CompTIA CS0-003 Practice Test 77

Question 760

A container is rebuilt but its mounted secret remained readable to the attacker. What is the MOST appropriate analyst action based on the evidence?

Scope node-level privilege exposure and inspect neighboring workloads for impact.
Preserve available audit and control-plane evidence, then perform controlled remediation.
Revoke the abused token and isolate affected workloads while preserving API audit evidence.
Rotate compromised secrets and narrow the replacement workload's access.

Explanation

Correct Answer

Image rebuild does not revoke exposed cluster credentials. Eradicate compromised Kubernetes secret.

Incorrect Answers

Privileged container execution can cross isolation boundaries. It would assess node-wide Kubernetes impact, but it would not eradicate compromised Kubernetes secret.

Premature deletion may destroy evidence needed to understand control-plane abuse. It could help retain Kubernetes evidence before rebuild, but it would not eradicate compromised Kubernetes secret.

Cluster control-plane credentials can extend compromise beyond one container. That is relevant to kubernetes cluster compromise, not to eradicate compromised Kubernetes secret.

Question 761

The incident team's recovery checklist has no test for restored customer data integrity. Which next step is MOST defensible for the security team?

Validate data consistency against trusted recovery points and business reconciliation checks.
Restore protective controls and verify telemetry before production return.
Update the approved baseline image before large-scale restoration.
Review and remove unauthorized persistence before declaring clean recovery.

Explanation

Correct Answer

Recovered systems can operate on corrupted or incomplete records. Verify data integrity during incident recovery.

Incorrect Answers

Service availability alone is not secure recovery. That is relevant to malware eradication and recovery validation, not to verify data integrity during incident recovery.

Recovery from unsafe images can immediately recreate exposure. It would avoid restoring compromised baseline weaknesses, but it would not verify data integrity during incident recovery.

Absence of alerts does not prove eradication of dormant launch paths. It could help verify persistence removed before reconnection, but it would not verify data integrity during incident recovery.

Question 762

A malware incident is declared eradicated after AV scan but user tokens were never revoked. Which action BEST aligns with sound security operations?

Verify actual endpoint network state and record the action acknowledgment.
Validate credentials, sessions and persistence removal before closure.
Attach source event references and distinguish observations from analyst hypotheses.
Hold closure and correct data-integrity issues with business stakeholders.

Explanation

Correct Answer

Malware cleanup is incomplete if identity footholds remain. Check identity persistence before closing malware case.

Incorrect Answers

Asynchronous response requests do not establish completed containment. Malware cleanup is incomplete if identity footholds remain.

Defensible incident closure needs traceable supporting artifacts. It could help improve evidence-backed incident closeout, but it would not check identity persistence before closing malware case.

Technical uptime does not prove business recovery. Malware cleanup is incomplete if identity footholds remain.

Question 763

A plant controller shows unexpected logic changes while a production line is still operating. Which response BEST addresses the security problem described?

Use vendor-approved passive evidence and controlled maintenance assessment.
Isolate workstation communications while preserving necessary plant safety monitoring.
Coordinate immediate safe-state and isolation decisions with OT engineering leadership.
Validate known-good controller logic and authorized change records before upload.

Explanation

Correct Answer

Blindly powering down safety-critical equipment may create physical hazards. Contain controller compromise with safety authority.

Incorrect Answers

Unvetted active scans can destabilize legacy industrial devices. It would collect OT evidence without disruptive probing, but it would not contain controller compromise with safety authority.

Containment should separate compromised engineering access from control functions. It could help isolate infected engineering workstation, but it would not contain controller compromise with safety authority.

Unverified restoration can reinstate malicious or unsafe commands. It would verify OT control logic before recovery, but it would not contain controller compromise with safety authority.

Question 764

Security asks to block all TXT queries globally to stop one suspected tunnel. Which investigative or response action BEST fits the evidence?

Correlate resolver client logs with endpoint telemetry before naming source machines.
Hunt for related process behavior and additional generated destinations.
Isolate suspicious egress and preserve DNS and process telemetry.
Apply scoped domain controls and monitor required legitimate TXT use.

Explanation

Correct Answer

Broad DNS record-type bans can break validation and service discovery. Limit DNS-tunnel containment scope.

Incorrect Answers

Upstream IPs may identify a resolver rather than an infected endpoint. It could help attribute DNS tunneling to originating host, but it would not limit DNS-tunnel containment scope.

Blocking one domain may not stop an adaptive rendezvous mechanism. That is relevant to malicious dns command-and-control, not to limit DNS-tunnel containment scope.

DNS tunneling can carry data or commands via normal resolver paths. It would contain suspected DNS tunneling, but it would not limit DNS-tunnel containment scope.

Question 765

An infected host's last-seen scan is old and a responder assumes it is clean. What is the MOST appropriate analyst action based on the evidence?

Verify current sensor data or inspect the host in authorized isolation.
Apply risk-based temporary controls and coordinate critical service dependencies.
Segment infected subnets and restrict lateral SMB paths immediately.
Patch or disable the exploited service across all impacted systems before reconnecting.

Explanation

Correct Answer

Stale last-seen evidence cannot prove malware absence. Validate unobserved endpoint after worm event.

Incorrect Answers

Containment should limit spread without avoidable enterprise-wide outage. It would avoid indiscriminate file-share shutdown, but it would not validate unobserved endpoint after worm event.

Network containment limits autonomous worm spread. It could help contain self-propagating SMB malware, but it would not validate unobserved endpoint after worm event.

Eradication requires closing the exploit route that enabled propagation. That is relevant to worm propagation over file shares, not to validate unobserved endpoint after worm event.

Question 766

A host has no current malware alerts but unknown startup registry entries persist. Which next step is MOST defensible for the security team?

Restore protective controls and verify telemetry before production return.
Review and remove unauthorized persistence before declaring clean recovery.
Validate data consistency against trusted recovery points and business reconciliation checks.
Update the approved baseline image before large-scale restoration.

Explanation

Correct Answer

Absence of alerts does not prove eradication of dormant launch paths. Verify persistence removed before reconnection.

Incorrect Answers

Service availability alone is not secure recovery. It would validate security telemetry after restoration, but it would not verify persistence removed before reconnection.

Recovered systems can operate on corrupted or incomplete records. That is relevant to malware eradication and recovery validation, not to verify persistence removed before reconnection.

Recovery from unsafe images can immediately recreate exposure. It would avoid restoring compromised baseline weaknesses, but it would not verify persistence removed before reconnection.

Question 767

A web server starts launching shell commands after requests to a newly uploaded PHP file. Which action BEST aligns with sound security operations?

Hunt for shared accounts, SSH keys and lateral network sessions from the compromised host.
Preserve logs and search file changes and process descendants for persistence.
Isolate the affected application host and preserve request and process evidence.
Remove attacker persistence and verify unauthorized tasks before restoring service.

Explanation

Correct Answer

Web process shell execution indicates likely server compromise. Contain suspected active web shell.

Incorrect Answers

Web-server footholds can be used as pivots to other infrastructure. It could help scope lateral movement from web shell, but it would not contain suspected active web shell.

Removing one script may not eliminate additional footholds. That is relevant to web shell on application server, not to contain suspected active web shell.

Fixing the entry vulnerability does not automatically eradicate attacker code. It could help eradicate post-exploit web-shell persistence, but it would not contain suspected active web shell.

Question 768

A malware-free scan follows reboot but suspicious remote sessions resume immediately. Which response BEST addresses the security problem described?

Limit access to the evidence and initiate necessary credential protection.
Analyze process structures and correlate with retained EDR event telemetry.
Acquire authorized volatile evidence and process memory before reboot.
Investigate stolen tokens and external persistence instead of trusting clean disk results.

Explanation

Correct Answer

Reboot clears memory code but does not remove identity-based footholds. Investigate recurrent compromise after reboot.

Incorrect Answers

Volatile forensics can contain reusable sensitive secrets. That is relevant to memory-only malicious activity, not to investigate recurrent compromise after reboot.

Memory structures require external timeline corroboration for reliable parent-child relationships. It would reconstruct fileless execution from memory, but it would not investigate recurrent compromise after reboot.

Memory-resident payload evidence can disappear during restart. It could help preserve volatile fileless malware evidence, but it would not investigate recurrent compromise after reboot.

Question 769

An external account successfully downloaded regulated files during the exposure window. Which investigative or response action BEST fits the evidence?

Engage legal and privacy teams using precise affected object and access evidence.
Revoke applicable signed links and verify effective object access restrictions.
Revoke public access and preserve policy history and access logs.
Report confirmed exposure separately from unproven data exfiltration.

Explanation

Correct Answer

Confirmed regulated data access may trigger notification obligations. Escalate confirmed exposed regulated cloud data.

Incorrect Answers

Fixing bucket ACLs may not invalidate every preissued access mechanism. It could help close residual storage signed URL exposure, but it would not escalate confirmed exposed regulated cloud data.

Misconfigured permissions require prompt containment plus exposure evidence. That is relevant to cloud object exposure incident, not to escalate confirmed exposed regulated cloud data.

Listing alone does not prove records were downloaded. It would distinguish cloud listing from data theft, but it would not escalate confirmed exposed regulated cloud data.

Question 770

A responder needs a forensic disk copy from a running critical server. What is the MOST appropriate analyst action based on the evidence?

Apply approved secure transfer, limited access and confidentiality handling.
Coordinate a minimally disruptive approved acquisition with integrity verification.
Reacquire and verify from trusted source rather than use an inconsistent image.
Collect authorized volatile evidence and recovery-key information before power loss.

Explanation

Correct Answer

Evidence collection must preserve availability and chain of custody. Acquire disk evidence from critical server safely.

Incorrect Answers

Memory captures can contain credentials and sensitive business information. It could help govern external sharing of volatile evidence, but it would not acquire disk evidence from critical server safely.

Source/destination hash mismatch undermines forensic reliability. It would resolve forensic disk hash mismatch, but it would not acquire disk evidence from critical server safely.

Shutdown can lose memory-only evidence and complicate encrypted storage access. It could help preserve live evidence before laptop shutdown, but it would not acquire disk evidence from critical server safely.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 75 - 10 Questions (Last Reviewed 28-Oct-2026)
CompTIA CS0-003 Practice Test 76 - 10 Questions (Last Reviewed 27-Oct-2026)
CompTIA CS0-003 Practice Test 77 - 10 Questions (Last Reviewed 26-Oct-2026)
CompTIA CS0-003 Practice Test 78 - 10 Questions (Last Reviewed 25-Oct-2026)
CompTIA CS0-003 Practice Test 79 - 10 Questions (Last Reviewed 24-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 760

Explanation

Correct Answer

Incorrect Answers

Question 761

Explanation

Correct Answer

Incorrect Answers

Question 762

Explanation

Correct Answer

Incorrect Answers

Question 763

Explanation

Correct Answer

Incorrect Answers

Question 764

Explanation

Correct Answer

Incorrect Answers

Question 765

Explanation

Correct Answer

Incorrect Answers

Question 766

Explanation

Correct Answer

Incorrect Answers

Question 767

Explanation

Correct Answer

Incorrect Answers

Question 768

Explanation

Correct Answer

Incorrect Answers

Question 769

Explanation

Correct Answer

Incorrect Answers

Question 770

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests