CompTIA CS0-003 Practice Test 87

Question 860

An MSP contract assigns patching to the vendor while the customer assumes internal operations own it. What is the MOST appropriate analyst action based on the evidence?

Request mitigation test results and affected-service scope before closing risk.
Define explicit scan authorization and decision authority.
Review agreed dependencies and document a negotiated recovery plan with owners.
Clarify responsibilities in the SLA or responsibility matrix with both parties.

Explanation

Correct Answer

Ambiguous contractual ownership delays remediation. Resolve third-party vulnerability patch accountability.

Incorrect Answers

Third-party assurance requires proof, not status assertions. It could help validate vendor security remediation claim, but it would not resolve third-party vulnerability patch accountability.

Cross-organization assessment requires agreed safe operating responsibility. That is relevant to memoranda, slas and third parties, not to resolve third-party vulnerability patch accountability.

Corrective action should reflect contractual and operational constraints. It would report supplier remediation SLA dispute, but it would not resolve third-party vulnerability patch accountability.

Question 861

A team publishes full internal exploit payloads to a broad distribution list. Which next step is MOST defensible for the security team?

Share minimum necessary technical evidence through access-controlled channels.
Reconcile stable asset identifiers and scan timestamps before maintaining the claim.
Add service owner, criticality and operational remediation dependencies.
Include asset, affected version, exploit path, impact, proposed remedy and validation.

Explanation

Correct Answer

Vulnerability reports can contain sensitive exploit details. Restrict exploit detail distribution.

Incorrect Answers

Misattributed scan evidence can send changes to the wrong system. It would correct asset identity in vulnerability report, but it would not restrict exploit detail distribution.

Assignable work needs responsibility and feasibility context. It could help enrich finding with ownership and constraints, but it would not restrict exploit detail distribution.

Remediation owners need reproducible targeted evidence. That is relevant to actionable finding writing, not to restrict exploit detail distribution.

Question 862

A cloud app's vulnerable library is present only in one disabled optional module. Which action BEST aligns with sound security operations?

Highlight transaction and credential consequences in prioritization.
Explain code reachability and mitigation confidence with source evidence.
State potential confidentiality impact and distinguish it from confirmed exfiltration.
Report verified isolation and residual internal pathways instead of treating risk as zero.

Explanation

Correct Answer

Realistic exploitation requires the vulnerable function to be reachable. Report vulnerability reachability constraints.

Incorrect Answers

Business impact can raise urgency above the base technical score. It would emphasize payment endpoint risk, but it would not report vulnerability reachability constraints.

A vulnerability is not proof of a breach. That is relevant to vulnerability findings and business impact, not to report vulnerability reachability constraints.

Environmental context limits but may not eliminate attack surface. It would describe standby service residual exposure, but it would not report vulnerability reachability constraints.

Question 863

An organization sends generic security awareness flyers but repeats cloud credential leaks in repositories. Which response BEST addresses the security problem described?

Add vendor lifecycle assurance to procurement training and approval.
Report the systemic SDLC defect and recommend secure coding tests and code review.
Target secret-handling coaching and enforce automated repository scanning.
Deliver focused process training and measure adherence to identity proofing.

Explanation

Correct Answer

Education works best when paired with workflow-specific controls. Prevent recurrent repository credential leaks.

Incorrect Answers

Prevention begins before vulnerable unsupported products enter the environment. It could help teach secure supplier lifecycle selection, but it would not prevent recurrent repository credential leaks.

Recurring findings call for preventive engineering, not only per-CVE tickets. That is relevant to training and prevention communication, not to prevent recurrent repository credential leaks.

Human procedural weaknesses require behavior and control checks, not one broadcast. It could help train help desk on secure reset workflow, but it would not prevent recurrent repository credential leaks.

Question 864

A board asks why an isolated lab CVE was delayed behind a medium public gateway flaw. Which investigative or response action BEST fits the evidence?

Report overdue exposure by criticality and remediation SLO alongside patch volume.
Summarize critical business services, exposure trends and required risk decisions.
Show the top residual risks and exposure distribution rather than relying on averages.
Explain reachability, exploit maturity and business impact used to set priorities.

Explanation

Correct Answer

Transparent risk-based prioritization shows why scores alone do not dictate order. Justify risk-based vulnerability remediation order.

Incorrect Answers

Activity metrics alone can disguise urgent unmanaged risk. That is relevant to executive vulnerability reporting, not to justify risk-based vulnerability remediation order.

Executive reporting should translate findings into business impact and accountability. It would present vulnerability risk at board level, but it would not justify risk-based vulnerability remediation order.

Mean severity can hide individual high-consequence assets. It could help avoid vulnerability severity averages hiding outliers, but it would not justify risk-based vulnerability remediation order.

Question 865

Regulators request proof of controls, but the report includes only assertions of compliance. What is the MOST appropriate analyst action based on the evidence?

Provide authoritative test and remediation evidence under required reporting format.
Explain the service risk, customer consequence, mitigation options and decision deadline.
Share affected build, required remediation and approved service window.
Provide exact asset, rule, test evidence and expected corrected state.

Explanation

Correct Answer

Compliance claims should be supported by independently traceable records. Supply auditable security compliance evidence.

Incorrect Answers

Business owners need consequences and accountable choices. It could help translate vulnerability finding for product owner, but it would not supply auditable security compliance evidence.

Supplier remediation depends on compatible operational scheduling. That is relevant to vulnerability communication to stakeholders, not to supply auditable security compliance evidence.

Technical implementers need operationally actionable detail. It would tailor remediation instructions to engineers, but it would not supply auditable security compliance evidence.

Question 866

A multi-vendor remediation effort lacks one definitive source of truth for completion. Which next step is MOST defensible for the security team?

Obtain effective installed version and runtime verification output.
Maintain a canonical remediation register with evidence-backed owner approvals.
Restrict the report to approved recipients and mask identifying details in external copies.
Present risk approval, interim mitigations, ownership and dated remediation evidence.

Explanation

Correct Answer

Consolidated records prevent contradictory closure claims across tools. Coordinate cross-vendor vulnerability evidence.

Incorrect Answers

Executing an installer does not prove successful remediation. It could help strengthen proof of patched vulnerability, but it would not coordinate cross-vendor vulnerability evidence.

Disclosure of asset naming can increase reconnaissance risk. It would safeguard confidential vulnerability report data, but it would not coordinate cross-vendor vulnerability evidence.

Defensible exceptions need a documented decision trail. It could help justify overdue vulnerability audit trail, but it would not coordinate cross-vendor vulnerability evidence.

Question 867

A procurement team buys unsupported devices without reviewing vendor security lifecycle. Which action BEST aligns with sound security operations?

Target secret-handling coaching and enforce automated repository scanning.
Report the systemic SDLC defect and recommend secure coding tests and code review.
Add vendor lifecycle assurance to procurement training and approval.
Deliver focused process training and measure adherence to identity proofing.

Explanation

Correct Answer

Prevention begins before vulnerable unsupported products enter the environment. Teach secure supplier lifecycle selection.

Incorrect Answers

Education works best when paired with workflow-specific controls. That is relevant to training and prevention communication, not to teach secure supplier lifecycle selection.

Recurring findings call for preventive engineering, not only per-CVE tickets. It would communicate recurring secure coding gap, but it would not teach secure supplier lifecycle selection.

Human procedural weaknesses require behavior and control checks, not one broadcast. That is relevant to training and prevention communication, not to teach secure supplier lifecycle selection.

Question 868

A security team creates urgent tickets but no owners acknowledge them. Which response BEST addresses the security problem described?

Record temporary status honestly and use approved manual proof where appropriate.
Coordinate approved business communication and recovery procedure before maintenance.
Verify the full attack surface and update the mitigation scope.
Implement accountable assignment and escalation with tracked acknowledgment.

Explanation

Correct Answer

Risk remains unmanaged until an owner accepts responsibility. Require vulnerability remediation acknowledgment.

Incorrect Answers

Missing retest tooling does not justify falsely claiming verification. It would handle unavailable vulnerability retest tools, but it would not require vulnerability remediation acknowledgment.

Secure patching includes operational continuity responsibilities. It could help prepare customer notice for disruptive fix, but it would not require vulnerability remediation acknowledgment.

Partial route blocking is not complete risk closure. That is relevant to operational remediation workflow closure, not to require vulnerability remediation acknowledgment.

Question 869

A vulnerability chart mixes high-severity CVSS v2 and CVSS v3 ratings without version tags. Which investigative or response action BEST fits the evidence?

Label scoring systems and avoid direct unqualified severity comparisons.
Show unassessed population explicitly alongside assessed findings.
Normalize duplicates and include affected asset value and exposure.
Use a clear consistent scale and disclose absolute change.

Explanation

Correct Answer

Different scoring standards can produce non-equivalent categories. Avoid mixed CVSS version trend distortion.

Incorrect Answers

Missing coverage must not masquerade as zero vulnerabilities. That is relevant to data visualization and reporting fairness, not to avoid mixed CVSS version trend distortion.

Raw frequency can obscure the most consequential risks. It would correct top-10 vulnerabilities for context, but it would not avoid mixed CVSS version trend distortion.

Honest visualization supports accurate risk decisions. It could help avoid misleading severity trend chart, but it would not avoid mixed CVSS version trend distortion.

Question 870

A nontechnical product owner receives unfiltered scanner output and misunderstands the impact. What is the MOST appropriate analyst action based on the evidence?

Provide exact asset, rule, test evidence and expected corrected state.
Explain the service risk, customer consequence, mitigation options and decision deadline.
Provide authoritative test and remediation evidence under required reporting format.
Share affected build, required remediation and approved service window.

Explanation

Correct Answer

Business owners need consequences and accountable choices. Translate vulnerability finding for product owner.

Incorrect Answers

Technical implementers need operationally actionable detail. That is relevant to vulnerability communication to stakeholders, not to translate vulnerability finding for product owner.

Compliance claims should be supported by independently traceable records. It could help supply auditable security compliance evidence, but it would not translate vulnerability finding for product owner.

Supplier remediation depends on compatible operational scheduling. That is relevant to vulnerability communication to stakeholders, not to translate vulnerability finding for product owner.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 85 - 10 Questions (Last Reviewed 18-Oct-2026)
CompTIA CS0-003 Practice Test 86 - 10 Questions (Last Reviewed 17-Oct-2026)
CompTIA CS0-003 Practice Test 87 - 10 Questions (Last Reviewed 16-Oct-2026)
CompTIA CS0-003 Practice Test 88 - 10 Questions (Last Reviewed 15-Oct-2026)
CompTIA CS0-003 Practice Test 89 - 10 Questions (Last Reviewed 14-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 860

Explanation

Correct Answer

Incorrect Answers

Question 861

Explanation

Correct Answer

Incorrect Answers

Question 862

Explanation

Correct Answer

Incorrect Answers

Question 863

Explanation

Correct Answer

Incorrect Answers

Question 864

Explanation

Correct Answer

Incorrect Answers

Question 865

Explanation

Correct Answer

Incorrect Answers

Question 866

Explanation

Correct Answer

Incorrect Answers

Question 867

Explanation

Correct Answer

Incorrect Answers

Question 868

Explanation

Correct Answer

Incorrect Answers

Question 869

Explanation

Correct Answer

Incorrect Answers

Question 870

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests