CompTIA CS0-003 Practice Test 89

Question 880

A remediation plan proposes downtime but never includes customer notification steps. What is the MOST appropriate analyst action based on the evidence?

Record temporary status honestly and use approved manual proof where appropriate.
Implement accountable assignment and escalation with tracked acknowledgment.
Verify the full attack surface and update the mitigation scope.
Coordinate approved business communication and recovery procedure before maintenance.

Explanation

Correct Answer

Secure patching includes operational continuity responsibilities. Prepare customer notice for disruptive fix.

Incorrect Answers

Missing retest tooling does not justify falsely claiming verification. It would handle unavailable vulnerability retest tools, but it would not prepare customer notice for disruptive fix.

Risk remains unmanaged until an owner accepts responsibility. It could help require vulnerability remediation acknowledgment, but it would not prepare customer notice for disruptive fix.

Partial route blocking is not complete risk closure. That is relevant to operational remediation workflow closure, not to prepare customer notice for disruptive fix.

Question 881

A configuration compliance dashboard uses last year's CIS benchmark without noting the version. Which next step is MOST defensible for the security team?

Identify the benchmark release and explain mapped control differences.
Report the exception, residual exposure and approved compensating controls.
Supply appropriately authorized external assessment evidence for applicable systems.
Attach reproducible evidence metadata for controls tested.

Explanation

Correct Answer

Control baseline version is necessary to interpret compliance results. Disclose baseline version in audit report.

Incorrect Answers

Incomplete exceptions make compliance statements misleading. That is relevant to compliance and evidence reports, not to disclose baseline version in audit report.

Regulatory test scope and method are part of compliance proof. It would report PCI external scan evidence, but it would not disclose baseline version in audit report.

Audit artifacts need traceable asset and observation context. It could help make compliance evidence reproducible, but it would not disclose baseline version in audit report.

Question 882

A vendor releases an emergency patch after business leaders approved temporary isolation. Which action BEST aligns with sound security operations?

Escalate a documented residual-risk decision and exception expiration.
Update stakeholders on new treatment options and revised maintenance impact.
Label exploitation as unconfirmed and distinguish vendor advisory from local evidence.
Present likelihood, business exposure, interim controls and explicit decision alternatives.

Explanation

Correct Answer

New fix availability changes the risk-treatment decision. Refresh zero-day remediation communication.

Incorrect Answers

Compensating controls are not automatically formal risk acceptance. That is relevant to critical zero-day communication, not to refresh zero-day remediation communication.

Risk communication must separate vulnerability from incident. It could help avoid overstating observed zero-day exploitation, but it would not refresh zero-day remediation communication.

Risk decisions require impact and options, not an unqualified alarm. That is relevant to critical zero-day communication, not to refresh zero-day remediation communication.

Question 883

A vulnerable device is scheduled for retirement but still reachable from users. Which response BEST addresses the security problem described?

Report business constraint, temporary isolation, owner-approved plan and replacement timeline.
Document contractual restriction and agree on vendor-managed remediation and interim controls.
Report live exposure and a short-term isolation plan despite future retirement.
Present delayed patch impact and temporary safeguards for accountable risk approval.

Explanation

Correct Answer

Future disposal does not remove present vulnerability. Communicate interim retired-device risk.

Incorrect Answers

Legacy remediation reporting must balance patient service availability with risk. It would document legacy system patch blocker, but it would not communicate interim retired-device risk.

Unilateral patching may violate support terms and operational assurances. It could help manage vendor-controlled patch inhibitor, but it would not communicate interim retired-device risk.

Business process timing can justify controlled sequencing, not silent neglect. It would report finance maintenance freeze risk, but it would not communicate interim retired-device risk.

Question 884

A report names missing patches but assigns no implementation or validation owners. Which investigative or response action BEST fits the evidence?

Coordinate dependent controls and a single verified closure checkpoint.
Include expiry, monitoring and reassessment trigger in the acceptance record.
Require deployed-build and exposure verification before closure.
Add accountable owner, due date and retest acceptance criteria for each critical item.

Explanation

Correct Answer

A finding becomes useful only with a trackable treatment action. Make vulnerability remediation action plan accountable.

Incorrect Answers

Multiteam vulnerabilities need integrated sequencing and evidence. It could help coordinate patch and firewall remediation actions, but it would not make vulnerability remediation action plan accountable.

Risk acceptance remains controlled only when reassessment is defined. That is relevant to remediation plan and owner follow-through, not to make vulnerability remediation action plan accountable.

Vendor release availability does not prove the target was updated. It would validate vendor patch deployed before closure, but it would not make vulnerability remediation action plan accountable.

Question 885

A remediation notice lists only CVSS but no affected application or business service. What is the MOST appropriate analyst action based on the evidence?

Add affected components, exploit prerequisites and business risk interpretation.
Redact secrets and limit report access while protecting original secured evidence.
Identify coverage failure and request a retest; never report a true negative.
Include the rating methodology and relevant environmental adjustments.

Explanation

Correct Answer

Implementers need scope and managers need relevant consequences. Improve incomplete vulnerability remediation notice.

Incorrect Answers

Reports can create new disclosure paths for captured credentials. It would remove secrets from distributed scanner evidence, but it would not improve incomplete vulnerability remediation notice.

An inaccessible target has unknown vulnerability status. It could help correct inaccurate scan pass report, but it would not improve incomplete vulnerability remediation notice.

Readers need scoring definitions to interpret severity consistently. That is relevant to scanner-to-stakeholder communication integrity, not to improve incomplete vulnerability remediation notice.

Question 886

A vulnerability disappears from scan reports after a firewall rule blocks scanner access. Which next step is MOST defensible for the security team?

Tie vulnerability recurrence to software build and release controls.
Verify patch state through alternate authorized credentials before declaring fixed.
Document verified operational constraints and controlled alternate safeguards.
Report emergency authorization, testing gaps and corrective change practices.

Explanation

Correct Answer

Scanner reachability loss is not software remediation. Avoid false closure caused by scan filtering.

Incorrect Answers

Reintroduced components indicate supply-chain or build policy drift. It would report reintroduced vulnerable dependency, but it would not avoid false closure caused by scan filtering.

Regulated or certified equipment may need nonstandard safe remediation sequences. That is relevant to change management link to vulnerabilities, not to avoid false closure caused by scan filtering.

Risk treatment must include safe execution and traceable governance. It would report emergency patch change control defect, but it would not avoid false closure caused by scan filtering.

Question 887

A workaround blocks one exposed route but leaves alternate API endpoints vulnerable. Which action BEST aligns with sound security operations?

Coordinate approved business communication and recovery procedure before maintenance.
Implement accountable assignment and escalation with tracked acknowledgment.
Verify the full attack surface and update the mitigation scope.
Record temporary status honestly and use approved manual proof where appropriate.

Explanation

Correct Answer

Partial route blocking is not complete risk closure. Validate all vulnerable API paths.

Incorrect Answers

Secure patching includes operational continuity responsibilities. It could help prepare customer notice for disruptive fix, but it would not validate all vulnerable API paths.

Risk remains unmanaged until an owner accepts responsibility. That is relevant to operational remediation workflow closure, not to validate all vulnerable API paths.

Missing retest tooling does not justify falsely claiming verification. It could help handle unavailable vulnerability retest tools, but it would not validate all vulnerable API paths.

Question 888

A compliance auditor asks why a high-severity finding remained open for 60 days. Which response BEST addresses the security problem described?

Restrict the report to approved recipients and mask identifying details in external copies.
Obtain effective installed version and runtime verification output.
Maintain a canonical remediation register with evidence-backed owner approvals.
Present risk approval, interim mitigations, ownership and dated remediation evidence.

Explanation

Correct Answer

Defensible exceptions need a documented decision trail. Justify overdue vulnerability audit trail.

Incorrect Answers

Disclosure of asset naming can increase reconnaissance risk. That is relevant to audit-ready vulnerability disposition, not to justify overdue vulnerability audit trail.

Executing an installer does not prove successful remediation. It would strengthen proof of patched vulnerability, but it would not justify overdue vulnerability audit trail.

Consolidated records prevent contradictory closure claims across tools. It could help coordinate cross-vendor vulnerability evidence, but it would not justify overdue vulnerability audit trail.

Question 889

A report includes a top-10 list dominated by low-value kiosks with repeated identical findings. Which investigative or response action BEST fits the evidence?

Normalize duplicates and include affected asset value and exposure.
Label scoring systems and avoid direct unqualified severity comparisons.
Show unassessed population explicitly alongside assessed findings.
Use a clear consistent scale and disclose absolute change.

Explanation

Correct Answer

Raw frequency can obscure the most consequential risks. Correct top-10 vulnerabilities for context.

Incorrect Answers

Different scoring standards can produce non-equivalent categories. It could help avoid mixed CVSS version trend distortion, but it would not correct top-10 vulnerabilities for context.

Missing coverage must not masquerade as zero vulnerabilities. That is relevant to data visualization and reporting fairness, not to correct top-10 vulnerabilities for context.

Honest visualization supports accurate risk decisions. It would avoid misleading severity trend chart, but it would not correct top-10 vulnerabilities for context.

Question 890

A critical new CVE is disclosed but the inventory lacks evidence whether the product is deployed. What is the MOST appropriate analyst action based on the evidence?

Escalate changed urgency and communicate revised interim controls.
Report an asset verification task and uncertainty before declaring enterprise exposure.
Request provider or management evidence of affected-version closure.
Present the security risk and operational impact for an authorized decision.

Explanation

Correct Answer

Unknown inventory is not proof of either vulnerability or safety. Communicate CVE exposure uncertainty.

Incorrect Answers

Confirmed active exploitation shifts likelihood and remediation priority. It could help update remediation after active exploitation, but it would not communicate CVE exposure uncertainty.

Outsourced patching does not remove the need for assurance. It would validate managed cloud patch status, but it would not communicate CVE exposure uncertainty.

Executives need both cyber and service consequences to choose containment. It could help communicate safe emergency shutdown trade-off, but it would not communicate CVE exposure uncertainty.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 87 - 10 Questions (Last Reviewed 16-Oct-2026)
CompTIA CS0-003 Practice Test 88 - 10 Questions (Last Reviewed 15-Oct-2026)
CompTIA CS0-003 Practice Test 89 - 10 Questions (Last Reviewed 14-Oct-2026)
CompTIA CS0-003 Practice Test 90 - 10 Questions (Last Reviewed 13-Oct-2026)
CompTIA CS0-003 Practice Test 91 - 10 Questions (Last Reviewed 12-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 880

Explanation

Correct Answer

Incorrect Answers

Question 881

Explanation

Correct Answer

Incorrect Answers

Question 882

Explanation

Correct Answer

Incorrect Answers

Question 883

Explanation

Correct Answer

Incorrect Answers

Question 884

Explanation

Correct Answer

Incorrect Answers

Question 885

Explanation

Correct Answer

Incorrect Answers

Question 886

Explanation

Correct Answer

Incorrect Answers

Question 887

Explanation

Correct Answer

Incorrect Answers

Question 888

Explanation

Correct Answer

Incorrect Answers

Question 889

Explanation

Correct Answer

Incorrect Answers

Question 890

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests