CompTIA CS0-003 Practice Test 66

Question 650

A defender needs to evaluate input validation rather than reconstruct the attacker's timeline. What is the MOST appropriate analyst action based on the evidence?

Build linked Diamond Model events while differentiating observed from inferred links.
Apply specific OWASP web testing procedures to the affected route.
Translate the behavior into ATT&CK techniques and hunt for corroborating telemetry.
Trace execution and initial access evidence using kill-chain hypotheses.

Explanation

Correct Answer

Control testing and incident chronology require different methodologies. Choose web testing over intrusion timeline model.

Incorrect Answers

A relationship model can expose common campaign components. It could help correlate multi-victim infrastructure using Diamond, but it would not choose web testing over intrusion timeline model.

Technique-driven hunts remain relevant when exact IOCs are missing. It would hunt credential access via ATT&CK, but it would not choose web testing over intrusion timeline model.

Attack-stage framing helps enumerate missing earlier events. It could help reconstruct precursors of C2 activity, but it would not choose web testing over intrusion timeline model.

Question 651

Two campaigns use the same CDN but different capabilities and victims. Which next step is MOST defensible for the security team?

Leave adversary identity uncertain while documenting observed infrastructure and capability.
Pivot through related Diamond Model events and their victim relationships.
Avoid merging them solely on shared infrastructure without further event relationships.
Represent the relationships as a Diamond Model event and retain evidence links.

Explanation

Correct Answer

Infrastructure overlap can be incidental or reused by separate threat actors. Avoid false intrusion clustering by shared IP.

Incorrect Answers

The model supports unknown vertices without fabricating attribution. That is relevant to diamond model intrusion analysis, not to avoid false intrusion clustering by shared IP.

Event relationships can reveal campaign targeting patterns. It would use Diamond Model relationships for victim scoping, but it would not avoid false intrusion clustering by shared IP.

The Diamond Model structures adversary, capability, infrastructure and victim context. That is relevant to diamond model intrusion analysis, not to avoid false intrusion clustering by shared IP.

Question 652

A suspicious PowerShell command launches a download but no subsequent execution is observed. Which action BEST aligns with sound security operations?

Document impersonation and initial-access patterns separately from credential theft outcomes.
Separate account enumeration evidence from password-use evidence before assigning tactics.
Classify the tool's actual remote execution technique rather than its benign product name.
Map the observed command behavior without asserting later persistence or exfiltration.

Explanation

Correct Answer

Framework phase labeling should not invent unobserved attack steps. Classify only observed malicious behaviors.

Incorrect Answers

A deceptive lure is not proof that credentials were actually stolen. It would separate phishing delivery from credential capture, but it would not classify only observed malicious behaviors.

A login pattern needs precise interpretation to support correct technique labeling. It could help distinguish account discovery from credential attacks, but it would not classify only observed malicious behaviors.

Legitimate software can be part of adversary tradecraft when misused. That is relevant to mapping adversary objective versus artifact, not to classify only observed malicious behaviors.

Question 653

A defender observes a phishing email but no user execution and wants containment metrics. Which response BEST addresses the security problem described?

Track the blocked delivery as a prevention event, not a host compromise.
Require payload preparation or campaign evidence before claiming weaponization.
Distinguish initial access from internal discovery in the behavioral timeline.
Link installation evidence to subsequent command-and-control without assuming data theft.

Explanation

Correct Answer

Accurate stage interpretation prevents false incident counts. Measure blocked phishing delivery distinctly.

Incorrect Answers

Vulnerability existence alone is not an attacker action. That is relevant to intrusion sequencing and attack paths, not to measure blocked phishing delivery distinctly.

Separate technique classification helps locate missing detections. It would map VPN compromise versus file discovery, but it would not measure blocked phishing delivery distinctly.

Tool execution and remote control are separate phases from impact. It could help separate installation from C2, but it would not measure blocked phishing delivery distinctly.

Question 654

A physical access tester attempts badge cloning outside the contractual assessment scope. Which investigative or response action BEST fits the evidence?

Define OSSTMM-aligned testing channels and obtain authorization for each area.
Stop the action and obtain written authorization before proceeding.
Distinguish control configuration review from actual security-test results.
Repeat consistent authorized tests against both baselines and record changed reachability.

Explanation

Correct Answer

Assessment methodologies never override legal scope boundaries. Enforce OSSTMM engagement authorization.

Incorrect Answers

Broad methodology scope should be explicit and approved. That is relevant to osstmm and test methodology selection, not to enforce OSSTMM engagement authorization.

Security testing measures behavior and exposure, not only policy existence. It could help distinguish security assessment from compliance checklist, but it would not enforce OSSTMM engagement authorization.

Comparable test methods allow defensible measurement of control effectiveness. That is relevant to osstmm and test methodology selection, not to enforce OSSTMM engagement authorization.

Question 655

A client asks for web application assessment results with reproducible steps and affected endpoints. What is the MOST appropriate analyst action based on the evidence?

Choose a more relevant platform assessment method for kernel configuration.
Compare actual executed test cases with the guide's relevant manual and technical objectives.
Report observed requests, responses, impact and mitigation under the test method.
Use relevant OWASP Web Security Testing Guide categories with authorized test scope.

Explanation

Correct Answer

Repeatable findings allow secure remediation without claiming unaudited exploit success. Document reproducible web test finding.

Incorrect Answers

Web application testing guidance does not replace OS hardening assessment. It would limit OWASP guide to appropriate attack surface, but it would not document reproducible web test finding.

Automated scanning does not automatically establish full web testing coverage. It could help evaluate incomplete OWASP testing coverage, but it would not document reproducible web test finding.

OWASP guidance organizes web application security testing methods. It would apply OWASP testing guide to session assessment, but it would not document reproducible web test finding.

Question 656

A web team wants a structured basis for assessing authentication and session defenses. Which next step is MOST defensible for the security team?

Choose a more relevant platform assessment method for kernel configuration.
Report observed requests, responses, impact and mitigation under the test method.
Compare actual executed test cases with the guide's relevant manual and technical objectives.
Use relevant OWASP Web Security Testing Guide categories with authorized test scope.

Explanation

Correct Answer

OWASP guidance organizes web application security testing methods. Apply OWASP testing guide to session assessment.

Incorrect Answers

Web application testing guidance does not replace OS hardening assessment. It could help limit OWASP guide to appropriate attack surface, but it would not apply OWASP testing guide to session assessment.

Repeatable findings allow secure remediation without claiming unaudited exploit success. That is relevant to owasp testing guide application, not to apply OWASP testing guide to session assessment.

Automated scanning does not automatically establish full web testing coverage. It would evaluate incomplete OWASP testing coverage, but it would not apply OWASP testing guide to session assessment.

Question 657

An adversary first compromises a VPN identity then enumerates internal file servers. Which action BEST aligns with sound security operations?

Distinguish initial access from internal discovery in the behavioral timeline.
Link installation evidence to subsequent command-and-control without assuming data theft.
Track the blocked delivery as a prevention event, not a host compromise.
Require payload preparation or campaign evidence before claiming weaponization.

Explanation

Correct Answer

Separate technique classification helps locate missing detections. Map VPN compromise versus file discovery.

Incorrect Answers

Tool execution and remote control are separate phases from impact. It would separate installation from C2, but it would not map VPN compromise versus file discovery.

Accurate stage interpretation prevents false incident counts. It could help measure blocked phishing delivery distinctly, but it would not map VPN compromise versus file discovery.

Vulnerability existence alone is not an attacker action. That is relevant to intrusion sequencing and attack paths, not to map VPN compromise versus file discovery.

Question 658

An executive asks which stages of an observed phishing attack were detected before compromise. Which response BEST addresses the security problem described?

Follow authorized OWASP web testing method categories.
Explain observed progression using the cyber kill chain with evidence boundaries.
Use the Diamond Model and annotate confidence for each event linkage.
Map relevant ATT&CK techniques and data sources for detection improvements.

Explanation

Correct Answer

Stage-oriented communication clarifies preventive and detective opportunities. Use kill chain for executive detection timeline.

Incorrect Answers

Application testing guidance targets specific control failure mechanisms. It would select OWASP guide for web assurance, but it would not use kill chain for executive detection timeline.

Relational campaign analysis benefits from the four model vertices. That is relevant to framework selection for soc management, not to use kill chain for executive detection timeline.

ATT&CK supports technical behavior- and telemetry-oriented planning. It would select ATT&CK for ransomware detection design, but it would not use kill chain for executive detection timeline.

Question 659

An application assurance team needs repeatable tests for session fixation and authorization. Which investigative or response action BEST fits the evidence?

Explain observed progression using the cyber kill chain with evidence boundaries.
Use the Diamond Model and annotate confidence for each event linkage.
Follow authorized OWASP web testing method categories.
Map relevant ATT&CK techniques and data sources for detection improvements.

Explanation

Correct Answer

Application testing guidance targets specific control failure mechanisms. Select OWASP guide for web assurance.

Incorrect Answers

Stage-oriented communication clarifies preventive and detective opportunities. It could help use kill chain for executive detection timeline, but it would not select OWASP guide for web assurance.

Relational campaign analysis benefits from the four model vertices. That is relevant to framework selection for soc management, not to select OWASP guide for web assurance.

ATT&CK supports technical behavior- and telemetry-oriented planning. It could help select ATT&CK for ransomware detection design, but it would not select OWASP guide for web assurance.

Question 660

An analyst detects a malicious scheduled task configured to run on every user sign-in. What is the MOST appropriate analyst action based on the evidence?

Separate tactic stages and associated techniques in the ATT&CK mapping.
Select ATT&CK credential-access techniques and their relevant data sources.
Evaluate actual behavior-based detections against the corresponding techniques.
Map the behavior to the relevant ATT&CK persistence technique rather than a specific actor.

Explanation

Correct Answer

ATT&CK describes adversary behaviors without proving group attribution. Map scheduled-task persistence to ATT&CK.

Incorrect Answers

A single intrusion can cross several tactics and require multiple evidence sources. That is relevant to mitre att&ck technique mapping, not to map scheduled-task persistence to ATT&CK.

Technique mapping directs hunts toward process and credential-access evidence. It would use ATT&CK to plan credential dumping detections, but it would not map scheduled-task persistence to ATT&CK.

One hash signature does not cover a technique class broadly. It could help assess ATT&CK coverage beyond file signatures, but it would not map scheduled-task persistence to ATT&CK.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 64 - 10 Questions (Last Reviewed 08-Nov-2026)
CompTIA CS0-003 Practice Test 65 - 10 Questions (Last Reviewed 07-Nov-2026)
CompTIA CS0-003 Practice Test 66 - 10 Questions (Last Reviewed 06-Nov-2026)
CompTIA CS0-003 Practice Test 67 - 10 Questions (Last Reviewed 05-Nov-2026)
CompTIA CS0-003 Practice Test 68 - 10 Questions (Last Reviewed 04-Nov-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 650

Explanation

Correct Answer

Incorrect Answers

Question 651

Explanation

Correct Answer

Incorrect Answers

Question 652

Explanation

Correct Answer

Incorrect Answers

Question 653

Explanation

Correct Answer

Incorrect Answers

Question 654

Explanation

Correct Answer

Incorrect Answers

Question 655

Explanation

Correct Answer

Incorrect Answers

Question 656

Explanation

Correct Answer

Incorrect Answers

Question 657

Explanation

Correct Answer

Incorrect Answers

Question 658

Explanation

Correct Answer

Incorrect Answers

Question 659

Explanation

Correct Answer

Incorrect Answers

Question 660

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests