CompTIA CS0-003 Practice Test 95

Question 940

A quarterly report claims response is faster because detections occur later in attackers' campaigns. What is the MOST appropriate analyst action based on the evidence?

Report evidence limitations rather than definitive absence of theft.
Track recurrence and residual identity risk in postincident reporting.
Define and test detection or response outcomes for each investment.
Compare activity onset, detection and containment milestones consistently.

Explanation

Correct Answer

Late detection can make apparent post-alert response look fast while impact grows. Detect misleading response metric improvement.

Incorrect Answers

Missing historical logs cannot support confident no-exfiltration claims. It would disclose incident data loss visibility limits, but it would not detect misleading response metric improvement.

One-dimensional closure metrics hide persistent systemic weakness. It could help report recurring incident root weakness, but it would not detect misleading response metric improvement.

Spending activity is not evidence of better security. That is relevant to postincident metrics and review governance, not to detect misleading response metric improvement.

Question 941

A retrospective produces 35 suggestions with no assigned owners or completion criteria. Which next step is MOST defensible for the security team?

Prioritize lessons and assign verified corrective actions with deadlines.
Validate that control changes or exercises actually address the recorded gaps.
Document contributing technical and process weaknesses beyond the initial click.
State the entry vector as unresolved and list evidence and next steps.

Explanation

Correct Answer

Recommendations without accountability rarely improve security posture. Make incident lessons learned actionable.

Incorrect Answers

Participation metrics do not prove reduced security risk. That is relevant to root cause and lessons learned reporting, not to make incident lessons learned actionable.

Root cause review should expose remediable systemic failures. It would provide systemic phishing breach root cause, but it would not make incident lessons learned actionable.

Honest uncertainty preserves credibility and guides investigation. It could help report unknown initial access without invention, but it would not make incident lessons learned actionable.

Question 942

Two incidents share one IP belonging to a large cloud provider. Which action BEST aligns with sound security operations?

Provide a qualitative supported confidence assessment with source and limitations.
Explain attribution uncertainty and compare independent behavior indicators.
Describe confirmed execution stage and observed effects only.
Report confirmed access and explicitly withhold unverified actor attribution.

Explanation

Correct Answer

Shared cloud infrastructure does not uniquely link intrusions. Communicate cloud shared-IP attribution limits.

Incorrect Answers

Pseudoprecise confidence numbers are misleading without calibration. That is relevant to confidence and threat actor communication, not to communicate cloud shared-IP attribution limits.

Incident labels should not outrun forensic proof. It could help avoid unsupported ransomware impact claim, but it would not communicate cloud shared-IP attribution limits.

Impact evidence and attribution confidence are separate questions. That is relevant to confidence and threat actor communication, not to communicate cloud shared-IP attribution limits.

Question 943

A malware outbreak affects 20 kiosk devices with no sensitive data and rapid restoration capability. Which response BEST addresses the security problem described?

Emphasize integrity impact and reconciliation requirements.
Evaluate potential domain-wide privilege reach, not just compromised-host count.
Report actual availability impact rather than assuming enterprise data breach.
Describe business service availability and fallback status distinctly.

Explanation

Correct Answer

Host count alone does not imply confidentiality loss. Separate large host count from data breach.

Incorrect Answers

Data tampering can have severe financial consequences without exfiltration. It would report significant integrity incident without theft, but it would not separate large host count from data breach.

Small observed host scope can carry broad credential impact. It could help assess credential blast radius in incident severity, but it would not separate large host count from data breach.

Impact reporting should differentiate affected and unaffected operations. It would communicate bounded authentication outage impact, but it would not separate large host count from data breach.

Question 944

An incident spans two suppliers that each maintain separate partial timelines. Which investigative or response action BEST fits the evidence?

Distinguish provider infrastructure security from customer identity compromise.
Clarify contractual notification responsibility and obtain legal approval for actual notices.
Share scoped relevant logs with approved confidentiality and access controls.
Establish a shared authorized event chronology with source attribution.

Explanation

Correct Answer

Coordinated timeline reconciles cross-provider evidence while preserving provenance. Reconcile multi-supplier incident chronology.

Incorrect Answers

Shared responsibility can yield tenant incidents without provider breach. It could help classify cloud provider versus tenant incident, but it would not reconcile multi-supplier incident chronology.

Shared-response ambiguity can cause deadline failures. That is relevant to response communication with external vendors, not to reconcile multi-supplier incident chronology.

Third-party assistance does not justify unrestricted evidence disclosure. It would limit incident evidence shared with vendor, but it would not reconcile multi-supplier incident chronology.

Question 945

A media inquiry requests internal vulnerability details that could facilitate active exploitation. What is the MOST appropriate analyst action based on the evidence?

Route the request to authorized spokespersons and limit sensitive technical disclosure.
Coordinate one approved factual statement and synchronized update cadence.
Use uncertainty-accurate language reviewed by incident and legal authorities.
Provide approved user action guidance and the scope of affected credentials.

Explanation

Correct Answer

Public transparency must be balanced with ongoing defensive security. Manage media request for exploit details.

Incorrect Answers

Consistent messages reduce confusion and unsupported promises. It would coordinate customer and PR incident statements, but it would not manage media request for exploit details.

Premature absolutes can be false and damage trust. It could help avoid premature public assurance during incident, but it would not manage media request for exploit details.

Actionable communication supports customer risk reduction. That is relevant to public relations and customer communication, not to manage media request for exploit details.

Question 946

A DR team announces recovery before applications pass transaction reconciliation checks. Which next step is MOST defensible for the security team?

Provide approved partner-specific status and safe alternative or mitigation.
State partial technical restoration until business validation is complete.
Communicate confidence ranges and dependencies rather than unsupported certainty.
Provide service-level transaction impact and recovery estimates with uncertainty.

Explanation

Correct Answer

Availability tests do not prove restored business correctness. Distinguish technical restore from business recovery.

Incorrect Answers

Third-party business dependencies require coordinated incident communication. It would update impacted API business partner, but it would not distinguish technical restore from business recovery.

Honest forecasts depend on verified restoration prerequisites. That is relevant to business continuity incident updates, not to distinguish technical restore from business recovery.

Business stakeholders need outcome-based operational information. It would communicate payment service outage impact, but it would not distinguish technical restore from business recovery.

Question 947

A report says 30 devices were compromised based on shared indicators but only three have verified malicious execution. Which action BEST aligns with sound security operations?

Translate detection status into risk, recovery and resource choices in plain language.
Publish a time-stamped revision with sources and prior-estimate explanation.
Separate confirmed infections from devices under investigation and state criteria.
Remove unsupported location attribution and describe confirmed infrastructure only.

Explanation

Correct Answer

Indicator matches alone cannot establish full endpoint compromise. Differentiate confirmed infections and suspected devices.

Incorrect Answers

Senior decision makers need actionable context over tool terminology. It could help make executive incident briefing accessible, but it would not differentiate confirmed infections and suspected devices.

Incident impact numbers often mature as accounting evidence becomes available. That is relevant to evidence confidence in executive communication, not to differentiate confirmed infections and suspected devices.

VPN and cloud egress geography are poor indicators of the person's location. It could help avoid false attacker geography claim, but it would not differentiate confirmed infections and suspected devices.

Question 948

A report includes a malware filename but no hash, host or acquisition timestamp. Which response BEST addresses the security problem described?

Reconcile time zones, drift and source event identity before publishing.
Qualify the statement as attempts pending successful access or execution evidence.
Move to controlled evidence storage with custodian metadata and restricted access.
Add verified artifact identifiers, affected system and collection context.

Explanation

Correct Answer

Reproducible technical evidence supports later validation. Strengthen malware artifact incident report.

Incorrect Answers

Incorrect time normalization can produce impossible event sequences. That is relevant to technical incident report evidence, not to strengthen malware artifact incident report.

Failed authentication alone does not demonstrate lateral compromise. It would avoid unsupported lateral movement claim, but it would not strengthen malware artifact incident report.

Reports should reference preserved artifacts with reliable provenance. It could help preserve screenshot evidence traceability, but it would not strengthen malware artifact incident report.

Question 949

A follow-up report declares all lessons complete based on meeting attendance. Which investigative or response action BEST fits the evidence?

Validate that control changes or exercises actually address the recorded gaps.
Document contributing technical and process weaknesses beyond the initial click.
Prioritize lessons and assign verified corrective actions with deadlines.
State the entry vector as unresolved and list evidence and next steps.

Explanation

Correct Answer

Participation metrics do not prove reduced security risk. Verify lessons learned control outcomes.

Incorrect Answers

Root cause review should expose remediable systemic failures. It could help provide systemic phishing breach root cause, but it would not verify lessons learned control outcomes.

Recommendations without accountability rarely improve security posture. That is relevant to root cause and lessons learned reporting, not to verify lessons learned control outcomes.

Honest uncertainty preserves credibility and guides investigation. It would report unknown initial access without invention, but it would not verify lessons learned control outcomes.

Question 950

A police request asks for an entire employee mailbox unrelated to the suspected intrusion scope. What is the MOST appropriate analyst action based on the evidence?

Restrict allegations and seek authorized legal guidance on attribution.
Seek legal review and apply appropriate request scope and preservation.
Provide verified integrity and chain-of-custody documentation before reliance.
Coordinate release through legal and authorized law-enforcement liaison.

Explanation

Correct Answer

External requests should not automatically override privacy and proportionality controls. Evaluate law-enforcement mailbox request scope.

Incorrect Answers

Premature accusations risk unjustified harm and evidentiary distortion. It could help prevent premature incident suspect disclosure, but it would not evaluate law-enforcement mailbox request scope.

Evidence integrity underpins future investigative and legal use. It would validate forensic transfer to investigator, but it would not evaluate law-enforcement mailbox request scope.

Evidence disclosure needs lawful authority and chain-of-custody control. It could help route incident evidence to law enforcement properly, but it would not evaluate law-enforcement mailbox request scope.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 93 - 10 Questions (Last Reviewed 10-Oct-2026)
CompTIA CS0-003 Practice Test 94 - 10 Questions (Last Reviewed 09-Oct-2026)
CompTIA CS0-003 Practice Test 95 - 10 Questions (Last Reviewed 08-Oct-2026)
CompTIA CS0-003 Practice Test 96 - 10 Questions (Last Reviewed 07-Oct-2026)
CompTIA CS0-003 Practice Test 97 - 10 Questions (Last Reviewed 06-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 940

Explanation

Correct Answer

Incorrect Answers

Question 941

Explanation

Correct Answer

Incorrect Answers

Question 942

Explanation

Correct Answer

Incorrect Answers

Question 943

Explanation

Correct Answer

Incorrect Answers

Question 944

Explanation

Correct Answer

Incorrect Answers

Question 945

Explanation

Correct Answer

Incorrect Answers

Question 946

Explanation

Correct Answer

Incorrect Answers

Question 947

Explanation

Correct Answer

Incorrect Answers

Question 948

Explanation

Correct Answer

Incorrect Answers

Question 949

Explanation

Correct Answer

Incorrect Answers

Question 950

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests