritize credentials exposed through logs.

Reading key material can enable impersonation and wider compromise. That is relevant to data exposure and vulnerability scope, not to prioritize credentials exposed through logs.

Question 472

A server flaw requires access through a private VPN used by hundreds of contractors. Which action BEST aligns with sound security operations?

Prioritize the combined exploit chain rather than rating each weakness in isolation.
Validate role assignments and potential escalation paths before claiming immediate exploitability.
Score availability consequences for the kiosk service realistically and schedule hardening.
Include contractor credential compromise and VPN access in likelihood assessment.

Explanation

Correct Answer

Private reachability may still be broad under business trust relationships. Contextualize VPN-restricted vulnerable service.

Incorrect Answers

Chained low-risk issues can unlock high-impact privilege paths. It would evaluate chained vulnerability impact, but it would not contextualize VPN-restricted vulnerable service.

Authorization prerequisites can make a route difficult without other footholds. It could help assess required privileged role in exploit chain, but it would not contextualize VPN-restricted vulnerable service.

Technical remote reboot capability may still have bounded business impact. That is relevant to attack path and privilege chains, not to contextualize VPN-restricted vulnerable service.

Question 473

A patch was delayed by a legacy-app team without a documented risk owner. Which response BEST addresses the security problem described?

Escalate the exposure for accountable exception and mitigation decisions.
Enrich findings with business service and asset criticality inventory.
Coordinate risk mitigation and a controlled maintenance decision with service owners.
Assign explicit remediation owners and track dependent validation checkpoints.

Explanation

Correct Answer

Informal postponement is not valid risk acceptance. Enforce vulnerability exception ownership.

Incorrect Answers

Vulnerability prioritization improves when technical evidence includes business impact. That is relevant to asset ownership and patch urgency, not to enforce vulnerability exception ownership.

Urgency must balance exploit risk and business interruption. It would plan critical patch around legal deadline, but it would not enforce vulnerability exception ownership.

Ambiguous accountability delays closure of shared vulnerabilities. It could help resolve cross-team vulnerability ownership, but it would not enforce vulnerability exception ownership.

Question 474

A static scan finds a function that appears unsafe but all attacker-controlled calls are blocked upstream. Which investigative or response action BEST fits the evidence?

Validate with host inventory before treating it as confirmed.
Document constrained exposure and validate the upstream control's reliability.
Compare scan completeness and environmental changes before dismissal.
Assign a confirmed remediation owner and due date consistent with risk.

Explanation

Correct Answer

Technical code risk and reachable exploit path require separate assessment. Qualify unreachable unsafe function finding.

Incorrect Answers

Network OS guesses can misidentify systems or patched distributions. That is relevant to factual interpretation of scanner certainty, not to qualify unreachable unsafe function finding.

Result absence may reflect scanner access or timing differences. It could help avoid false-positive classification from missing rescan, but it would not qualify unreachable unsafe function finding.

Strong version and exposure evidence supports action rather than repeated unneeded probing. That is relevant to factual interpretation of scanner certainty, not to qualify unreachable unsafe function finding.

Question 475

A scanner shows patch closure on one replica but vulnerable replicas still serve traffic. What is the MOST appropriate analyst action based on the evidence?

Validate the disabled service and maintain monitored remediation plan.
Track the credential misconfiguration as a separate residual risk.
Verify every serving instance and load-balancer pool member before declaring fixed.
Reevaluate compensating control effectiveness and prioritize the residual attack path.

Explanation

Correct Answer

Partial remediation leaves exploitable paths active. Require complete pool vulnerability remediation.

Incorrect Answers

Disabling vulnerable functionality may reduce current exploitability pending patch. It would assess service-disabled risk control, but it would not require complete pool vulnerability remediation.

Removing a software flaw does not close unrelated authentication weaknesses. It could help distinguish patched CVE from residual credential risk, but it would not require complete pool vulnerability remediation.

Allowlist protection depends on trustworthiness of allowed sources. It would reassess compromised trusted network exposure, but it would not require complete pool vulnerability remediation.

Question 476

A vulnerability scanner lists several network paths but only one is routable from attacker-controlled segments. Which next step is MOST defensible for the security team?

Prioritize internal segmentation and credential hardening against lateral movement.
Evaluate local attacker prerequisites and planned hardening rather than assuming internet exploitability.
Review the direct origin path and enforce network-layer access control.
Prioritize the verified reachable exploit chain and record blocked alternatives.

Explanation

Correct Answer

Attack-path feasibility requires real connectivity evidence. Validate reachable attack chain.

Incorrect Answers

Internal exploitability still matters after phishing footholds. It could help address reachable internal admin vulnerability, but it would not validate reachable attack chain.

Binding to loopback narrows the remote attack path. That is relevant to reachability and lateral movement exposure, not to validate reachable attack chain.

Application-layer filtering cannot protect traffic bypassing the protected path. It would address WAF-bypass origin reachability, but it would not validate reachable attack chain.

Question 477

A scan output marks the finding false positive solely because it was not observed in the previous run. Which action BEST aligns with sound security operations?

Compare scan completeness and environmental changes before dismissal.
Validate with host inventory before treating it as confirmed.
Document constrained exposure and validate the upstream control's reliability.
Assign a confirmed remediation owner and due date consistent with risk.

Explanation

Correct Answer

Result absence may reflect scanner access or timing differences. Avoid false-positive classification from missing rescan.

Incorrect Answers

Network OS guesses can misidentify systems or patched distributions. It would qualify TCP fingerprint vulnerability confidence, but it would not avoid false-positive classification from missing rescan.

Technical code risk and reachable exploit path require separate assessment. It could help qualify unreachable unsafe function finding, but it would not avoid false-positive classification from missing rescan.

Strong version and exposure evidence supports action rather than repeated unneeded probing. That is relevant to factual interpretation of scanner certainty, not to avoid false-positive classification from missing rescan.

Question 478

A vulnerability is severe on an appliance supporting a legal filing deadline the next morning. Which response BEST addresses the security problem described?

Enrich findings with business service and asset criticality inventory.
Coordinate risk mitigation and a controlled maintenance decision with service owners.
Escalate the exposure for accountable exception and mitigation decisions.
Assign explicit remediation owners and track dependent validation checkpoints.

Explanation

Correct Answer

Urgency must balance exploit risk and business interruption. Plan critical patch around legal deadline.

Incorrect Answers

Vulnerability prioritization improves when technical evidence includes business impact. It would enrich vulnerability findings with asset value, but it would not plan critical patch around legal deadline.

Informal postponement is not valid risk acceptance. That is relevant to asset ownership and patch urgency, not to plan critical patch around legal deadline.

Ambiguous accountability delays closure of shared vulnerabilities. It would resolve cross-team vulnerability ownership, but it would not plan critical patch around legal deadline.

Question 479

A database CVE is high severity but network reachability is blocked and service disabled. Which investigative or response action BEST fits the evidence?

Reevaluate compensating control effectiveness and prioritize the residual attack path.
Verify every serving instance and load-balancer pool member before declaring fixed.
Validate the disabled service and maintain monitored remediation plan.
Track the credential misconfiguration as a separate residual risk.

Explanation

Correct Answer

Disabling vulnerable functionality may reduce current exploitability pending patch. Assess service-disabled risk control.

Incorrect Answers

Allowlist protection depends on trustworthiness of allowed sources. It could help reassess compromised trusted network exposure, but it would not assess service-disabled risk control.

Partial remediation leaves exploitable paths active. That is relevant to network isolation and compensating control, not to assess service-disabled risk control.

Removing a software flaw does not close unrelated authentication weaknesses. It could help distinguish patched CVE from residual credential risk, but it would not assess service-disabled risk control.

Question 480

An internet host is patched but an exposed management credential remains weak. What is the MOST appropriate analyst action based on the evidence?

Reevaluate compensating control effectiveness and prioritize the residual attack path.
Verify every serving instance and load-balancer pool member before declaring fixed.
Validate the disabled service and maintain monitored remediation plan.
Track the credential misconfiguration as a separate residual risk.

Explanation

Correct Answer

Removing a software flaw does not close unrelated authentication weaknesses. Distinguish patched CVE from residual credential risk.

Incorrect Answers

Allowlist protection depends on trustworthiness of allowed sources. That is relevant to network isolation and compensating control, not to distinguish patched CVE from residual credential risk.

Partial remediation leaves exploitable paths active. It would require complete pool vulnerability remediation, but it would not distinguish patched CVE from residual credential risk.

Disabling vulnerable functionality may reduce current exploitability pending patch. It could help assess service-disabled risk control, but it would not distinguish patched CVE from residual credential risk.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 46 - 10 Questions (Last Reviewed 30-Sep-2026)
CompTIA CS0-003 Practice Test 47 - 10 Questions (Last Reviewed 29-Sep-2026)
CompTIA CS0-003 Practice Test 48 - 10 Questions (Last Reviewed 28-Sep-2026)
CompTIA CS0-003 Practice Test 49 - 10 Questions (Last Reviewed 27-Sep-2026)
CompTIA CS0-003 Practice Test 50 - 10 Questions (Last Reviewed 26-Sep-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 470

Explanation

Correct Answer

Incorrect Answers

Question 471

Explanation

Correct Answer

Incorrect Answers

Question 472

Explanation

Correct Answer

Incorrect Answers

Question 473

Explanation

Correct Answer

Incorrect Answers

Question 474

Explanation

Correct Answer

Incorrect Answers

Question 475

Explanation

Correct Answer

Incorrect Answers

Question 476

Explanation

Correct Answer

Incorrect Answers

Question 477

Explanation

Correct Answer

Incorrect Answers

Question 478

Explanation

Correct Answer

Incorrect Answers

Question 479

Explanation

Correct Answer

Incorrect Answers

Question 480

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests