CompTIA CS0-003 Practice Test 60

Question 590

A cloud function accepts a user-supplied IAM role ARN and assumes it without restriction. What is the MOST appropriate analyst action based on the evidence?

Apply explicit private bucket policy and verify effective anonymous access is denied.
Enforce approved role allowlists and strict trust relationships.
Isolate untrusted build execution and prevent secrets injection into unapproved jobs.
Enforce tenant-aware authorization at the backend service boundary.

Explanation

Correct Answer

Role selection by untrusted input can cross authorization boundaries. Prevent confused-deputy cloud role assumption.

Incorrect Answers

Storage confidentiality requires resource-level access enforcement. It could help close anonymous cloud object access, but it would not prevent confused-deputy cloud role assumption.

Build events from outsiders must not access privileged release credentials. It would prevent CI pull-request secret leakage, but it would not prevent confused-deputy cloud role assumption.

Gateway authentication alone cannot stop cross-tenant object access. It could help remediate tenant scope bypass, but it would not prevent confused-deputy cloud role assumption.

Question 591

An approved vulnerability exception has passed its expiry with no vendor fix. Which next step is MOST defensible for the security team?

Scope a narrowly justified exception to the sensitive device and document alternate checks.
Document validated vendor fix and adjust signature with controlled evidence.
Renew risk assessment, upgrade compensating controls and seek accountable authorization.
Rotate compromised or inherited credentials and verify associated access.

Explanation

Correct Answer

Expired exceptions cannot remain valid by default. Reauthorize vulnerability exception on expiry.

Incorrect Answers

Broad exclusions create unnecessary vulnerability blind spots. That is relevant to security control quality and exception closure, not to reauthorize vulnerability exception on expiry.

Accurate scanner configuration prevents repeated phantom findings. It would correct scanner signature after verified fix, but it would not reauthorize vulnerability exception on expiry.

Reimaging alone does not invalidate externally reusable credentials. That is relevant to security control quality and exception closure, not to reauthorize vulnerability exception on expiry.

Question 592

A penetration test finds exploitable role logic missing from automated scanner results. Which action BEST aligns with sound security operations?

Establish expiry, grouping and periodic review based on changed exposure.
Verify evidence, handle reward per program rules and consolidate remediation tracking.
Fix provisioning templates and configuration policy rather than repeatedly correcting individual hosts.
Incorporate the tested abuse case into security regression testing and threat models.

Explanation

Correct Answer

Manual discovery should strengthen future preventive and detective coverage. Turn pentest finding into regression control.

Incorrect Answers

Risk acceptance needs continuing validity as context evolves. It would stop perpetual unmanaged risk exceptions, but it would not turn pentest finding into regression control.

Duplicate reports should not create contradictory fixes or suppress legitimate evidence. It could help manage duplicate bug bounty report fairly, but it would not turn pentest finding into regression control.

Baseline automation prevents repeated configuration drift at the source. That is relevant to technical debt and recurring findings, not to turn pentest finding into regression control.

Question 593

A bug bounty submission is accurate but duplicate to an internally known unresolved flaw. Which response BEST addresses the security problem described?

Verify evidence, handle reward per program rules and consolidate remediation tracking.
Incorporate the tested abuse case into security regression testing and threat models.
Establish expiry, grouping and periodic review based on changed exposure.
Fix provisioning templates and configuration policy rather than repeatedly correcting individual hosts.

Explanation

Correct Answer

Duplicate reports should not create contradictory fixes or suppress legitimate evidence. Manage duplicate bug bounty report fairly.

Incorrect Answers

Manual discovery should strengthen future preventive and detective coverage. That is relevant to technical debt and recurring findings, not to manage duplicate bug bounty report fairly.

Risk acceptance needs continuing validity as context evolves. It would stop perpetual unmanaged risk exceptions, but it would not manage duplicate bug bounty report fairly.

Baseline automation prevents repeated configuration drift at the source. It could help eliminate recurring golden-image misconfiguration, but it would not manage duplicate bug bounty report fairly.

Question 594

A security manager needs evidence that suspicious file changes occurred despite prevention controls. Which investigative or response action BEST fits the evidence?

Apply preventative access controls with least-privilege approvals.
Deploy detective file-integrity monitoring with protected alerts.
Use responsive containment controls through approved incident authority.
Perform corrective remediation followed by verified configuration assessment.

Explanation

Correct Answer

Detective monitoring creates actionable evidence after changes. Choose detective integrity control.

Incorrect Answers

Preventative controls block the prohibited action at authorization time. That is relevant to control type selection, not to choose detective integrity control.

Responsive actions limit ongoing incident propagation after detection. It could help select response containment control, but it would not choose detective integrity control.

Corrective controls remove known deficiencies and require outcome validation. That is relevant to control type selection, not to choose detective integrity control.

Question 595

An API team encodes user input on storage but renders it later in different HTML contexts. What is the MOST appropriate analyst action based on the evidence?

Conduct threat modeling before finalizing the design and trust boundaries.
Define reproducible exploit conditions and retest cases as remediation acceptance gates.
Encode untrusted data at the output sink for the actual rendering context.
Add parameterization standards, code review and security tests into the SDLC.

Explanation

Correct Answer

Encoding at input time can fail when the same data reaches different interpreters. Use context-aware output encoding.

Incorrect Answers

Early adversary-focused design review identifies architectural weaknesses. It would apply threat modeling during design, but it would not use context-aware output encoding.

Ticket status alone cannot prove security flaws were fixed. It could help establish security-defect closure validation, but it would not use context-aware output encoding.

Preventive development practices reduce recurrence more effectively than only late scans. It would embed secure coding throughout SDLC, but it would not use context-aware output encoding.

Question 596

A risk committee demands closure even though a compensating control has not been effectiveness-tested. Which next step is MOST defensible for the security team?

Escalate overdue exposure through the defined exception governance.
Track verified remediation against risk-tier service-level objectives.
Record the emergency authorization and complete retrospective change documentation.
Validate the control outcome before marking the residual risk treated.

Explanation

Correct Answer

Claimed mitigation cannot be trusted without evidence of operation. Verify compensating control before acceptance.

Incorrect Answers

Service-level misses need accountable risk decisions, not silent ticket aging. It could help escalate vulnerability remediation SLO breach, but it would not verify compensating control before acceptance.

Operational success should be measured against agreed exposure windows. That is relevant to governance and slos, not to verify compensating control before acceptance.

Time-critical fixes still require traceable governance. It would document emergency security patch approval, but it would not verify compensating control before acceptance.

Question 597

A compromised host needs immediate isolation once high-confidence malware is confirmed. Which action BEST aligns with sound security operations?

Use responsive containment controls through approved incident authority.
Deploy detective file-integrity monitoring with protected alerts.
Perform corrective remediation followed by verified configuration assessment.
Apply preventative access controls with least-privilege approvals.

Explanation

Correct Answer

Responsive actions limit ongoing incident propagation after detection. Select response containment control.

Incorrect Answers

Detective monitoring creates actionable evidence after changes. It would choose detective integrity control, but it would not select response containment control.

Corrective controls remove known deficiencies and require outcome validation. It could help verify corrective control effectiveness, but it would not select response containment control.

Preventative controls block the prohibited action at authorization time. That is relevant to control type selection, not to select response containment control.

Question 598

Developers repeatedly introduce SQL injection in new services despite late testing. Which response BEST addresses the security problem described?

Encode untrusted data at the output sink for the actual rendering context.
Add parameterization standards, code review and security tests into the SDLC.
Define reproducible exploit conditions and retest cases as remediation acceptance gates.
Conduct threat modeling before finalizing the design and trust boundaries.

Explanation

Correct Answer

Preventive development practices reduce recurrence more effectively than only late scans. Embed secure coding throughout SDLC.

Incorrect Answers

Encoding at input time can fail when the same data reaches different interpreters. It would use context-aware output encoding, but it would not embed secure coding throughout SDLC.

Ticket status alone cannot prove security flaws were fixed. That is relevant to security sdlc and secure coding, not to embed secure coding throughout SDLC.

Early adversary-focused design review identifies architectural weaknesses. It would apply threat modeling during design, but it would not embed secure coding throughout SDLC.

Question 599

A scanner signature continues flagging a fixed issue because vendor checks lack the new build mapping. Which investigative or response action BEST fits the evidence?

Scope a narrowly justified exception to the sensitive device and document alternate checks.
Renew risk assessment, upgrade compensating controls and seek accountable authorization.
Document validated vendor fix and adjust signature with controlled evidence.
Rotate compromised or inherited credentials and verify associated access.

Explanation

Correct Answer

Accurate scanner configuration prevents repeated phantom findings. Correct scanner signature after verified fix.

Incorrect Answers

Broad exclusions create unnecessary vulnerability blind spots. It could help limit scan exception scope, but it would not correct scanner signature after verified fix.

Expired exceptions cannot remain valid by default. That is relevant to security control quality and exception closure, not to correct scanner signature after verified fix.

Reimaging alone does not invalidate externally reusable credentials. It could help close residual credentials after rebuild, but it would not correct scanner signature after verified fix.

Question 600

Monthly reports show the same insecure default settings on every newly built VM. What is the MOST appropriate analyst action based on the evidence?

Incorporate the tested abuse case into security regression testing and threat models.
Establish expiry, grouping and periodic review based on changed exposure.
Verify evidence, handle reward per program rules and consolidate remediation tracking.
Fix provisioning templates and configuration policy rather than repeatedly correcting individual hosts.

Explanation

Correct Answer

Baseline automation prevents repeated configuration drift at the source. Eliminate recurring golden-image misconfiguration.

Incorrect Answers

Manual discovery should strengthen future preventive and detective coverage. That is relevant to technical debt and recurring findings, not to eliminate recurring golden-image misconfiguration.

Risk acceptance needs continuing validity as context evolves. It would stop perpetual unmanaged risk exceptions, but it would not eliminate recurring golden-image misconfiguration.

Duplicate reports should not create contradictory fixes or suppress legitimate evidence. It could help manage duplicate bug bounty report fairly, but it would not eliminate recurring golden-image misconfiguration.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 58 - 10 Questions (Last Reviewed 14-Nov-2026)
CompTIA CS0-003 Practice Test 59 - 10 Questions (Last Reviewed 13-Nov-2026)
CompTIA CS0-003 Practice Test 60 - 10 Questions (Last Reviewed 12-Nov-2026)
CompTIA CS0-003 Practice Test 61 - 10 Questions (Last Reviewed 11-Nov-2026)
CompTIA CS0-003 Practice Test 62 - 10 Questions (Last Reviewed 10-Nov-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 590

Explanation

Correct Answer

Incorrect Answers

Question 591

Explanation

Correct Answer

Incorrect Answers

Question 592

Explanation

Correct Answer

Incorrect Answers

Question 593

Explanation

Correct Answer

Incorrect Answers

Question 594

Explanation

Correct Answer

Incorrect Answers

Question 595

Explanation

Correct Answer

Incorrect Answers

Question 596

Explanation

Correct Answer

Incorrect Answers

Question 597

Explanation

Correct Answer

Incorrect Answers

Question 598

Explanation

Correct Answer

Incorrect Answers

Question 599

Explanation

Correct Answer

Incorrect Answers

Question 600

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests