CompTIA CS0-003 Practice Test 71

Question 700

A suspicious process is running on an encrypted laptop scheduled for shutdown. What is the MOST appropriate analyst action based on the evidence?

Apply approved secure transfer, limited access and confidentiality handling.
Coordinate a minimally disruptive approved acquisition with integrity verification.
Reacquire and verify from trusted source rather than use an inconsistent image.
Collect authorized volatile evidence and recovery-key information before power loss.

Explanation

Correct Answer

Shutdown can lose memory-only evidence and complicate encrypted storage access. Preserve live evidence before laptop shutdown.

Incorrect Answers

Memory captures can contain credentials and sensitive business information. It would govern external sharing of volatile evidence, but it would not preserve live evidence before laptop shutdown.

Evidence collection must preserve availability and chain of custody. It could help acquire disk evidence from critical server safely, but it would not preserve live evidence before laptop shutdown.

Source/destination hash mismatch undermines forensic reliability. That is relevant to endpoint evidence acquisition order, not to preserve live evidence before laptop shutdown.

Question 701

EDR observes process injection but disk scans find no malicious executable. Which next step is MOST defensible for the security team?

Acquire authorized volatile evidence and process memory before reboot.
Analyze process structures and correlate with retained EDR event telemetry.
Limit access to the evidence and initiate necessary credential protection.
Investigate stolen tokens and external persistence instead of trusting clean disk results.

Explanation

Correct Answer

Memory-resident payload evidence can disappear during restart. Preserve volatile fileless malware evidence.

Incorrect Answers

Memory structures require external timeline corroboration for reliable parent-child relationships. That is relevant to memory-only malicious activity, not to preserve volatile fileless malware evidence.

Volatile forensics can contain reusable sensitive secrets. It would protect credentials found in memory evidence, but it would not preserve volatile fileless malware evidence.

Reboot clears memory code but does not remove identity-based footholds. It could help investigate recurrent compromise after reboot, but it would not preserve volatile fileless malware evidence.

Question 702

An endpoint is reimaged from a baseline whose installer includes a vulnerable remote agent. Which action BEST aligns with sound security operations?

Validate data consistency against trusted recovery points and business reconciliation checks.
Update the approved baseline image before large-scale restoration.
Review and remove unauthorized persistence before declaring clean recovery.
Restore protective controls and verify telemetry before production return.

Explanation

Correct Answer

Recovery from unsafe images can immediately recreate exposure. Avoid restoring compromised baseline weaknesses.

Incorrect Answers

Recovered systems can operate on corrupted or incomplete records. That is relevant to malware eradication and recovery validation, not to avoid restoring compromised baseline weaknesses.

Absence of alerts does not prove eradication of dormant launch paths. It could help verify persistence removed before reconnection, but it would not avoid restoring compromised baseline weaknesses.

Service availability alone is not secure recovery. That is relevant to malware eradication and recovery validation, not to avoid restoring compromised baseline weaknesses.

Question 703

After a worm cleanup, hosts still run an outdated vulnerable service version. Which response BEST addresses the security problem described?

Apply risk-based temporary controls and coordinate critical service dependencies.
Segment infected subnets and restrict lateral SMB paths immediately.
Patch or disable the exploited service across all impacted systems before reconnecting.
Verify current sensor data or inspect the host in authorized isolation.

Explanation

Correct Answer

Eradication requires closing the exploit route that enabled propagation. Close SMB worm propagation vulnerability.

Incorrect Answers

Containment should limit spread without avoidable enterprise-wide outage. It would avoid indiscriminate file-share shutdown, but it would not close SMB worm propagation vulnerability.

Network containment limits autonomous worm spread. It could help contain self-propagating SMB malware, but it would not close SMB worm propagation vulnerability.

Stale last-seen evidence cannot prove malware absence. It would validate unobserved endpoint after worm event, but it would not close SMB worm propagation vulnerability.

Question 704

A managed service provider detects compromise of its access to customer systems but delays notification. Which investigative or response action BEST fits the evidence?

Request available provider evidence using the contracted incident response channel.
Obtain authorized incident cooperation and scope rather than initiating unapproved probing.
Validate actual sessions and entitlement paths before broadening affected-account count.
Invoke contractual incident notification and restrict supplier access while assessing exposure.

Explanation

Correct Answer

Shared privileged connections require timely coordinated containment. Respond to third-party privileged access breach.

Incorrect Answers

Shared responsibility requires provider coordination for inaccessible telemetry. It could help obtain provider-controlled cloud incident logs, but it would not respond to third-party privileged access breach.

Incident response does not grant unrestricted access to external networks. That is relevant to third-party response and coordination, not to respond to third-party privileged access breach.

Exposure estimates must reflect confirmed evidence. It would scope supplier account compromise accurately, but it would not respond to third-party privileged access breach.

Question 705

A campaign's hashes change but scheduled-task behavior recurs across affected machines. What is the MOST appropriate analyst action based on the evidence?

Hunt behavioral persistence patterns to find related cases beyond hashes.
Use process, URL and certificate context before blocking or attributing a campaign.
Continue locally grounded containment with available telemetry and document enrichment gaps.
Hunt related indicators and TTPs across relevant endpoints while retaining confidence boundaries.

Explanation

Correct Answer

TTP-based scoping can detect variants missed by exact signatures. Scope malware variants through behavior.

Incorrect Answers

Shared infrastructure can produce misleading associations. It would avoid indiscriminate cloud IP threat blocking, but it would not scope malware variants through behavior.

Response should not stall solely because an external context service fails. It could help maintain incident response without threat feed, but it would not scope malware variants through behavior.

IOC matches can guide broader scoping without proving every host is infected. That is relevant to threat-intelligence-informed incident scope, not to scope malware variants through behavior.

Question 706

A vendor confirms one affected account but the customer assumes all external support identities were breached. Which next step is MOST defensible for the security team?

Invoke contractual incident notification and restrict supplier access while assessing exposure.
Validate actual sessions and entitlement paths before broadening affected-account count.
Request available provider evidence using the contracted incident response channel.
Obtain authorized incident cooperation and scope rather than initiating unapproved probing.

Explanation

Correct Answer

Exposure estimates must reflect confirmed evidence. Scope supplier account compromise accurately.

Incorrect Answers

Shared privileged connections require timely coordinated containment. It would respond to third-party privileged access breach, but it would not scope supplier account compromise accurately.

Shared responsibility requires provider coordination for inaccessible telemetry. That is relevant to third-party response and coordination, not to scope supplier account compromise accurately.

Incident response does not grant unrestricted access to external networks. It would respect third-party forensic scope, but it would not scope supplier account compromise accurately.

Question 707

A breach report includes customer records from one tenant but claims all tenants were accessed. Which action BEST aligns with sound security operations?

Disable the affected route or restrict access while preserving tenant-specific audit records.
Analyze block logs and confirm no successful backend effect before incident declaration.
Reconcile successful object-read logs and impacted identifiers before estimating victims.
Validate end-to-end object authorization under representative user roles.

Explanation

Correct Answer

Notification scope must track confirmed data access rather than guess. Quantify affected API tenants accurately.

Incorrect Answers

Confirmed broken authorization risks immediate data exposure. It could help contain cross-tenant API access breach, but it would not quantify affected API tenants accurately.

Observed attempts do not automatically establish server compromise. That is relevant to application api attack response, not to quantify affected API tenants accurately.

Security remediation needs effective deployed control verification. It could help verify cross-tenant API fix in runtime, but it would not quantify affected API tenants accurately.

Question 708

An application depends on the compromised key for a payment integration. Which response BEST addresses the security problem described?

Disable the leaked key and preserve cloud audit evidence of its use.
Restrict replacement service policy and monitor for similar exposure in the build process.
Distinguish enumeration from successful retrieval using API outcomes and byte counts.
Coordinate an approved replacement identity and secret rotation before removing emergency controls.

Explanation

Correct Answer

Business continuity must be protected without keeping stolen credentials active. Rotate compromised integration secret safely.

Incorrect Answers

Public credential disclosure plus misuse warrants prompt containment. That is relevant to cloud access-key exposure, not to rotate compromised integration secret safely.

Correcting entitlement and secret handling reduces repeat compromise likelihood. It would harden cloud key after containment, but it would not rotate compromised integration secret safely.

Evidence does not justify claiming data exfiltration when reads failed. It could help scope cloud key misuse based on API results, but it would not rotate compromised integration secret safely.

Question 709

The team's intelligence feed is unavailable during a live incident. Which investigative or response action BEST fits the evidence?

Continue locally grounded containment with available telemetry and document enrichment gaps.
Use process, URL and certificate context before blocking or attributing a campaign.
Hunt related indicators and TTPs across relevant endpoints while retaining confidence boundaries.
Hunt behavioral persistence patterns to find related cases beyond hashes.

Explanation

Correct Answer

Response should not stall solely because an external context service fails. Maintain incident response without threat feed.

Incorrect Answers

Shared infrastructure can produce misleading associations. It could help avoid indiscriminate cloud IP threat blocking, but it would not maintain incident response without threat feed.

IOC matches can guide broader scoping without proving every host is infected. That is relevant to threat-intelligence-informed incident scope, not to maintain incident response without threat feed.

TTP-based scoping can detect variants missed by exact signatures. It would scope malware variants through behavior, but it would not maintain incident response without threat feed.

Question 710

A security engineer wants to email raw memory dumps to an outside consultant. What is the MOST appropriate analyst action based on the evidence?

Reacquire and verify from trusted source rather than use an inconsistent image.
Apply approved secure transfer, limited access and confidentiality handling.
Coordinate a minimally disruptive approved acquisition with integrity verification.
Collect authorized volatile evidence and recovery-key information before power loss.

Explanation

Correct Answer

Memory captures can contain credentials and sensitive business information. Govern external sharing of volatile evidence.

Incorrect Answers

Source/destination hash mismatch undermines forensic reliability. It could help resolve forensic disk hash mismatch, but it would not govern external sharing of volatile evidence.

Evidence collection must preserve availability and chain of custody. It would acquire disk evidence from critical server safely, but it would not govern external sharing of volatile evidence.

Shutdown can lose memory-only evidence and complicate encrypted storage access. It could help preserve live evidence before laptop shutdown, but it would not govern external sharing of volatile evidence.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 69 - 10 Questions (Last Reviewed 03-Nov-2026)
CompTIA CS0-003 Practice Test 70 - 10 Questions (Last Reviewed 02-Nov-2026)
CompTIA CS0-003 Practice Test 71 - 10 Questions (Last Reviewed 01-Nov-2026)
CompTIA CS0-003 Practice Test 72 - 10 Questions (Last Reviewed 31-Oct-2026)
CompTIA CS0-003 Practice Test 73 - 10 Questions (Last Reviewed 30-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 700

Explanation

Correct Answer

Incorrect Answers

Question 701

Explanation

Correct Answer

Incorrect Answers

Question 702

Explanation

Correct Answer

Incorrect Answers

Question 703

Explanation

Correct Answer

Incorrect Answers

Question 704

Explanation

Correct Answer

Incorrect Answers

Question 705

Explanation

Correct Answer

Incorrect Answers

Question 706

Explanation

Correct Answer

Incorrect Answers

Question 707

Explanation

Correct Answer

Incorrect Answers

Question 708

Explanation

Correct Answer

Incorrect Answers

Question 709

Explanation

Correct Answer

Incorrect Answers

Question 710

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests