CompTIA CS0-003 Practice Test 91

Question 900

A report uses a proprietary scanner severity label without its risk scoring policy. What is the MOST appropriate analyst action based on the evidence?

Add affected components, exploit prerequisites and business risk interpretation.
Identify coverage failure and request a retest; never report a true negative.
Redact secrets and limit report access while protecting original secured evidence.
Include the rating methodology and relevant environmental adjustments.

Explanation

Correct Answer

Readers need scoring definitions to interpret severity consistently. Disclose proprietary scanner severity basis.

Incorrect Answers

Implementers need scope and managers need relevant consequences. That is relevant to scanner-to-stakeholder communication integrity, not to disclose proprietary scanner severity basis.

An inaccessible target has unknown vulnerability status. It would correct inaccurate scan pass report, but it would not disclose proprietary scanner severity basis.

Reports can create new disclosure paths for captured credentials. It could help remove secrets from distributed scanner evidence, but it would not disclose proprietary scanner severity basis.

Question 901

A new exploit is observed against an asset already scheduled for a fix next month. Which next step is MOST defensible for the security team?

Escalate changed urgency and communicate revised interim controls.
Present the security risk and operational impact for an authorized decision.
Report an asset verification task and uncertainty before declaring enterprise exposure.
Request provider or management evidence of affected-version closure.

Explanation

Correct Answer

Confirmed active exploitation shifts likelihood and remediation priority. Update remediation after active exploitation.

Incorrect Answers

Executives need both cyber and service consequences to choose containment. It could help communicate safe emergency shutdown trade-off, but it would not update remediation after active exploitation.

Unknown inventory is not proof of either vulnerability or safety. That is relevant to emerging vulnerability risk and monitoring, not to update remediation after active exploitation.

Outsourced patching does not remove the need for assurance. It would validate managed cloud patch status, but it would not update remediation after active exploitation.

Question 902

A product engineer needs concrete reproduction conditions to fix an authentication bypass. Which action BEST aligns with sound security operations?

Link exploitable exposure and recovery dependencies to the warehouse service.
Provide approved reproduction steps and the required authorization boundary.
Compare claimed fix scope against actual inventory and validated versions.
Distinguish vulnerability potential from observed data access and relevant records.

Explanation

Correct Answer

Clear technical evidence supports a targeted root-cause fix. Give engineer actionable auth bypass finding.

Incorrect Answers

Business-specific scenarios make vulnerability information decision-ready. It could help answer executive operational continuity concern, but it would not give engineer actionable auth bypass finding.

Supplier assurance needs asset-level confirmation. It would evaluate supplier patch completeness, but it would not give engineer actionable auth bypass finding.

Legal decisions depend on confirmed event facts and applicable obligations. It could help report vulnerability versus breach for legal team, but it would not give engineer actionable auth bypass finding.

Question 903

A dashboard's average time to fix excludes unresolved older findings. Which response BEST addresses the security problem described?

Present distinct treatment outcomes and residual risk for each category.
Calculate metrics using the contractual calendar basis and correct the report.
Include aging open items and a clearly defined closure cohort.
Report risk-weighted reduction and the remaining known exploited exposure.

Explanation

Correct Answer

Survivorship bias makes performance appear better than real backlog. Correct vulnerability remediation time bias.

Incorrect Answers

Acceptance does not demonstrate elimination of the underlying flaw. That is relevant to remediation measurement and priorities, not to correct vulnerability remediation time bias.

Time basis differences can create false compliance. It would calculate correct contractual vulnerability SLA, but it would not correct vulnerability remediation time bias.

High volume alone does not prove effective risk reduction. That is relevant to remediation measurement and priorities, not to correct vulnerability remediation time bias.

Question 904

Security staff announce a vulnerability as exploited without any observed attacks. Which investigative or response action BEST fits the evidence?

Update stakeholders on new treatment options and revised maintenance impact.
Present likelihood, business exposure, interim controls and explicit decision alternatives.
Escalate a documented residual-risk decision and exception expiration.
Label exploitation as unconfirmed and distinguish vendor advisory from local evidence.

Explanation

Correct Answer

Risk communication must separate vulnerability from incident. Avoid overstating observed zero-day exploitation.

Incorrect Answers

New fix availability changes the risk-treatment decision. It would refresh zero-day remediation communication, but it would not avoid overstating observed zero-day exploitation.

Risk decisions require impact and options, not an unqualified alarm. It could help communicate zero-day decision options, but it would not avoid overstating observed zero-day exploitation.

Compensating controls are not automatically formal risk acceptance. That is relevant to critical zero-day communication, not to avoid overstating observed zero-day exploitation.

Question 905

A zero-day has no patch and leadership asks whether to shut down the affected service. What is the MOST appropriate analyst action based on the evidence?

Present likelihood, business exposure, interim controls and explicit decision alternatives.
Escalate a documented residual-risk decision and exception expiration.
Label exploitation as unconfirmed and distinguish vendor advisory from local evidence.
Update stakeholders on new treatment options and revised maintenance impact.

Explanation

Correct Answer

Risk decisions require impact and options, not an unqualified alarm. Communicate zero-day decision options.

Incorrect Answers

Compensating controls are not automatically formal risk acceptance. That is relevant to critical zero-day communication, not to communicate zero-day decision options.

Risk communication must separate vulnerability from incident. It would avoid overstating observed zero-day exploitation, but it would not communicate zero-day decision options.

New fix availability changes the risk-treatment decision. It could help refresh zero-day remediation communication, but it would not communicate zero-day decision options.

Question 906

A trend graph cuts off the vertical axis to exaggerate a small remediation improvement. Which next step is MOST defensible for the security team?

Show unassessed population explicitly alongside assessed findings.
Use a clear consistent scale and disclose absolute change.
Label scoring systems and avoid direct unqualified severity comparisons.
Normalize duplicates and include affected asset value and exposure.

Explanation

Correct Answer

Honest visualization supports accurate risk decisions. Avoid misleading severity trend chart.

Incorrect Answers

Missing coverage must not masquerade as zero vulnerabilities. That is relevant to data visualization and reporting fairness, not to avoid misleading severity trend chart.

Different scoring standards can produce non-equivalent categories. It could help avoid mixed CVSS version trend distortion, but it would not avoid misleading severity trend chart.

Raw frequency can obscure the most consequential risks. That is relevant to data visualization and reporting fairness, not to avoid misleading severity trend chart.

Question 907

An emergency vulnerability bulletin lacks a business continuity plan for the recommended shutdown. Which action BEST aligns with sound security operations?

Escalate changed urgency and communicate revised interim controls.
Report an asset verification task and uncertainty before declaring enterprise exposure.
Present the security risk and operational impact for an authorized decision.
Request provider or management evidence of affected-version closure.

Explanation

Correct Answer

Executives need both cyber and service consequences to choose containment. Communicate safe emergency shutdown trade-off.

Incorrect Answers

Confirmed active exploitation shifts likelihood and remediation priority. It would update remediation after active exploitation, but it would not communicate safe emergency shutdown trade-off.

Unknown inventory is not proof of either vulnerability or safety. It could help communicate CVE exposure uncertainty, but it would not communicate safe emergency shutdown trade-off.

Outsourced patching does not remove the need for assurance. It would validate managed cloud patch status, but it would not communicate safe emergency shutdown trade-off.

Question 908

A new SaaS product is in scope for risk management but cannot be scanned directly. Which response BEST addresses the security problem described?

Label them unassessed and plan authorized coverage before declaring compliance.
Reconcile retirement records against actual network observations.
Request rule effectiveness evidence and residual path review.
Obtain vendor assurance and contractual evidence under approved access paths.

Explanation

Correct Answer

Third-party assessments may use different proof methods from network scans. Include SaaS risk assurance without illegal scanning.

Incorrect Answers

No scan data cannot be counted as security assurance. It could help correct unassessed segmented systems report, but it would not include SaaS risk assurance without illegal scanning.

Supposed retirement is not proof an exposed device was removed. That is relevant to asset coverage and lifecycle reporting, not to include SaaS risk assurance without illegal scanning.

A claimed compensating control needs validated operation. It would verify legacy network isolation control, but it would not include SaaS risk assurance without illegal scanning.

Question 909

A compliance report states all data is encrypted but omits exceptions for a legacy database. Which investigative or response action BEST fits the evidence?

Report the exception, residual exposure and approved compensating controls.
Identify the benchmark release and explain mapped control differences.
Supply appropriately authorized external assessment evidence for applicable systems.
Attach reproducible evidence metadata for controls tested.

Explanation

Correct Answer

Incomplete exceptions make compliance statements misleading. Include encryption exceptions in compliance report.

Incorrect Answers

Control baseline version is necessary to interpret compliance results. It would disclose baseline version in audit report, but it would not include encryption exceptions in compliance report.

Regulatory test scope and method are part of compliance proof. It could help report PCI external scan evidence, but it would not include encryption exceptions in compliance report.

Audit artifacts need traceable asset and observation context. That is relevant to compliance and evidence reports, not to include encryption exceptions in compliance report.

Question 910

A hotfix is deployed directly to production and later causes outages. What is the MOST appropriate analyst action based on the evidence?

Tie vulnerability recurrence to software build and release controls.
Report emergency authorization, testing gaps and corrective change practices.
Verify patch state through alternate authorized credentials before declaring fixed.
Document verified operational constraints and controlled alternate safeguards.

Explanation

Correct Answer

Risk treatment must include safe execution and traceable governance. Report emergency patch change control defect.

Incorrect Answers

Reintroduced components indicate supply-chain or build policy drift. It would report reintroduced vulnerable dependency, but it would not report emergency patch change control defect.

Scanner reachability loss is not software remediation. That is relevant to change management link to vulnerabilities, not to report emergency patch change control defect.

Regulated or certified equipment may need nonstandard safe remediation sequences. It would explain regulated asset patch constraint, but it would not report emergency patch change control defect.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 89 - 10 Questions (Last Reviewed 14-Oct-2026)
CompTIA CS0-003 Practice Test 90 - 10 Questions (Last Reviewed 13-Oct-2026)
CompTIA CS0-003 Practice Test 91 - 10 Questions (Last Reviewed 12-Oct-2026)
CompTIA CS0-003 Practice Test 92 - 10 Questions (Last Reviewed 11-Oct-2026)
CompTIA CS0-003 Practice Test 93 - 10 Questions (Last Reviewed 10-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 900

Explanation

Correct Answer

Incorrect Answers

Question 901

Explanation

Correct Answer

Incorrect Answers

Question 902

Explanation

Correct Answer

Incorrect Answers

Question 903

Explanation

Correct Answer

Incorrect Answers

Question 904

Explanation

Correct Answer

Incorrect Answers

Question 905

Explanation

Correct Answer

Incorrect Answers

Question 906

Explanation

Correct Answer

Incorrect Answers

Question 907

Explanation

Correct Answer

Incorrect Answers

Question 908

Explanation

Correct Answer

Incorrect Answers

Question 909

Explanation

Correct Answer

Incorrect Answers

Question 910

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests