CompTIA CS0-003 Practice Test 54

Question 530

An API gateway authenticates users but ignores per-tenant scope on downstream requests. What is the MOST appropriate analyst action based on the evidence?

Apply explicit private bucket policy and verify effective anonymous access is denied.
Enforce tenant-aware authorization at the backend service boundary.
Isolate untrusted build execution and prevent secrets injection into unapproved jobs.
Enforce approved role allowlists and strict trust relationships.

Explanation

Correct Answer

Gateway authentication alone cannot stop cross-tenant object access. Remediate tenant scope bypass.

Incorrect Answers

Storage confidentiality requires resource-level access enforcement. It could help close anonymous cloud object access, but it would not remediate tenant scope bypass.

Build events from outsiders must not access privileged release credentials. It would prevent CI pull-request secret leakage, but it would not remediate tenant scope bypass.

Role selection by untrusted input can cross authorization boundaries. It could help prevent confused-deputy cloud role assumption, but it would not remediate tenant scope bypass.

Question 531

A document preview service fetches arbitrary URL parameters, including cloud metadata addresses. Which next step is MOST defensible for the security team?

Canonicalize and validate resolved addresses against prohibited network ranges.
Revalidate every redirect destination and prohibit private-address hops.
Enforce destination allowlists and block internal/metadata address access after DNS resolution.
Apply network egress filtering independent of application hostname checks.

Explanation

Correct Answer

Server-side fetchers can be coerced into reaching privileged internal endpoints. Prevent SSRF to cloud metadata.

Incorrect Answers

String-only URL filters can be bypassed using alternative address forms. That is relevant to server-side request forgery, not to prevent SSRF to cloud metadata.

Redirect chains can defeat a one-time destination allowlist. It would prevent redirect-based SSRF pivot, but it would not prevent SSRF to cloud metadata.

Defense-in-depth limits DNS rebinding into internal network targets. That is relevant to server-side request forgery, not to prevent SSRF to cloud metadata.

Question 532

An internal admin API accepts requests from public networks and relies only on a static key. Which action BEST aligns with sound security operations?

Restrict origin access to approved reverse-proxy paths.
Scope the execution identity to the intended bucket and required API actions.
Segregate management access and use dedicated authenticated operator channels.
Move administration behind restricted network access and stronger identity authentication.

Explanation

Correct Answer

Network and identity controls together reduce compromise risk. Harden exposed admin API.

Incorrect Answers

Direct origin routing can bypass protective application filtering. It would prevent direct-origin WAF bypass, but it would not harden exposed admin API.

Broad cloud permissions increase compromise blast radius. It could help tighten serverless function IAM, but it would not harden exposed admin API.

Separating control plane from public data plane reduces privilege attack paths. That is relevant to cloud app threat mitigation, not to harden exposed admin API.

Question 533

An application must fetch partner URLs but a compromised DNS answer may resolve into private space. Which response BEST addresses the security problem described?

Apply network egress filtering independent of application hostname checks.
Revalidate every redirect destination and prohibit private-address hops.
Canonicalize and validate resolved addresses against prohibited network ranges.
Enforce destination allowlists and block internal/metadata address access after DNS resolution.

Explanation

Correct Answer

Defense-in-depth limits DNS rebinding into internal network targets. Contain SSRF through network-level egress rules.

Incorrect Answers

Redirect chains can defeat a one-time destination allowlist. That is relevant to server-side request forgery, not to contain SSRF through network-level egress rules.

String-only URL filters can be bypassed using alternative address forms. It would close SSRF IP normalization bypass, but it would not contain SSRF through network-level egress rules.

Server-side fetchers can be coerced into reaching privileged internal endpoints. It could help prevent SSRF to cloud metadata, but it would not contain SSRF through network-level egress rules.

Question 534

A WAF blocks known injection patterns but the application remains vulnerable to new encodings. Which investigative or response action BEST fits the evidence?

Reduce the application database principal to least required table operations.
Fix the application query construction rather than relying only on signatures.
Use tested query parameterization and enforce secure data-access libraries.
Replace string-concatenated SQL with parameterized prepared statements.

Explanation

Correct Answer

Edge filtering cannot guarantee coverage of all input encodings. Implement root cause SQL injection fix.

Incorrect Answers

Least privilege constrains damage if application code is compromised. That is relevant to sql injection risk mitigation, not to implement root cause SQL injection fix.

Handwritten escaping can fail for alternate character sets and contexts. It could help replace fragile manual SQL escaping, but it would not implement root cause SQL injection fix.

Parameter binding separates user data from executable query syntax. That is relevant to sql injection risk mitigation, not to implement root cause SQL injection fix.

Question 535

A CI/CD pipeline passes production secrets to untrusted pull-request jobs. What is the MOST appropriate analyst action based on the evidence?

Enforce tenant-aware authorization at the backend service boundary.
Apply explicit private bucket policy and verify effective anonymous access is denied.
Isolate untrusted build execution and prevent secrets injection into unapproved jobs.
Enforce approved role allowlists and strict trust relationships.

Explanation

Correct Answer

Build events from outsiders must not access privileged release credentials. Prevent CI pull-request secret leakage.

Incorrect Answers

Gateway authentication alone cannot stop cross-tenant object access. It would remediate tenant scope bypass, but it would not prevent CI pull-request secret leakage.

Storage confidentiality requires resource-level access enforcement. It could help close anonymous cloud object access, but it would not prevent CI pull-request secret leakage.

Role selection by untrusted input can cross authorization boundaries. It would prevent confused-deputy cloud role assumption, but it would not prevent CI pull-request secret leakage.

Question 536

A fraud model accepts unverified external labels as ground truth during automated retraining. Which next step is MOST defensible for the security team?

Add authorization-aware quotas and abuse limits during architectural redesign.
Enforce separation of duties and distinct approval authority.
Independently validate critical attributes against trusted signals.
Validate dataset provenance and apply review gates for high-impact training updates.

Explanation

Correct Answer

Untrusted labels can poison model behavior even when code is bug-free. Mitigate training-data poisoning.

Incorrect Answers

Insecure design creates systemic resource exhaustion beyond one coding bug. It could help introduce resource-governance controls at design level, but it would not mitigate training-data poisoning.

Transaction integrity requires governance controls, not just secure software code. That is relevant to insecure design and data poisoning, not to mitigate training-data poisoning.

Self-declared metadata can be manipulated to bypass model or business controls. It would prevent attacker-supplied metadata poisoning, but it would not mitigate training-data poisoning.

Question 537

A cloud instance launches from an image with baked-in production credentials. Which action BEST aligns with sound security operations?

Remove embedded secrets from images, rotate credentials and provision via secure secret service.
Plan replacement and isolate the device with monitored compensating controls in the interim.
Disable default accounts and enforce unique strong authentication with network restrictions.
Disable directory listing and remove sensitive backups from the public web root.

Explanation

Correct Answer

Image reuse spreads credentials to new systems and potential unauthorized readers. Remediate secrets embedded in machine image.

Incorrect Answers

Unsupported components accumulate unresolved security risk. It would manage end-of-life vulnerable appliance, but it would not remediate secrets embedded in machine image.

Default credentials are widely known and enable simple takeover. It could help remediate exposed default credentials, but it would not remediate secrets embedded in machine image.

Discovery and retrieval of backup files can disclose credentials and source code. That is relevant to security misconfiguration and legacy components, not to remediate secrets embedded in machine image.

Question 538

A web app appends user-provided filenames directly into an OS shell command. Which response BEST addresses the security problem described?

Require trusted signed scripts and execute in restricted isolated build workers.
Replace shell interpolation with parameterized subprocess APIs and strict input validation.
Use safe data formats with strict type schemas and avoid unsafe object reconstruction.
Remove untrusted code execution and restrict plugin sources and privileges.

Explanation

Correct Answer

Shell metacharacters can turn ordinary data into arbitrary commands. Prevent shell command injection.

Incorrect Answers

Supply-chain build hooks are code execution boundaries. It would constrain untrusted build script execution, but it would not prevent shell command injection.

Untrusted deserialization can reach executable gadget chains. That is relevant to command injection and arbitrary execution, not to prevent shell command injection.

Remote attacker-controlled content should not run with elevated authority. It would block remote code execution by plugin loading, but it would not prevent shell command injection.

Question 539

A messaging service exposes its administrative dashboard on the same port as public subscribers. Which investigative or response action BEST fits the evidence?

Move administration behind restricted network access and stronger identity authentication.
Restrict origin access to approved reverse-proxy paths.
Segregate management access and use dedicated authenticated operator channels.
Scope the execution identity to the intended bucket and required API actions.

Explanation

Correct Answer

Separating control plane from public data plane reduces privilege attack paths. Isolate public messaging management interface.

Incorrect Answers

Network and identity controls together reduce compromise risk. It could help harden exposed admin API, but it would not isolate public messaging management interface.

Direct origin routing can bypass protective application filtering. That is relevant to cloud app threat mitigation, not to isolate public messaging management interface.

Broad cloud permissions increase compromise blast radius. It could help tighten serverless function IAM, but it would not isolate public messaging management interface.

Question 540

An image recognition workflow trusts metadata fields submitted by untrusted users to make safety decisions. What is the MOST appropriate analyst action based on the evidence?

Add authorization-aware quotas and abuse limits during architectural redesign.
Validate dataset provenance and apply review gates for high-impact training updates.
Enforce separation of duties and distinct approval authority.
Independently validate critical attributes against trusted signals.

Explanation

Correct Answer

Self-declared metadata can be manipulated to bypass model or business controls. Prevent attacker-supplied metadata poisoning.

Incorrect Answers

Insecure design creates systemic resource exhaustion beyond one coding bug. That is relevant to insecure design and data poisoning, not to prevent attacker-supplied metadata poisoning.

Untrusted labels can poison model behavior even when code is bug-free. It would mitigate training-data poisoning, but it would not prevent attacker-supplied metadata poisoning.

Transaction integrity requires governance controls, not just secure software code. It could help fix missing dual control in payment design, but it would not prevent attacker-supplied metadata poisoning.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 52 - 10 Questions (Last Reviewed 24-Sep-2026)
CompTIA CS0-003 Practice Test 53 - 10 Questions (Last Reviewed 23-Sep-2026)
CompTIA CS0-003 Practice Test 54 - 10 Questions (Last Reviewed 22-Sep-2026)
CompTIA CS0-003 Practice Test 55 - 10 Questions (Last Reviewed 21-Sep-2026)
CompTIA CS0-003 Practice Test 56 - 10 Questions (Last Reviewed 20-Sep-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 530

Explanation

Correct Answer

Incorrect Answers

Question 531

Explanation

Correct Answer

Incorrect Answers

Question 532

Explanation

Correct Answer

Incorrect Answers

Question 533

Explanation

Correct Answer

Incorrect Answers

Question 534

Explanation

Correct Answer

Incorrect Answers

Question 535

Explanation

Correct Answer

Incorrect Answers

Question 536

Explanation

Correct Answer

Incorrect Answers

Question 537

Explanation

Correct Answer

Incorrect Answers

Question 538

Explanation

Correct Answer

Incorrect Answers

Question 539

Explanation

Correct Answer

Incorrect Answers

Question 540

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests