CompTIA CS0-003 Practice Test 86

Question 850

An audit requests PCI external scanning records but the report contains only internal vulnerability scans. What is the MOST appropriate analyst action based on the evidence?

Identify the benchmark release and explain mapped control differences.
Supply appropriately authorized external assessment evidence for applicable systems.
Attach reproducible evidence metadata for controls tested.
Report the exception, residual exposure and approved compensating controls.

Explanation

Correct Answer

Regulatory test scope and method are part of compliance proof. Report PCI external scan evidence.

Incorrect Answers

Control baseline version is necessary to interpret compliance results. It would disclose baseline version in audit report, but it would not report PCI external scan evidence.

Audit artifacts need traceable asset and observation context. That is relevant to compliance and evidence reports, not to report PCI external scan evidence.

Incomplete exceptions make compliance statements misleading. It would include encryption exceptions in compliance report, but it would not report PCI external scan evidence.

Question 851

A release introduces a known insecure dependency previously removed. Which next step is MOST defensible for the security team?

Verify patch state through alternate authorized credentials before declaring fixed.
Document verified operational constraints and controlled alternate safeguards.
Tie vulnerability recurrence to software build and release controls.
Report emergency authorization, testing gaps and corrective change practices.

Explanation

Correct Answer

Reintroduced components indicate supply-chain or build policy drift. Report reintroduced vulnerable dependency.

Incorrect Answers

Scanner reachability loss is not software remediation. It could help avoid false closure caused by scan filtering, but it would not report reintroduced vulnerable dependency.

Regulated or certified equipment may need nonstandard safe remediation sequences. That is relevant to change management link to vulnerabilities, not to report reintroduced vulnerable dependency.

Risk treatment must include safe execution and traceable governance. It could help report emergency patch change control defect, but it would not report reintroduced vulnerable dependency.

Question 852

A product owner delegates acceptance of severe enterprise risk to an unqualified contractor. Which action BEST aligns with sound security operations?

Clearly record continued vulnerability, residual impact and control conditions.
Correct the scope and report unauthorized residual exposure.
Trigger reassessment and notify the responsible owner with new reachability evidence.
Route acceptance to the accountable authorized risk owner.

Explanation

Correct Answer

Third parties cannot accept organizational exposure without proper authority. Report invalid risk acceptance authority.

Incorrect Answers

Risk acceptance is a governance decision, not technical remediation. That is relevant to risk acceptance reporting and governance, not to report invalid risk acceptance authority.

Broader exceptions may conceal significant unapproved risk. It would identify exception-control scope mismatch, but it would not report invalid risk acceptance authority.

Exposure changes invalidate old treatment assumptions. It could help reopen expired or changed vulnerability acceptance, but it would not report invalid risk acceptance authority.

Question 853

A patch team boasts of 10,000 fixes but leaves a single exploited VPN vulnerability open. Which response BEST addresses the security problem described?

Report risk-weighted reduction and the remaining known exploited exposure.
Include aging open items and a clearly defined closure cohort.
Calculate metrics using the contractual calendar basis and correct the report.
Present distinct treatment outcomes and residual risk for each category.

Explanation

Correct Answer

High volume alone does not prove effective risk reduction. Emphasize exploit exposure over patch count.

Incorrect Answers

Survivorship bias makes performance appear better than real backlog. It could help correct vulnerability remediation time bias, but it would not emphasize exploit exposure over patch count.

Time basis differences can create false compliance. That is relevant to remediation measurement and priorities, not to emphasize exploit exposure over patch count.

Acceptance does not demonstrate elimination of the underlying flaw. It would separate mitigation from risk acceptance in metrics, but it would not emphasize exploit exposure over patch count.

Question 854

An emergency accepted exception hides an overdue critical asset from compliance reports. Which investigative or response action BEST fits the evidence?

Define clock start, calendar basis and verified close event uniformly.
Report residual risk and approved exception status transparently.
Define tiered remediation targets based on risk and business constraints.
Measure verified full-scope mitigation rather than administrative ticket closure.

Explanation

Correct Answer

Risk acceptance changes treatment, not the historical presence of exposure. Disclose exceptions in SLO reporting.

Incorrect Answers

Inconsistent timing rules invalidate SLA comparisons. It could help standardize vulnerability SLO clock, but it would not disclose exceptions in SLO reporting.

Different impacts require proportionate response windows. It would design risk-based remediation service levels, but it would not disclose exceptions in SLO reporting.

Incomplete deployment cannot satisfy real remediation objectives. It could help reject false SLO success on standby exposure, but it would not disclose exceptions in SLO reporting.

Question 855

One critical CVE is fixed and reintroduced after every deployment. What is the MOST appropriate analyst action based on the evidence?

Use verified remediation outcomes and distinguish unvalidated closures.
Separate scope expansion from actual risk deterioration in trend charts.
Report recurrence and root-cause process weakness separately from one-time closures.
Include assessed asset and test coverage with the count trend.

Explanation

Correct Answer

Repeat defects indicate remediation-system problems. Measure recurring vulnerabilities in builds.

Incorrect Answers

Closure status without technical proof is not confirmed risk reduction. That is relevant to vulnerability trend and recurrence metrics, not to measure recurring vulnerabilities in builds.

New asset coverage can increase counts without weaker controls. It would interpret exposure trend after asset discovery, but it would not measure recurring vulnerabilities in builds.

Reduced visibility can create misleading apparent improvement. That is relevant to vulnerability trend and recurrence metrics, not to measure recurring vulnerabilities in builds.

Question 856

A legal officer needs evidence relevant to a suspected reportable data exposure. Which next step is MOST defensible for the security team?

Link exploitable exposure and recovery dependencies to the warehouse service.
Provide approved reproduction steps and the required authorization boundary.
Compare claimed fix scope against actual inventory and validated versions.
Distinguish vulnerability potential from observed data access and relevant records.

Explanation

Correct Answer

Legal decisions depend on confirmed event facts and applicable obligations. Report vulnerability versus breach for legal team.

Incorrect Answers

Business-specific scenarios make vulnerability information decision-ready. It would answer executive operational continuity concern, but it would not report vulnerability versus breach for legal team.

Clear technical evidence supports a targeted root-cause fix. It could help give engineer actionable auth bypass finding, but it would not report vulnerability versus breach for legal team.

Supplier assurance needs asset-level confirmation. That is relevant to stakeholder expectations and risk evidence, not to report vulnerability versus breach for legal team.

Question 857

A risk owner accepts a vulnerability but executives assume the technical flaw no longer exists. Which action BEST aligns with sound security operations?

Clearly record continued vulnerability, residual impact and control conditions.
Route acceptance to the accountable authorized risk owner.
Correct the scope and report unauthorized residual exposure.
Trigger reassessment and notify the responsible owner with new reachability evidence.

Explanation

Correct Answer

Risk acceptance is a governance decision, not technical remediation. Explain accepted risk versus fixed vulnerability.

Incorrect Answers

Third parties cannot accept organizational exposure without proper authority. That is relevant to risk acceptance reporting and governance, not to explain accepted risk versus fixed vulnerability.

Broader exceptions may conceal significant unapproved risk. It would identify exception-control scope mismatch, but it would not explain accepted risk versus fixed vulnerability.

Exposure changes invalidate old treatment assumptions. It could help reopen expired or changed vulnerability acceptance, but it would not explain accepted risk versus fixed vulnerability.

Question 858

An asset owner has accepted residual risk but no future change is scheduled. Which response BEST addresses the security problem described?

Add accountable owner, due date and retest acceptance criteria for each critical item.
Include expiry, monitoring and reassessment trigger in the acceptance record.
Require deployed-build and exposure verification before closure.
Coordinate dependent controls and a single verified closure checkpoint.

Explanation

Correct Answer

Risk acceptance remains controlled only when reassessment is defined. Track accepted vulnerability future review.

Incorrect Answers

A finding becomes useful only with a trackable treatment action. That is relevant to remediation plan and owner follow-through, not to track accepted vulnerability future review.

Vendor release availability does not prove the target was updated. It could help validate vendor patch deployed before closure, but it would not track accepted vulnerability future review.

Multiteam vulnerabilities need integrated sequencing and evidence. That is relevant to remediation plan and owner follow-through, not to track accepted vulnerability future review.

Question 859

A vendor reports its SOC has mitigated an issue but provides no verifiable outcome evidence. Which investigative or response action BEST fits the evidence?

Review agreed dependencies and document a negotiated recovery plan with owners.
Define explicit scan authorization and decision authority.
Request mitigation test results and affected-service scope before closing risk.
Clarify responsibilities in the SLA or responsibility matrix with both parties.

Explanation

Correct Answer

Third-party assurance requires proof, not status assertions. Validate vendor security remediation claim.

Incorrect Answers

Corrective action should reflect contractual and operational constraints. It would report supplier remediation SLA dispute, but it would not validate vendor security remediation claim.

Cross-organization assessment requires agreed safe operating responsibility. It could help add scan authority to partner MOU, but it would not validate vendor security remediation claim.

Ambiguous contractual ownership delays remediation. It would resolve third-party vulnerability patch accountability, but it would not validate vendor security remediation claim.

Question 860

An MSP contract assigns patching to the vendor while the customer assumes internal operations own it. What is the MOST appropriate analyst action based on the evidence?

Request mitigation test results and affected-service scope before closing risk.
Define explicit scan authorization and decision authority.
Review agreed dependencies and document a negotiated recovery plan with owners.
Clarify responsibilities in the SLA or responsibility matrix with both parties.

Explanation

Correct Answer

Ambiguous contractual ownership delays remediation. Resolve third-party vulnerability patch accountability.

Incorrect Answers

Third-party assurance requires proof, not status assertions. It could help validate vendor security remediation claim, but it would not resolve third-party vulnerability patch accountability.

Cross-organization assessment requires agreed safe operating responsibility. That is relevant to memoranda, slas and third parties, not to resolve third-party vulnerability patch accountability.

Corrective action should reflect contractual and operational constraints. It would report supplier remediation SLA dispute, but it would not resolve third-party vulnerability patch accountability.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 84 - 10 Questions (Last Reviewed 19-Oct-2026)
CompTIA CS0-003 Practice Test 85 - 10 Questions (Last Reviewed 18-Oct-2026)
CompTIA CS0-003 Practice Test 86 - 10 Questions (Last Reviewed 17-Oct-2026)
CompTIA CS0-003 Practice Test 87 - 10 Questions (Last Reviewed 16-Oct-2026)
CompTIA CS0-003 Practice Test 88 - 10 Questions (Last Reviewed 15-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 850

Explanation

Correct Answer

Incorrect Answers

Question 851

Explanation

Correct Answer

Incorrect Answers

Question 852

Explanation

Correct Answer

Incorrect Answers

Question 853

Explanation

Correct Answer

Incorrect Answers

Question 854

Explanation

Correct Answer

Incorrect Answers

Question 855

Explanation

Correct Answer

Incorrect Answers

Question 856

Explanation

Correct Answer

Incorrect Answers

Question 857

Explanation

Correct Answer

Incorrect Answers

Question 858

Explanation

Correct Answer

Incorrect Answers

Question 859

Explanation

Correct Answer

Incorrect Answers

Question 860

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests