CompTIA CS0-003 Practice Test 85

Question 840

A patch causes an outage during rollout but the report omits operational impact. What is the MOST appropriate analyst action based on the evidence?

Recommend time-bounded exception governance and periodic reauthorization.
Include active-version verification as a separate completion metric.
Group overdue fixes by business service and risk-based priority.
Report the change failure, rollback and revised test controls alongside risk reduction.

Explanation

Correct Answer

Balanced reporting captures both security and availability outcomes. Report patch-induced business impact.

Incorrect Answers

Unlimited exceptions undermine enforceable remediation policy. That is relevant to patch program governance reporting, not to report patch-induced business impact.

Installed patches may not protect until services restart. It would measure active patch state, but it would not report patch-induced business impact.

Backlog sorting should focus attention on meaningful exposure. It could help risk-rank vulnerability patch backlog, but it would not report patch-induced business impact.

Question 841

The dashboard shows a backlog of hundreds of old patches but no separation by asset criticality. Which next step is MOST defensible for the security team?

Group overdue fixes by business service and risk-based priority.
Report the change failure, rollback and revised test controls alongside risk reduction.
Recommend time-bounded exception governance and periodic reauthorization.
Include active-version verification as a separate completion metric.

Explanation

Correct Answer

Backlog sorting should focus attention on meaningful exposure. Risk-rank vulnerability patch backlog.

Incorrect Answers

Balanced reporting captures both security and availability outcomes. It could help report patch-induced business impact, but it would not risk-rank vulnerability patch backlog.

Unlimited exceptions undermine enforceable remediation policy. That is relevant to patch program governance reporting, not to risk-rank vulnerability patch backlog.

Installed patches may not protect until services restart. It would measure active patch state, but it would not risk-rank vulnerability patch backlog.

Question 842

A memorandum of understanding outlines shared scanning but omits who can approve intrusive tests. Which action BEST aligns with sound security operations?

Clarify responsibilities in the SLA or responsibility matrix with both parties.
Define explicit scan authorization and decision authority.
Request mitigation test results and affected-service scope before closing risk.
Review agreed dependencies and document a negotiated recovery plan with owners.

Explanation

Correct Answer

Cross-organization assessment requires agreed safe operating responsibility. Add scan authority to partner MOU.

Incorrect Answers

Ambiguous contractual ownership delays remediation. It could help resolve third-party vulnerability patch accountability, but it would not add scan authority to partner MOU.

Third-party assurance requires proof, not status assertions. It would validate vendor security remediation claim, but it would not add scan authority to partner MOU.

Corrective action should reflect contractual and operational constraints. It could help report supplier remediation SLA dispute, but it would not add scan authority to partner MOU.

Question 843

A vulnerability report omits assets that were unreachable during the last scan. Which response BEST addresses the security problem described?

Label scoring systems and avoid direct unqualified severity comparisons.
Normalize duplicates and include affected asset value and exposure.
Show unassessed population explicitly alongside assessed findings.
Use a clear consistent scale and disclose absolute change.

Explanation

Correct Answer

Missing coverage must not masquerade as zero vulnerabilities. Communicate unscanned asset blind spots.

Incorrect Answers

Different scoring standards can produce non-equivalent categories. That is relevant to data visualization and reporting fairness, not to communicate unscanned asset blind spots.

Raw frequency can obscure the most consequential risks. It would correct top-10 vulnerabilities for context, but it would not communicate unscanned asset blind spots.

Honest visualization supports accurate risk decisions. That is relevant to data visualization and reporting fairness, not to communicate unscanned asset blind spots.

Question 844

A team delays validation because scanners are unavailable for a week. Which investigative or response action BEST fits the evidence?

Implement accountable assignment and escalation with tracked acknowledgment.
Verify the full attack surface and update the mitigation scope.
Coordinate approved business communication and recovery procedure before maintenance.
Record temporary status honestly and use approved manual proof where appropriate.

Explanation

Correct Answer

Missing retest tooling does not justify falsely claiming verification. Handle unavailable vulnerability retest tools.

Incorrect Answers

Risk remains unmanaged until an owner accepts responsibility. It would require vulnerability remediation acknowledgment, but it would not handle unavailable vulnerability retest tools.

Partial route blocking is not complete risk closure. It could help validate all vulnerable API paths, but it would not handle unavailable vulnerability retest tools.

Secure patching includes operational continuity responsibilities. That is relevant to operational remediation workflow closure, not to handle unavailable vulnerability retest tools.

Question 845

A remediation SLA excludes holidays but the contract defines calendar days. What is the MOST appropriate analyst action based on the evidence?

Calculate metrics using the contractual calendar basis and correct the report.
Present distinct treatment outcomes and residual risk for each category.
Report risk-weighted reduction and the remaining known exploited exposure.
Include aging open items and a clearly defined closure cohort.

Explanation

Correct Answer

Time basis differences can create false compliance. Calculate correct contractual vulnerability SLA.

Incorrect Answers

Acceptance does not demonstrate elimination of the underlying flaw. That is relevant to remediation measurement and priorities, not to calculate correct contractual vulnerability SLA.

High volume alone does not prove effective risk reduction. It would emphasize exploit exposure over patch count, but it would not calculate correct contractual vulnerability SLA.

Survivorship bias makes performance appear better than real backlog. It could help correct vulnerability remediation time bias, but it would not calculate correct contractual vulnerability SLA.

Question 846

A vendor manager asks whether a supplier's patch statement resolves all known affected devices. Which next step is MOST defensible for the security team?

Link exploitable exposure and recovery dependencies to the warehouse service.
Compare claimed fix scope against actual inventory and validated versions.
Provide approved reproduction steps and the required authorization boundary.
Distinguish vulnerability potential from observed data access and relevant records.

Explanation

Correct Answer

Supplier assurance needs asset-level confirmation. Evaluate supplier patch completeness.

Incorrect Answers

Business-specific scenarios make vulnerability information decision-ready. That is relevant to stakeholder expectations and risk evidence, not to evaluate supplier patch completeness.

Clear technical evidence supports a targeted root-cause fix. It could help give engineer actionable auth bypass finding, but it would not evaluate supplier patch completeness.

Legal decisions depend on confirmed event facts and applicable obligations. That is relevant to stakeholder expectations and risk evidence, not to evaluate supplier patch completeness.

Question 847

A payroll system has an approved maintenance freeze during annual tax filing. Which action BEST aligns with sound security operations?

Report business constraint, temporary isolation, owner-approved plan and replacement timeline.
Document contractual restriction and agree on vendor-managed remediation and interim controls.
Present delayed patch impact and temporary safeguards for accountable risk approval.
Report live exposure and a short-term isolation plan despite future retirement.

Explanation

Correct Answer

Business process timing can justify controlled sequencing, not silent neglect. Report finance maintenance freeze risk.

Incorrect Answers

Legacy remediation reporting must balance patient service availability with risk. It would document legacy system patch blocker, but it would not report finance maintenance freeze risk.

Unilateral patching may violate support terms and operational assurances. It could help manage vendor-controlled patch inhibitor, but it would not report finance maintenance freeze risk.

Future disposal does not remove present vulnerability. It would communicate interim retired-device risk, but it would not report finance maintenance freeze risk.

Question 848

A scanner report states only 'critical CVE' without affected software or evidence. Which response BEST addresses the security problem described?

Add service owner, criticality and operational remediation dependencies.
Reconcile stable asset identifiers and scan timestamps before maintaining the claim.
Share minimum necessary technical evidence through access-controlled channels.
Include asset, affected version, exploit path, impact, proposed remedy and validation.

Explanation

Correct Answer

Remediation owners need reproducible targeted evidence. Write actionable CVE remediation finding.

Incorrect Answers

Assignable work needs responsibility and feasibility context. It could help enrich finding with ownership and constraints, but it would not write actionable CVE remediation finding.

Misattributed scan evidence can send changes to the wrong system. That is relevant to actionable finding writing, not to write actionable CVE remediation finding.

Vulnerability reports can contain sensitive exploit details. It would restrict exploit detail distribution, but it would not write actionable CVE remediation finding.

Question 849

A supplier misses a required security fix deadline but blames a client's inaccessible maintenance window. Which investigative or response action BEST fits the evidence?

Review agreed dependencies and document a negotiated recovery plan with owners.
Define explicit scan authorization and decision authority.
Clarify responsibilities in the SLA or responsibility matrix with both parties.
Request mitigation test results and affected-service scope before closing risk.

Explanation

Correct Answer

Corrective action should reflect contractual and operational constraints. Report supplier remediation SLA dispute.

Incorrect Answers

Cross-organization assessment requires agreed safe operating responsibility. It would add scan authority to partner MOU, but it would not report supplier remediation SLA dispute.

Ambiguous contractual ownership delays remediation. It could help resolve third-party vulnerability patch accountability, but it would not report supplier remediation SLA dispute.

Third-party assurance requires proof, not status assertions. That is relevant to memoranda, slas and third parties, not to report supplier remediation SLA dispute.

Question 850

An audit requests PCI external scanning records but the report contains only internal vulnerability scans. What is the MOST appropriate analyst action based on the evidence?

Identify the benchmark release and explain mapped control differences.
Supply appropriately authorized external assessment evidence for applicable systems.
Attach reproducible evidence metadata for controls tested.
Report the exception, residual exposure and approved compensating controls.

Explanation

Correct Answer

Regulatory test scope and method are part of compliance proof. Report PCI external scan evidence.

Incorrect Answers

Control baseline version is necessary to interpret compliance results. It would disclose baseline version in audit report, but it would not report PCI external scan evidence.

Audit artifacts need traceable asset and observation context. That is relevant to compliance and evidence reports, not to report PCI external scan evidence.

Incomplete exceptions make compliance statements misleading. It would include encryption exceptions in compliance report, but it would not report PCI external scan evidence.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 83 - 10 Questions (Last Reviewed 20-Oct-2026)
CompTIA CS0-003 Practice Test 84 - 10 Questions (Last Reviewed 19-Oct-2026)
CompTIA CS0-003 Practice Test 85 - 10 Questions (Last Reviewed 18-Oct-2026)
CompTIA CS0-003 Practice Test 86 - 10 Questions (Last Reviewed 17-Oct-2026)
CompTIA CS0-003 Practice Test 87 - 10 Questions (Last Reviewed 16-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 840

Explanation

Correct Answer

Incorrect Answers

Question 841

Explanation

Correct Answer

Incorrect Answers

Question 842

Explanation

Correct Answer

Incorrect Answers

Question 843

Explanation

Correct Answer

Incorrect Answers

Question 844

Explanation

Correct Answer

Incorrect Answers

Question 845

Explanation

Correct Answer

Incorrect Answers

Question 846

Explanation

Correct Answer

Incorrect Answers

Question 847

Explanation

Correct Answer

Incorrect Answers

Question 848

Explanation

Correct Answer

Incorrect Answers

Question 849

Explanation

Correct Answer

Incorrect Answers

Question 850

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests