CompTIA CS0-003 Practice Test 69

Question 680

A breach affects regulated records but the technical team plans customer statements without legal input. What is the MOST appropriate analyst action based on the evidence?

Declare appropriate coordinated response structure with accountable roles and handoffs.
Apply the defined incident severity and evidence criteria before major escalation.
Assign incident command and coordinate disruptive actions with service owners.
Escalate to designated legal and communications authorities before external notices.

Explanation

Correct Answer

Notification duties require accountable governance and accurate impact assessment. Route regulated incident disclosure to authorized leads.

Incorrect Answers

Clear leadership prevents duplicated or missed containment during expansion. It could help activate coordinated incident management for multi-region event, but it would not route regulated incident disclosure to authorized leads.

Consistent severity prevents overwhelming emergency response with unconfirmed exposure. That is relevant to incident commander and escalation decisions, not to route regulated incident disclosure to authorized leads.

Uncoordinated containment may amplify operational impact. It would coordinate incident response command, but it would not route regulated incident disclosure to authorized leads.

Question 681

A developer with deploy access deletes production infrastructure-as-code templates after a dispute. Which next step is MOST defensible for the security team?

Preserve audit trails, revoke unsafe access and restore from trusted version control.
Compare deployed state with signed build and control-plane audit records.
Preserve evidence and assess authorization and script behavior without prejudging intent.
Revoke unauthorized deployment rights and enforce approved release gates.

Explanation

Correct Answer

Intentional integrity loss requires containment and reproducible recovery. Contain insider infrastructure sabotage.

Incorrect Answers

Production integrity requires checking actual runtime, not just repository state. It would investigate out-of-band infrastructure modification, but it would not contain insider infrastructure sabotage.

Incident classification should distinguish impact and intent using evidence. It could help classify accidental destructive maintenance carefully, but it would not contain insider infrastructure sabotage.

Restoring configuration alone does not remove root access weakness. That is relevant to insider sabotage and system integrity, not to contain insider infrastructure sabotage.

Question 682

Audit logs show unauthorized creation of privileged pods using a stolen service-account token. Which action BEST aligns with sound security operations?

Scope node-level privilege exposure and inspect neighboring workloads for impact.
Revoke the abused token and isolate affected workloads while preserving API audit evidence.
Rotate compromised secrets and narrow the replacement workload's access.
Preserve available audit and control-plane evidence, then perform controlled remediation.

Explanation

Correct Answer

Cluster control-plane credentials can extend compromise beyond one container. Contain stolen Kubernetes service account.

Incorrect Answers

Privileged container execution can cross isolation boundaries. It would assess node-wide Kubernetes impact, but it would not contain stolen Kubernetes service account.

Image rebuild does not revoke exposed cluster credentials. That is relevant to kubernetes cluster compromise, not to contain stolen Kubernetes service account.

Premature deletion may destroy evidence needed to understand control-plane abuse. It would retain Kubernetes evidence before rebuild, but it would not contain stolen Kubernetes service account.

Question 683

An engineering workstation used for controller programming is infected with malware. Which response BEST addresses the security problem described?

Use vendor-approved passive evidence and controlled maintenance assessment.
Validate known-good controller logic and authorized change records before upload.
Isolate workstation communications while preserving necessary plant safety monitoring.
Coordinate immediate safe-state and isolation decisions with OT engineering leadership.

Explanation

Correct Answer

Containment should separate compromised engineering access from control functions. Isolate infected engineering workstation.

Incorrect Answers

Unvetted active scans can destabilize legacy industrial devices. It could help collect OT evidence without disruptive probing, but it would not isolate infected engineering workstation.

Unverified restoration can reinstate malicious or unsafe commands. That is relevant to ot incident containment, not to isolate infected engineering workstation.

Blindly powering down safety-critical equipment may create physical hazards. It could help contain controller compromise with safety authority, but it would not isolate infected engineering workstation.

Question 684

An investigator only has a RAM image and wants process ancestry before host shutdown. Which investigative or response action BEST fits the evidence?

Acquire authorized volatile evidence and process memory before reboot.
Investigate stolen tokens and external persistence instead of trusting clean disk results.
Limit access to the evidence and initiate necessary credential protection.
Analyze process structures and correlate with retained EDR event telemetry.

Explanation

Correct Answer

Memory structures require external timeline corroboration for reliable parent-child relationships. Reconstruct fileless execution from memory.

Incorrect Answers

Memory-resident payload evidence can disappear during restart. That is relevant to memory-only malicious activity, not to reconstruct fileless execution from memory.

Reboot clears memory code but does not remove identity-based footholds. It would investigate recurrent compromise after reboot, but it would not reconstruct fileless execution from memory.

Volatile forensics can contain reusable sensitive secrets. It could help protect credentials found in memory evidence, but it would not reconstruct fileless execution from memory.

Question 685

After permissions are fixed, a stale signed URL may still allow cached downloads. What is the MOST appropriate analyst action based on the evidence?

Revoke applicable signed links and verify effective object access restrictions.
Revoke public access and preserve policy history and access logs.
Engage legal and privacy teams using precise affected object and access evidence.
Report confirmed exposure separately from unproven data exfiltration.

Explanation

Correct Answer

Fixing bucket ACLs may not invalidate every preissued access mechanism. Close residual storage signed URL exposure.

Incorrect Answers

Misconfigured permissions require prompt containment plus exposure evidence. It could help contain temporary public cloud storage leak, but it would not close residual storage signed URL exposure.

Confirmed regulated data access may trigger notification obligations. That is relevant to cloud object exposure incident, not to close residual storage signed URL exposure.

Listing alone does not prove records were downloaded. It would distinguish cloud listing from data theft, but it would not close residual storage signed URL exposure.

Question 686

Unaffected endpoints have pending auto-update downloads of the compromised package. Which next step is MOST defensible for the security team?

Pause update distribution and scope installed versions using signed package and EDR evidence.
Revoke deployment approvals and block the identified package/version.
Rotate updater credentials and verify release infrastructure integrity.
Preserve signed binaries and reconcile build provenance with the vendor's trusted statement.

Explanation

Correct Answer

Preventing pending installations limits future spread. Stop pending compromised supplier software install.

Incorrect Answers

Trusted distribution paths can propagate compromised build artifacts. It could help contain malicious supplier update rollout, but it would not stop pending compromised supplier software install.

Supply-chain incidents can recur if the distribution authority stays compromised. It would eradicate supplier release credential persistence, but it would not stop pending compromised supplier software install.

Signature validity does not guarantee a build pipeline was uncompromised. It could help investigate suspicious signed supplier artifact, but it would not stop pending compromised supplier software install.

Question 687

A compromised workstation authenticates to domain controllers using an unexpected privileged service identity. Which action BEST aligns with sound security operations?

Identify originating identity and isolate affected endpoints before coordinated eradication.
Rotate and restrict the service credential across all dependent hosts.
Isolate the source and restrict abused credentials while collecting authentication history.
Preserve ticket request evidence and investigate potential offline credential exposure.

Explanation

Correct Answer

Active privilege use across hosts requires immediate containment. Contain credential-driven lateral spread.

Incorrect Answers

Remote management execution can rapidly distribute payloads. That is relevant to credential-based lateral movement, not to contain credential-driven lateral spread.

Residual shared credentials can reopen lateral access after host cleanup. It would eradicate shared credential persistence, but it would not contain credential-driven lateral spread.

Ticket requests can indicate preparation without confirmed server compromise. That is relevant to credential-based lateral movement, not to contain credential-driven lateral spread.

Question 688

An analyst wants to work directly on the write-protected evidence master to save time. Which response BEST addresses the security problem described?

Document transfer time, custodian, purpose and integrity hash immediately.
Reject the altered copy for conclusions and reacquire or verify original integrity.
Coordinate an authorized preservation hold on the scoped custodians and data.
Create a verified working copy and preserve the original unchanged.

Explanation

Correct Answer

Analytical actions should not modify the primary evidence. Preserve original disk image integrity.

Incorrect Answers

Evidence custody must remain accountable across handling events. It would repair missing forensic evidence handoff record, but it would not preserve original disk image integrity.

Evidence mismatch undermines confidence in content preservation. It could help detect corrupted evidence transfer, but it would not preserve original disk image integrity.

Legal preservation overrides ordinary destruction for relevant material. That is relevant to chain of custody under incident response, not to preserve original disk image integrity.

Question 689

A storage policy change makes private financial reports anonymously readable for two hours. Which investigative or response action BEST fits the evidence?

Revoke public access and preserve policy history and access logs.
Revoke applicable signed links and verify effective object access restrictions.
Report confirmed exposure separately from unproven data exfiltration.
Engage legal and privacy teams using precise affected object and access evidence.

Explanation

Correct Answer

Misconfigured permissions require prompt containment plus exposure evidence. Contain temporary public cloud storage leak.

Incorrect Answers

Fixing bucket ACLs may not invalidate every preissued access mechanism. That is relevant to cloud object exposure incident, not to contain temporary public cloud storage leak.

Listing alone does not prove records were downloaded. It would distinguish cloud listing from data theft, but it would not contain temporary public cloud storage leak.

Confirmed regulated data access may trigger notification obligations. It could help escalate confirmed exposed regulated cloud data, but it would not contain temporary public cloud storage leak.

Question 690

Vendor signatures validate correctly but package hashes differ from expected approved release artifacts. What is the MOST appropriate analyst action based on the evidence?

Revoke deployment approvals and block the identified package/version.
Preserve signed binaries and reconcile build provenance with the vendor's trusted statement.
Pause update distribution and scope installed versions using signed package and EDR evidence.
Rotate updater credentials and verify release infrastructure integrity.

Explanation

Correct Answer

Signature validity does not guarantee a build pipeline was uncompromised. Investigate suspicious signed supplier artifact.

Incorrect Answers

Preventing pending installations limits future spread. That is relevant to supply-chain malware incident, not to investigate suspicious signed supplier artifact.

Trusted distribution paths can propagate compromised build artifacts. It could help contain malicious supplier update rollout, but it would not investigate suspicious signed supplier artifact.

Supply-chain incidents can recur if the distribution authority stays compromised. That is relevant to supply-chain malware incident, not to investigate suspicious signed supplier artifact.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 67 - 10 Questions (Last Reviewed 05-Nov-2026)
CompTIA CS0-003 Practice Test 68 - 10 Questions (Last Reviewed 04-Nov-2026)
CompTIA CS0-003 Practice Test 69 - 10 Questions (Last Reviewed 03-Nov-2026)
CompTIA CS0-003 Practice Test 70 - 10 Questions (Last Reviewed 02-Nov-2026)
CompTIA CS0-003 Practice Test 71 - 10 Questions (Last Reviewed 01-Nov-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 680

Explanation

Correct Answer

Incorrect Answers

Question 681

Explanation

Correct Answer

Incorrect Answers

Question 682

Explanation

Correct Answer

Incorrect Answers

Question 683

Explanation

Correct Answer

Incorrect Answers

Question 684

Explanation

Correct Answer

Incorrect Answers

Question 685

Explanation

Correct Answer

Incorrect Answers

Question 686

Explanation

Correct Answer

Incorrect Answers

Question 687

Explanation

Correct Answer

Incorrect Answers

Question 688

Explanation

Correct Answer

Incorrect Answers

Question 689

Explanation

Correct Answer

Incorrect Answers

Question 690

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests