CompTIA CS0-003 Practice Test 74

Question 730

Object listing records show public requests but no successful content reads. What is the MOST appropriate analyst action based on the evidence?

Engage legal and privacy teams using precise affected object and access evidence.
Report confirmed exposure separately from unproven data exfiltration.
Revoke public access and preserve policy history and access logs.
Revoke applicable signed links and verify effective object access restrictions.

Explanation

Correct Answer

Listing alone does not prove records were downloaded. Distinguish cloud listing from data theft.

Incorrect Answers

Confirmed regulated data access may trigger notification obligations. It would escalate confirmed exposed regulated cloud data, but it would not distinguish cloud listing from data theft.

Misconfigured permissions require prompt containment plus exposure evidence. That is relevant to cloud object exposure incident, not to distinguish cloud listing from data theft.

Fixing bucket ACLs may not invalidate every preissued access mechanism. It would close residual storage signed URL exposure, but it would not distinguish cloud listing from data theft.

Question 731

A CDN absorbs most of the attack but direct origin IP remains reachable. Which next step is MOST defensible for the security team?

Activate approved edge rate limiting or upstream mitigation with service owners.
Compare service availability, malicious request rates and customer success metrics.
Restrict origin access to trusted edge infrastructure.
Evaluate legitimate customer impact and use traffic behavior controls instead.

Explanation

Correct Answer

Attackers can bypass CDN protection when origins remain directly exposed. Close DDoS origin bypass.

Incorrect Answers

Distributed attack traffic should be absorbed before exhausting application resources. It could help mitigate active API DDoS, but it would not close DDoS origin bypass.

Recovery decisions need actual service outcome evidence. That is relevant to ddos response coordination, not to close DDoS origin bypass.

Broad geographic blocking can cause unnecessary disruption. It could help avoid overbroad DDoS geographic containment, but it would not close DDoS origin bypass.

Question 732

A compromised cloud role has issued short-lived tokens that remain accepted after password rotation. Which action BEST aligns with sound security operations?

Disable or restrict the account session and preserve associated sign-in and command logs.
Revoke malicious grants and review delegated service access.
Separate authorized historical actions from the compromise window using evidence.
Revoke or expire sessions and assess provider token invalidation controls.

Explanation

Correct Answer

Password rotation does not necessarily terminate already-issued access tokens. Invalidate stolen cloud sessions.

Incorrect Answers

Active privileged misuse can rapidly expand impact. That is relevant to privileged identity takeover, not to invalidate stolen cloud sessions.

Application consent can preserve attacker reach beyond user password remediation. It would eradicate persistent OAuth delegation, but it would not invalidate stolen cloud sessions.

Incident scope should not attribute all prior activity to the intruder. It could help bound privileged account compromise timeline, but it would not invalidate stolen cloud sessions.

Question 733

Operations wants to restore control from backups with unknown configuration provenance. Which response BEST addresses the security problem described?

Validate known-good controller logic and authorized change records before upload.
Isolate workstation communications while preserving necessary plant safety monitoring.
Use vendor-approved passive evidence and controlled maintenance assessment.
Coordinate immediate safe-state and isolation decisions with OT engineering leadership.

Explanation

Correct Answer

Unverified restoration can reinstate malicious or unsafe commands. Verify OT control logic before recovery.

Incorrect Answers

Containment should separate compromised engineering access from control functions. It could help isolate infected engineering workstation, but it would not verify OT control logic before recovery.

Unvetted active scans can destabilize legacy industrial devices. That is relevant to ot incident containment, not to verify OT control logic before recovery.

Blindly powering down safety-critical equipment may create physical hazards. It would contain controller compromise with safety authority, but it would not verify OT control logic before recovery.

Question 734

A security team seeks public advice by uploading internal threat logs containing customer identifiers. Which investigative or response action BEST fits the evidence?

Apply scoped acquisition and controlled evidence storage with legal and privacy approval.
Sanitize or aggregate data before sharing on approved channels.
Minimize irrelevant material in the shared report while preserving authorized evidence.
Restrict access and redact unnecessary PII before broader technical sharing.

Explanation

Correct Answer

External disclosure can create a separate data exposure incident. Anonymize incident logs for public sharing.

Incorrect Answers

Response urgency does not remove handling and retention duties. It could help govern compromised mailbox collection, but it would not anonymize incident logs for public sharing.

Reporting should match the legitimate investigative purpose. It would exclude irrelevant private communication, but it would not anonymize incident logs for public sharing.

Malware analysis data can include sensitive real-user records. It could help protect payroll PII in incident artifact, but it would not anonymize incident logs for public sharing.

Question 735

One affected user entered their password into a lookalike sign-in portal. What is the MOST appropriate analyst action based on the evidence?

Verify security baseline, patch state and clean authentication before reconnection.
Isolate the endpoint and preserve the EDR process and network timeline.
Reset compromised credentials, revoke sessions and assess downstream access.
Quarantine related messages and search for recipients who opened the attachment.

Explanation

Correct Answer

Credential theft remains dangerous after a malicious webpage is closed. Respond to confirmed phished credentials.

Incorrect Answers

Recovery must ensure persistence and stolen credentials cannot reopen access. That is relevant to phishing-triggered endpoint incident, not to respond to confirmed phished credentials.

Confirmed suspicious execution plus C2 warrants containment and evidence preservation. It would contain active phishing-driven host compromise, but it would not respond to confirmed phished credentials.

Removing the shared attack vector can prevent additional infections. That is relevant to phishing-triggered endpoint incident, not to respond to confirmed phished credentials.

Question 736

An API receives repeated injection payloads and the WAF reports blocks without backend execution evidence. Which next step is MOST defensible for the security team?

Validate end-to-end object authorization under representative user roles.
Disable the affected route or restrict access while preserving tenant-specific audit records.
Reconcile successful object-read logs and impacted identifiers before estimating victims.
Analyze block logs and confirm no successful backend effect before incident declaration.

Explanation

Correct Answer

Observed attempts do not automatically establish server compromise. Distinguish blocked API exploit from successful execution.

Incorrect Answers

Security remediation needs effective deployed control verification. It would verify cross-tenant API fix in runtime, but it would not distinguish blocked API exploit from successful execution.

Confirmed broken authorization risks immediate data exposure. It could help contain cross-tenant API access breach, but it would not distinguish blocked API exploit from successful execution.

Notification scope must track confirmed data access rather than guess. That is relevant to application api attack response, not to distinguish blocked API exploit from successful execution.

Question 737

Version control still shows valid approved code but production changes came from an unknown emergency console. Which action BEST aligns with sound security operations?

Compare deployed state with signed build and control-plane audit records.
Preserve evidence and assess authorization and script behavior without prejudging intent.
Preserve audit trails, revoke unsafe access and restore from trusted version control.
Revoke unauthorized deployment rights and enforce approved release gates.

Explanation

Correct Answer

Production integrity requires checking actual runtime, not just repository state. Investigate out-of-band infrastructure modification.

Incorrect Answers

Incident classification should distinguish impact and intent using evidence. That is relevant to insider sabotage and system integrity, not to investigate out-of-band infrastructure modification.

Intentional integrity loss requires containment and reproducible recovery. It would contain insider infrastructure sabotage, but it would not investigate out-of-band infrastructure modification.

Restoring configuration alone does not remove root access weakness. It could help fix CI deployment authorization after sabotage, but it would not investigate out-of-band infrastructure modification.

Question 738

An affected pod ran on a shared node with additional tenants' workloads. Which response BEST addresses the security problem described?

Preserve available audit and control-plane evidence, then perform controlled remediation.
Scope node-level privilege exposure and inspect neighboring workloads for impact.
Rotate compromised secrets and narrow the replacement workload's access.
Revoke the abused token and isolate affected workloads while preserving API audit evidence.

Explanation

Correct Answer

Privileged container execution can cross isolation boundaries. Assess node-wide Kubernetes impact.

Incorrect Answers

Premature deletion may destroy evidence needed to understand control-plane abuse. That is relevant to kubernetes cluster compromise, not to assess node-wide Kubernetes impact.

Image rebuild does not revoke exposed cluster credentials. It could help eradicate compromised Kubernetes secret, but it would not assess node-wide Kubernetes impact.

Cluster control-plane credentials can extend compromise beyond one container. That is relevant to kubernetes cluster compromise, not to assess node-wide Kubernetes impact.

Question 739

Several destination IPs are shared cloud addresses with ambiguous ownership. Which investigative or response action BEST fits the evidence?

Hunt related indicators and TTPs across relevant endpoints while retaining confidence boundaries.
Continue locally grounded containment with available telemetry and document enrichment gaps.
Use process, URL and certificate context before blocking or attributing a campaign.
Hunt behavioral persistence patterns to find related cases beyond hashes.

Explanation

Correct Answer

Shared infrastructure can produce misleading associations. Avoid indiscriminate cloud IP threat blocking.

Incorrect Answers

IOC matches can guide broader scoping without proving every host is infected. It would expand incident scope through corroborated intelligence, but it would not avoid indiscriminate cloud IP threat blocking.

Response should not stall solely because an external context service fails. It could help maintain incident response without threat feed, but it would not avoid indiscriminate cloud IP threat blocking.

TTP-based scoping can detect variants missed by exact signatures. It would scope malware variants through behavior, but it would not avoid indiscriminate cloud IP threat blocking.

Question 740

A firewall records an outbound transfer but proxy logs have a missing ten-minute window. What is the MOST appropriate analyst action based on the evidence?

Distinguish attempted authentication, accepted sessions and observed execution by host.
Label competing hypotheses and prioritize collection of earliest reliable evidence.
Normalize event timestamps and account for host clock drift before timeline sequencing.
Preserve the gap and corroborate with endpoint and NetFlow counters.

Explanation

Correct Answer

Missing data should be explicitly bounded instead of filled with assumptions. Handle forensic timeline visibility gap.

Incorrect Answers

Scope estimates should reflect confirmed stages rather than one aggregated count. It could help classify attempted versus executed lateral access, but it would not handle forensic timeline visibility gap.

An unproven initial access story must not be promoted to fact. That is relevant to timeline and scope reconstruction, not to handle forensic timeline visibility gap.

Inconsistent time bases can reverse apparent attack order. It would reconstruct accurate cross-sensor incident timeline, but it would not handle forensic timeline visibility gap.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 72 - 10 Questions (Last Reviewed 31-Oct-2026)
CompTIA CS0-003 Practice Test 73 - 10 Questions (Last Reviewed 30-Oct-2026)
CompTIA CS0-003 Practice Test 74 - 10 Questions (Last Reviewed 29-Oct-2026)
CompTIA CS0-003 Practice Test 75 - 10 Questions (Last Reviewed 28-Oct-2026)
CompTIA CS0-003 Practice Test 76 - 10 Questions (Last Reviewed 27-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 730

Explanation

Correct Answer

Incorrect Answers

Question 731

Explanation

Correct Answer

Incorrect Answers

Question 732

Explanation

Correct Answer

Incorrect Answers

Question 733

Explanation

Correct Answer

Incorrect Answers

Question 734

Explanation

Correct Answer

Incorrect Answers

Question 735

Explanation

Correct Answer

Incorrect Answers

Question 736

Explanation

Correct Answer

Incorrect Answers

Question 737

Explanation

Correct Answer

Incorrect Answers

Question 738

Explanation

Correct Answer

Incorrect Answers

Question 739

Explanation

Correct Answer

Incorrect Answers

Question 740

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests