CompTIA CS0-003 Practice Test 68

Question 670

A threat report provides a full kill-chain diagram even though only delivery and C2 were logged. What is the MOST appropriate analyst action based on the evidence?

Mark the escalation hypothesis unconfirmed and request additional host evidence.
Remove unsupported stages or label them as hypotheses, not observed facts.
Require reproducible control-specific testing records before acceptance.
Seek stronger identifiers before treating the events as related.

Explanation

Correct Answer

Attractive framework diagrams cannot replace proof of each stage. Avoid fabricating kill-chain phases.

Incorrect Answers

Framework mappings should carry evidence limitations. It would express uncertainty in privilege escalation mapping, but it would not avoid fabricating kill-chain phases.

Category labels are not proof of actual application security testing. That is relevant to modeling uncertainty in incident reports, not to avoid fabricating kill-chain phases.

Common generic accounts are weak linking evidence. It would challenge weak event correlation in Diamond Model, but it would not avoid fabricating kill-chain phases.

Question 671

A rebuilt endpoint is ready to return to service after malicious code removal. Which next step is MOST defensible for the security team?

Isolate the endpoint and preserve the EDR process and network timeline.
Quarantine related messages and search for recipients who opened the attachment.
Verify security baseline, patch state and clean authentication before reconnection.
Reset compromised credentials, revoke sessions and assess downstream access.

Explanation

Correct Answer

Recovery must ensure persistence and stolen credentials cannot reopen access. Validate recovered phishing endpoint.

Incorrect Answers

Confirmed suspicious execution plus C2 warrants containment and evidence preservation. It could help contain active phishing-driven host compromise, but it would not validate recovered phishing endpoint.

Removing the shared attack vector can prevent additional infections. That is relevant to phishing-triggered endpoint incident, not to validate recovered phishing endpoint.

Credential theft remains dangerous after a malicious webpage is closed. It could help respond to confirmed phished credentials, but it would not validate recovered phishing endpoint.

Question 672

An approved administration task fires unexpectedly after a configuration change. Which action BEST aligns with sound security operations?

Disable the unauthorized task and preserve its creator and executable evidence.
Compare task content, hash and deployment records before treating them as one campaign.
Search alternate persistence mechanisms and rebuild validated clean startup configuration.
Validate change authorization and execution logs rather than assuming maliciousness from timing.

Explanation

Correct Answer

Legitimate scheduled tasks can shift when configuration or time sources change. Distinguish changed admin schedule from attacker persistence.

Incorrect Answers

Recurring task execution can maintain attacker access. That is relevant to malicious scheduled task persistence, not to distinguish changed admin schedule from attacker persistence.

Generic task names do not uniquely identify malicious software. It would avoid misattribution by common task name, but it would not distinguish changed admin schedule from attacker persistence.

Removing one foothold does not guarantee eradication of others. It could help detect redundant persistence after task removal, but it would not distinguish changed admin schedule from attacker persistence.

Question 673

A task is deleted but the same payload launches after each reboot from a registry key. Which response BEST addresses the security problem described?

Search alternate persistence mechanisms and rebuild validated clean startup configuration.
Disable the unauthorized task and preserve its creator and executable evidence.
Validate change authorization and execution logs rather than assuming maliciousness from timing.
Compare task content, hash and deployment records before treating them as one campaign.

Explanation

Correct Answer

Removing one foothold does not guarantee eradication of others. Detect redundant persistence after task removal.

Incorrect Answers

Recurring task execution can maintain attacker access. It could help remove unauthorized scheduled-task persistence, but it would not detect redundant persistence after task removal.

Legitimate scheduled tasks can shift when configuration or time sources change. That is relevant to malicious scheduled task persistence, not to detect redundant persistence after task removal.

Generic task names do not uniquely identify malicious software. It would avoid misattribution by common task name, but it would not detect redundant persistence after task removal.

Question 674

An incident handler proposes scanning a vendor network without explicit permission. Which investigative or response action BEST fits the evidence?

Validate actual sessions and entitlement paths before broadening affected-account count.
Obtain authorized incident cooperation and scope rather than initiating unapproved probing.
Request available provider evidence using the contracted incident response channel.
Invoke contractual incident notification and restrict supplier access while assessing exposure.

Explanation

Correct Answer

Incident response does not grant unrestricted access to external networks. Respect third-party forensic scope.

Incorrect Answers

Exposure estimates must reflect confirmed evidence. It could help scope supplier account compromise accurately, but it would not respect third-party forensic scope.

Shared responsibility requires provider coordination for inaccessible telemetry. It would obtain provider-controlled cloud incident logs, but it would not respect third-party forensic scope.

Shared privileged connections require timely coordinated containment. It could help respond to third-party privileged access breach, but it would not respect third-party forensic scope.

Question 675

Multiple machines execute a remote WMI process from a single unauthorized source. What is the MOST appropriate analyst action based on the evidence?

Isolate the source and restrict abused credentials while collecting authentication history.
Rotate and restrict the service credential across all dependent hosts.
Identify originating identity and isolate affected endpoints before coordinated eradication.
Preserve ticket request evidence and investigate potential offline credential exposure.

Explanation

Correct Answer

Remote management execution can rapidly distribute payloads. Contain WMI-based lateral execution.

Incorrect Answers

Active privilege use across hosts requires immediate containment. That is relevant to credential-based lateral movement, not to contain WMI-based lateral execution.

Residual shared credentials can reopen lateral access after host cleanup. It would eradicate shared credential persistence, but it would not contain WMI-based lateral execution.

Ticket requests can indicate preparation without confirmed server compromise. That is relevant to credential-based lateral movement, not to contain WMI-based lateral execution.

Question 676

A legal hold covers mailbox records but routine retention would delete them next week. Which next step is MOST defensible for the security team?

Document transfer time, custodian, purpose and integrity hash immediately.
Reject the altered copy for conclusions and reacquire or verify original integrity.
Create a verified working copy and preserve the original unchanged.
Coordinate an authorized preservation hold on the scoped custodians and data.

Explanation

Correct Answer

Legal preservation overrides ordinary destruction for relevant material. Apply scoped legal hold to incident records.

Incorrect Answers

Evidence custody must remain accountable across handling events. It would repair missing forensic evidence handoff record, but it would not apply scoped legal hold to incident records.

Evidence mismatch undermines confidence in content preservation. It could help detect corrupted evidence transfer, but it would not apply scoped legal hold to incident records.

Analytical actions should not modify the primary evidence. That is relevant to chain of custody under incident response, not to apply scoped legal hold to incident records.

Question 677

Investigation shows one admin used their account normally before the anomalous logon. Which action BEST aligns with sound security operations?

Separate authorized historical actions from the compromise window using evidence.
Revoke or expire sessions and assess provider token invalidation controls.
Disable or restrict the account session and preserve associated sign-in and command logs.
Revoke malicious grants and review delegated service access.

Explanation

Correct Answer

Incident scope should not attribute all prior activity to the intruder. Bound privileged account compromise timeline.

Incorrect Answers

Password rotation does not necessarily terminate already-issued access tokens. That is relevant to privileged identity takeover, not to bound privileged account compromise timeline.

Active privileged misuse can rapidly expand impact. It would contain confirmed privileged session compromise, but it would not bound privileged account compromise timeline.

Application consent can preserve attacker reach beyond user password remediation. It could help eradicate persistent OAuth delegation, but it would not bound privileged account compromise timeline.

Question 678

After rollback, a CI pipeline still allows the same unapproved account to deploy. Which response BEST addresses the security problem described?

Preserve audit trails, revoke unsafe access and restore from trusted version control.
Revoke unauthorized deployment rights and enforce approved release gates.
Compare deployed state with signed build and control-plane audit records.
Preserve evidence and assess authorization and script behavior without prejudging intent.

Explanation

Correct Answer

Restoring configuration alone does not remove root access weakness. Fix CI deployment authorization after sabotage.

Incorrect Answers

Intentional integrity loss requires containment and reproducible recovery. That is relevant to insider sabotage and system integrity, not to fix CI deployment authorization after sabotage.

Production integrity requires checking actual runtime, not just repository state. It could help investigate out-of-band infrastructure modification, but it would not fix CI deployment authorization after sabotage.

Incident classification should distinguish impact and intent using evidence. That is relevant to insider sabotage and system integrity, not to fix CI deployment authorization after sabotage.

Question 679

An employee claims a destructive script was run accidentally during approved maintenance. Which investigative or response action BEST fits the evidence?

Compare deployed state with signed build and control-plane audit records.
Revoke unauthorized deployment rights and enforce approved release gates.
Preserve evidence and assess authorization and script behavior without prejudging intent.
Preserve audit trails, revoke unsafe access and restore from trusted version control.

Explanation

Correct Answer

Incident classification should distinguish impact and intent using evidence. Classify accidental destructive maintenance carefully.

Incorrect Answers

Production integrity requires checking actual runtime, not just repository state. It would investigate out-of-band infrastructure modification, but it would not classify accidental destructive maintenance carefully.

Restoring configuration alone does not remove root access weakness. It could help fix CI deployment authorization after sabotage, but it would not classify accidental destructive maintenance carefully.

Intentional integrity loss requires containment and reproducible recovery. It would contain insider infrastructure sabotage, but it would not classify accidental destructive maintenance carefully.

Question 680

A breach affects regulated records but the technical team plans customer statements without legal input. What is the MOST appropriate analyst action based on the evidence?

Declare appropriate coordinated response structure with accountable roles and handoffs.
Apply the defined incident severity and evidence criteria before major escalation.
Assign incident command and coordinate disruptive actions with service owners.
Escalate to designated legal and communications authorities before external notices.

Explanation

Correct Answer

Notification duties require accountable governance and accurate impact assessment. Route regulated incident disclosure to authorized leads.

Incorrect Answers

Clear leadership prevents duplicated or missed containment during expansion. It could help activate coordinated incident management for multi-region event, but it would not route regulated incident disclosure to authorized leads.

Consistent severity prevents overwhelming emergency response with unconfirmed exposure. That is relevant to incident commander and escalation decisions, not to route regulated incident disclosure to authorized leads.

Uncoordinated containment may amplify operational impact. It would coordinate incident response command, but it would not route regulated incident disclosure to authorized leads.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 66 - 10 Questions (Last Reviewed 06-Nov-2026)
CompTIA CS0-003 Practice Test 67 - 10 Questions (Last Reviewed 05-Nov-2026)
CompTIA CS0-003 Practice Test 68 - 10 Questions (Last Reviewed 04-Nov-2026)
CompTIA CS0-003 Practice Test 69 - 10 Questions (Last Reviewed 03-Nov-2026)
CompTIA CS0-003 Practice Test 70 - 10 Questions (Last Reviewed 02-Nov-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 670

Explanation

Correct Answer

Incorrect Answers

Question 671

Explanation

Correct Answer

Incorrect Answers

Question 672

Explanation

Correct Answer

Incorrect Answers

Question 673

Explanation

Correct Answer

Incorrect Answers

Question 674

Explanation

Correct Answer

Incorrect Answers

Question 675

Explanation

Correct Answer

Incorrect Answers

Question 676

Explanation

Correct Answer

Incorrect Answers

Question 677

Explanation

Correct Answer

Incorrect Answers

Question 678

Explanation

Correct Answer

Incorrect Answers

Question 679

Explanation

Correct Answer

Incorrect Answers

Question 680

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests