CompTIA CS0-003 Practice Test 56

Question 550

A user changes their password but all existing sessions remain valid indefinitely. What is the MOST appropriate analyst action based on the evidence?

Use HttpOnly for authentication cookies and constrain third-party script execution.
Revoke or rotate affected sessions after security-sensitive credential changes.
Apply an appropriate SameSite policy after testing legitimate integration flows.
Mark sensitive cookies Secure and eliminate HTTP exposure for authenticated sessions.

Explanation

Correct Answer

Password changes alone may not invalidate stolen session tokens. Terminate stale sessions after password reset.

Incorrect Answers

HttpOnly reduces credential theft through client-side script access. It would prevent script-accessible auth cookie theft, but it would not terminate stale sessions after password reset.

SameSite restrictions reduce ambient credential use in cross-site requests. That is relevant to session and browser protections, not to terminate stale sessions after password reset.

Secure cookies reduce transmission over unencrypted connections. It would protect cookies over HTTPS, but it would not terminate stale sessions after password reset.

Question 551

A workflow runs post-build scripts supplied by an unauthenticated user. Which next step is MOST defensible for the security team?

Replace shell interpolation with parameterized subprocess APIs and strict input validation.
Use safe data formats with strict type schemas and avoid unsafe object reconstruction.
Require trusted signed scripts and execute in restricted isolated build workers.
Remove untrusted code execution and restrict plugin sources and privileges.

Explanation

Correct Answer

Supply-chain build hooks are code execution boundaries. Constrain untrusted build script execution.

Incorrect Answers

Shell metacharacters can turn ordinary data into arbitrary commands. It could help prevent shell command injection, but it would not constrain untrusted build script execution.

Untrusted deserialization can reach executable gadget chains. That is relevant to command injection and arbitrary execution, not to constrain untrusted build script execution.

Remote attacker-controlled content should not run with elevated authority. It could help block remote code execution by plugin loading, but it would not constrain untrusted build script execution.

Question 552

A financial workflow permits one staff member to create and approve high-value payments. Which action BEST aligns with sound security operations?

Independently validate critical attributes against trusted signals.
Validate dataset provenance and apply review gates for high-impact training updates.
Add authorization-aware quotas and abuse limits during architectural redesign.
Enforce separation of duties and distinct approval authority.

Explanation

Correct Answer

Transaction integrity requires governance controls, not just secure software code. Fix missing dual control in payment design.

Incorrect Answers

Self-declared metadata can be manipulated to bypass model or business controls. That is relevant to insecure design and data poisoning, not to fix missing dual control in payment design.

Untrusted labels can poison model behavior even when code is bug-free. It would mitigate training-data poisoning, but it would not fix missing dual control in payment design.

Insecure design creates systemic resource exhaustion beyond one coding bug. It could help introduce resource-governance controls at design level, but it would not fix missing dual control in payment design.

Question 553

An internal application grants all API tokens edit rights despite read-only business roles. Which response BEST addresses the security problem described?

Scope token authorization to required actions and resources.
Derive tenant scope from trusted authenticated claims and enforce data isolation.
Enforce server-side ownership checks for each object and action.
Check authorization at the server API on every protected operation.

Explanation

Correct Answer

Excess token permissions enable unauthorized modifications after token exposure. Enforce API action-level authorization.

Incorrect Answers

Client-supplied tenant selection enables cross-tenant data access. It could help prevent cross-tenant authorization bypass, but it would not enforce API action-level authorization.

Authentication does not authorize access to arbitrary records. That is relevant to broken object-level authorization, not to enforce API action-level authorization.

User interface visibility is not a security boundary. It would remediate client-only admin control, but it would not enforce API action-level authorization.

Question 554

A frontend hides the admin button but backend APIs still accept standard-user admin requests. Which investigative or response action BEST fits the evidence?

Enforce server-side ownership checks for each object and action.
Check authorization at the server API on every protected operation.
Derive tenant scope from trusted authenticated claims and enforce data isolation.
Scope token authorization to required actions and resources.

Explanation

Correct Answer

User interface visibility is not a security boundary. Remediate client-only admin control.

Incorrect Answers

Authentication does not authorize access to arbitrary records. It could help fix insecure direct object reference, but it would not remediate client-only admin control.

Client-supplied tenant selection enables cross-tenant data access. It would prevent cross-tenant authorization bypass, but it would not remediate client-only admin control.

Excess token permissions enable unauthorized modifications after token exposure. It could help enforce API action-level authorization, but it would not remediate client-only admin control.

Question 555

A team disables CSRF checks for an OAuth callback without state validation. What is the MOST appropriate analyst action based on the evidence?

Add unpredictable anti-CSRF tokens or equivalent trusted-origin validation for sensitive actions.
Move state changes to protected methods with CSRF defenses and confirmation.
Validate cryptographic state binding and redirect URI constraints for the flow.
Evaluate actual cross-origin credential behavior before asserting cookie-based CSRF risk.

Explanation

Correct Answer

OAuth state guards against cross-site authorization response confusion. Protect OAuth callback from cross-site manipulation.

Incorrect Answers

Request authenticity must not rely only on automatically attached cookies. That is relevant to cross-site request forgery, not to protect OAuth callback from cross-site manipulation.

Read-style URLs should not cause sensitive side effects when embedded elsewhere. It would avoid state-changing GET CSRF exposure, but it would not protect OAuth callback from cross-site manipulation.

CSRF depends on whether a browser automatically supplies an exploitable credential. That is relevant to cross-site request forgery, not to protect OAuth callback from cross-site manipulation.

Question 556

A web server exposes directory listings containing private configuration backups. Which next step is MOST defensible for the security team?

Plan replacement and isolate the device with monitored compensating controls in the interim.
Remove embedded secrets from images, rotate credentials and provision via secure secret service.
Disable default accounts and enforce unique strong authentication with network restrictions.
Disable directory listing and remove sensitive backups from the public web root.

Explanation

Correct Answer

Discovery and retrieval of backup files can disclose credentials and source code. Block web backup disclosure.

Incorrect Answers

Unsupported components accumulate unresolved security risk. It would manage end-of-life vulnerable appliance, but it would not block web backup disclosure.

Image reuse spreads credentials to new systems and potential unauthorized readers. It could help remediate secrets embedded in machine image, but it would not block web backup disclosure.

Default credentials are widely known and enable simple takeover. That is relevant to security misconfiguration and legacy components, not to block web backup disclosure.

Question 557

A serverless job can write to all storage buckets though it processes one queue. Which action BEST aligns with sound security operations?

Scope the execution identity to the intended bucket and required API actions.
Segregate management access and use dedicated authenticated operator channels.
Move administration behind restricted network access and stronger identity authentication.
Restrict origin access to approved reverse-proxy paths.

Explanation

Correct Answer

Broad cloud permissions increase compromise blast radius. Tighten serverless function IAM.

Incorrect Answers

Separating control plane from public data plane reduces privilege attack paths. That is relevant to cloud app threat mitigation, not to tighten serverless function IAM.

Network and identity controls together reduce compromise risk. It would harden exposed admin API, but it would not tighten serverless function IAM.

Direct origin routing can bypass protective application filtering. It could help prevent direct-origin WAF bypass, but it would not tighten serverless function IAM.

Question 558

A web app sets session cookies without Secure while serving login over HTTPS. Which response BEST addresses the security problem described?

Use HttpOnly for authentication cookies and constrain third-party script execution.
Mark sensitive cookies Secure and eliminate HTTP exposure for authenticated sessions.
Revoke or rotate affected sessions after security-sensitive credential changes.
Apply an appropriate SameSite policy after testing legitimate integration flows.

Explanation

Correct Answer

Secure cookies reduce transmission over unencrypted connections. Protect cookies over HTTPS.

Incorrect Answers

HttpOnly reduces credential theft through client-side script access. That is relevant to session and browser protections, not to protect cookies over HTTPS.

Password changes alone may not invalidate stolen session tokens. It could help terminate stale sessions after password reset, but it would not protect cookies over HTTPS.

SameSite restrictions reduce ambient credential use in cross-site requests. That is relevant to session and browser protections, not to protect cookies over HTTPS.

Question 559

A deserialization endpoint accepts untrusted object graphs that invoke dangerous methods. Which investigative or response action BEST fits the evidence?

Require trusted signed scripts and execute in restricted isolated build workers.
Replace shell interpolation with parameterized subprocess APIs and strict input validation.
Use safe data formats with strict type schemas and avoid unsafe object reconstruction.
Remove untrusted code execution and restrict plugin sources and privileges.

Explanation

Correct Answer

Untrusted deserialization can reach executable gadget chains. Mitigate insecure deserialization.

Incorrect Answers

Supply-chain build hooks are code execution boundaries. It would constrain untrusted build script execution, but it would not mitigate insecure deserialization.

Shell metacharacters can turn ordinary data into arbitrary commands. It could help prevent shell command injection, but it would not mitigate insecure deserialization.

Remote attacker-controlled content should not run with elevated authority. It would block remote code execution by plugin loading, but it would not mitigate insecure deserialization.

Question 560

A URL filter blocks 127.0.0.1 but allows alternative numeric and IPv6 loopback spellings. What is the MOST appropriate analyst action based on the evidence?

Apply network egress filtering independent of application hostname checks.
Revalidate every redirect destination and prohibit private-address hops.
Enforce destination allowlists and block internal/metadata address access after DNS resolution.
Canonicalize and validate resolved addresses against prohibited network ranges.

Explanation

Correct Answer

String-only URL filters can be bypassed using alternative address forms. Close SSRF IP normalization bypass.

Incorrect Answers

Defense-in-depth limits DNS rebinding into internal network targets. It could help contain SSRF through network-level egress rules, but it would not close SSRF IP normalization bypass.

Redirect chains can defeat a one-time destination allowlist. That is relevant to server-side request forgery, not to close SSRF IP normalization bypass.

Server-side fetchers can be coerced into reaching privileged internal endpoints. It would prevent SSRF to cloud metadata, but it would not close SSRF IP normalization bypass.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 54 - 10 Questions (Last Reviewed 22-Sep-2026)
CompTIA CS0-003 Practice Test 55 - 10 Questions (Last Reviewed 21-Sep-2026)
CompTIA CS0-003 Practice Test 56 - 10 Questions (Last Reviewed 20-Sep-2026)
CompTIA CS0-003 Practice Test 57 - 10 Questions (Last Reviewed 15-Nov-2026)
CompTIA CS0-003 Practice Test 58 - 10 Questions (Last Reviewed 14-Nov-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 550

Explanation

Correct Answer

Incorrect Answers

Question 551

Explanation

Correct Answer

Incorrect Answers

Question 552

Explanation

Correct Answer

Incorrect Answers

Question 553

Explanation

Correct Answer

Incorrect Answers

Question 554

Explanation

Correct Answer

Incorrect Answers

Question 555

Explanation

Correct Answer

Incorrect Answers

Question 556

Explanation

Correct Answer

Incorrect Answers

Question 557

Explanation

Correct Answer

Incorrect Answers

Question 558

Explanation

Correct Answer

Incorrect Answers

Question 559

Explanation

Correct Answer

Incorrect Answers

Question 560

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests