CompTIA CS0-003 Practice Test 8

Question 70

Multiple laptops gain identical unknown startup scripts after a shared software image update. What is the MOST appropriate analyst action based on the evidence?

Inspect extension publisher, permissions and deployment source before disabling suspected abuse.
Compare golden image hash and deployment change record before declaring distributed malware.
Verify actual process creation and child actions rather than assuming execution.
Preserve the hosts-file modification and restore known trusted name resolution.

Explanation

Correct Answer

Shared deployment error can explain coordinated startup changes across devices. Distinguish image rollout change from distributed compromise.

Incorrect Answers

Browser extensions can read sensitive web data when granted sweeping permissions. It would investigate unapproved broad-permission browser extension, but it would not distinguish image rollout change from distributed compromise.

Prevention events do not necessarily indicate successful payload launch. That is relevant to suspicious persistence across endpoints, not to distinguish image rollout change from distributed compromise.

Host-file tampering can redirect sensitive requests outside DNS controls. It would identify endpoint hosts-file redirection, but it would not distinguish image rollout change from distributed compromise.

Question 71

A recently terminated employee's mailbox suddenly creates a rule forwarding invoices externally. Which next step is MOST defensible for the security team?

Correlate group membership change with session actions and approved elevation procedures.
Check support tickets and audit trail for account takeover attempts.
Review mailbox audit, rule creation and token use, then revoke unauthorized forwarding.
Block the elevated consent request and review its requester and destination application.

Explanation

Correct Answer

Server-side mail rules can persist after credential theft and leak sensitive content. Detect unauthorized email forwarding rule.

Incorrect Answers

Brief privileged grants can be abused even when quickly removed. It could help investigate temporary rogue privilege elevation, but it would not detect unauthorized email forwarding rule.

Unusual reset volume from one actor can indicate compromised delegated authority. That is relevant to suspicious account behavior and persistence, not to detect unauthorized email forwarding rule.

Admin consent can grant broad tenant access to a malicious app. It could help investigate unusual high-privilege OAuth consent, but it would not detect unauthorized email forwarding rule.

Question 72

An executive receives a voicemail urging urgent MFA code disclosure to a fake help desk. Which action BEST aligns with sound security operations?

Inspect DMARC alignment and the original message headers before trusting the sender identity.
Decode and assess the QR target safely, and search gateway logs for affected recipients.
Verify payment changes through an independent known contact channel and review header alignment.
Classify the social-engineering attempt and notify impacted identities to reject code sharing.

Explanation

Correct Answer

MFA one-time codes are authentication secrets that support fraudulent sign-ins. Detect voice-based MFA social engineering.

Incorrect Answers

Valid DKIM for a different domain does not establish aligned sender legitimacy. That is relevant to email lure and impersonation, not to detect voice-based MFA social engineering.

Quishing hides a destination that still needs independent URL analysis. It would investigate QR-code phishing, but it would not detect voice-based MFA social engineering.

Sender authentication success does not confirm legitimate business instructions. It could help triage business email compromise lure, but it would not detect voice-based MFA social engineering.

Question 73

A single server attempts connections to every host on a management VLAN in ascending order. Which response BEST addresses the security problem described?

Investigate the source process and destination response pattern for network sweep activity.
Check first-seen, last-seen and current service ownership before taking action.
Preserve the interaction sequence and isolate honeypot telemetry from production credentials.
Confirm the approved engagement scope and timing before downgrading severity.

Explanation

Correct Answer

Ordered horizontal probing suggests enumeration and possible pivot preparation. Detect management subnet sweep.

Incorrect Answers

Reputation can become stale when infrastructure addresses are reassigned. It could help challenge stale indicator attribution, but it would not detect management subnet sweep.

Decoy interaction can reveal attack behavior but must not introduce real access. That is relevant to honeypot and reconnaissance indicators, not to detect management subnet sweep.

Authorized assessment traffic can resemble hostile reconnaissance. It would verify approved red-team scanning, but it would not detect management subnet sweep.

Question 74

A signed document hash differs after it passes through an unapproved conversion service. Which investigative or response action BEST fits the evidence?

Check audit service state, event deletion and privilege changes before assuming sensor failure.
Validate the signature chain and approved transformation before accepting integrity.
Preserve transaction records and compare changes with authorized application workflows.
Compare the hash with trusted build artifacts and inspect deployment provenance.

Explanation

Correct Answer

Recomputed content hashes reveal modification even if the file remains readable. Assess document tampering after conversion.

Incorrect Answers

Selective logging gaps may indicate deliberate defense evasion. It could help triage suspicious audit-log suppression, but it would not assess document tampering after conversion.

Broad integrity-changing writes may signify fraud or compromised automation. It would investigate unauthorized database modification, but it would not assess document tampering after conversion.

Hash mismatches flag changed bytes but require authoritative baseline context. It could help investigate unapproved application binary change, but it would not assess document tampering after conversion.

Question 75

A tablet joins an unauthorized personal hotspot during restricted corporate access. What is the MOST appropriate analyst action based on the evidence?

Correlate switch port, DHCP fingerprint and known printer management data.
Validate the transmitter location and certificate/authentication behavior for evil-twin activity.
Validate endpoint policy telemetry and disable prohibited alternate network paths.
Capture wireless management traffic and compare with approved controller activity.

Explanation

Correct Answer

Uncontrolled hotspot access can bypass enterprise segmentation and monitoring. Control unauthorized wireless bypass.

Incorrect Answers

MAC addresses can be forged and require corroborating device identity. That is relevant to wireless and rogue device indicators, not to control unauthorized wireless bypass.

Matching SSID alone cannot establish access-point legitimacy. It would identify potential evil-twin wireless access, but it would not control unauthorized wireless bypass.

Excessive unauthenticated deauth frames may disrupt service or support interception attacks. That is relevant to wireless and rogue device indicators, not to control unauthorized wireless bypass.

Question 76

A user reports frequent Wi-Fi deauthentication frames targeting a meeting room. Which next step is MOST defensible for the security team?

Validate the transmitter location and certificate/authentication behavior for evil-twin activity.
Correlate switch port, DHCP fingerprint and known printer management data.
Validate endpoint policy telemetry and disable prohibited alternate network paths.
Capture wireless management traffic and compare with approved controller activity.

Explanation

Correct Answer

Excessive unauthenticated deauth frames may disrupt service or support interception attacks. Investigate wireless deauthentication flood.

Incorrect Answers

Matching SSID alone cannot establish access-point legitimacy. It would identify potential evil-twin wireless access, but it would not investigate wireless deauthentication flood.

MAC addresses can be forged and require corroborating device identity. It could help detect suspected MAC spoofing, but it would not investigate wireless deauthentication flood.

Uncontrolled hotspot access can bypass enterprise segmentation and monitoring. That is relevant to wireless and rogue device indicators, not to investigate wireless deauthentication flood.

Question 77

A PowerShell script downloads content using `-EncodedCommand` from an unrelated domain. Which action BEST aligns with sound security operations?

Decode safely and correlate the child command with destination reputation and signer.
Correlate certutil command parameters with downloaded file hashes and execution events.
Identify the downloaded script and execution history; block unapproved privileged execution.
Confirm process ownership and documented testing scope before treating enumeration as hostile.

Explanation

Correct Answer

Obfuscation plus unapproved network retrieval increases maliciousness suspicion. Analyze encoded PowerShell download.

Incorrect Answers

Certificate utilities can be abused to stage payloads outside normal installers. That is relevant to unusual command-line activity, not to analyze encoded PowerShell download.

Executing remote content without validation risks immediate host compromise. It would investigate curl-to-shell execution, but it would not analyze encoded PowerShell download.

Reconnaissance commands are dual-use and require execution context. It could help evaluate legitimate admin command enumeration, but it would not analyze encoded PowerShell download.

Question 78

A high volume of NXDOMAIN replies follows script execution on a compromised endpoint. Which response BEST addresses the security problem described?

Enrich DNS resolutions with reputation and passive-DNS history before blocking infrastructure.
Review queried domains and process tree for domain-generation-algorithm behavior.
Correlate query lengths, unique labels and host process evidence for DNS tunneling.
Check the new vendor's documented TXT discovery behavior before classifying maliciousness.

Explanation

Correct Answer

Repeated failed pseudo-random lookups are common to generated rendezvous attempts. Test DGA-driven lookup hypothesis.

Incorrect Answers

Rapid answer churn may indicate resilient malicious hosting rather than routine CDN use. That is relevant to dns behavior and tunneling, not to test DGA-driven lookup hypothesis.

Unusual high-entropy subdomain streams can carry encoded data through DNS. It could help triage DNS tunneling pattern, but it would not test DGA-driven lookup hypothesis.

Legitimate service discovery can use TXT records and must be distinguished by context. That is relevant to dns behavior and tunneling, not to test DGA-driven lookup hypothesis.

Question 79

A storage access log records a single signed URL downloaded from multiple distant clients. Which investigative or response action BEST fits the evidence?

Correlate denied object paths and identity permissions for enumeration attempts.
Mask sensitive configuration values in logs and rotate the leaked token.
Check expiration, audience restrictions and access patterns for link leakage.
Compare IAM policy changes and denied API operations with expected application permissions.

Explanation

Correct Answer

Bearer URLs can be reused if not appropriately scoped or short-lived. Investigate exposed object pre-signed URL.

Incorrect Answers

Systematic 403 access patterns can signal attempts to locate accessible sensitive objects. It would triage cloud object enumeration with denials, but it would not investigate exposed object pre-signed URL.

Logging secrets can expose credentials to broad observer groups. It could help remediate cloud function secret in logs, but it would not investigate exposed object pre-signed URL.

Unexpected access denial may reflect legitimate least privilege or a broken deployment. It would diagnose cloud permission regression, but it would not investigate exposed object pre-signed URL.

Question 80

A function environment variable containing a token appears in routine debug output. What is the MOST appropriate analyst action based on the evidence?

Correlate denied object paths and identity permissions for enumeration attempts.
Check expiration, audience restrictions and access patterns for link leakage.
Compare IAM policy changes and denied API operations with expected application permissions.
Mask sensitive configuration values in logs and rotate the leaked token.

Explanation

Correct Answer

Logging secrets can expose credentials to broad observer groups. Remediate cloud function secret in logs.

Incorrect Answers

Systematic 403 access patterns can signal attempts to locate accessible sensitive objects. It could help triage cloud object enumeration with denials, but it would not remediate cloud function secret in logs.

Bearer URLs can be reused if not appropriately scoped or short-lived. That is relevant to cloud data exposure and application logs, not to remediate cloud function secret in logs.

Unexpected access denial may reflect legitimate least privilege or a broken deployment. It would diagnose cloud permission regression, but it would not remediate cloud function secret in logs.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 6 - 10 Questions (Last Reviewed 09-Nov-2026)
CompTIA CS0-003 Practice Test 7 - 10 Questions (Last Reviewed 08-Nov-2026)
CompTIA CS0-003 Practice Test 8 - 10 Questions (Last Reviewed 07-Nov-2026)
CompTIA CS0-003 Practice Test 9 - 10 Questions (Last Reviewed 06-Nov-2026)
CompTIA CS0-003 Practice Test 10 - 10 Questions (Last Reviewed 05-Nov-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 70

Explanation

Correct Answer

Incorrect Answers

Question 71

Explanation

Correct Answer

Incorrect Answers

Question 72

Explanation

Correct Answer

Incorrect Answers

Question 73

Explanation

Correct Answer

Incorrect Answers

Question 74

Explanation

Correct Answer

Incorrect Answers

Question 75

Explanation

Correct Answer

Incorrect Answers

Question 76

Explanation

Correct Answer

Incorrect Answers

Question 77

Explanation

Correct Answer

Incorrect Answers

Question 78

Explanation

Correct Answer

Incorrect Answers

Question 79

Explanation

Correct Answer

Incorrect Answers

Question 80

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests