CompTIA CS0-003 Practice Test 99

Question 980

An incident report calls a phishing attachment a ransomware infection although no file encrypted. What is the MOST appropriate analyst action based on the evidence?

Provide a qualitative supported confidence assessment with source and limitations.
Report confirmed access and explicitly withhold unverified actor attribution.
Explain attribution uncertainty and compare independent behavior indicators.
Describe confirmed execution stage and observed effects only.

Explanation

Correct Answer

Incident labels should not outrun forensic proof. Avoid unsupported ransomware impact claim.

Incorrect Answers

Pseudoprecise confidence numbers are misleading without calibration. It could help report calibrated attribution uncertainty, but it would not avoid unsupported ransomware impact claim.

Impact evidence and attribution confidence are separate questions. That is relevant to confidence and threat actor communication, not to avoid unsupported ransomware impact claim.

Shared cloud infrastructure does not uniquely link intrusions. It would communicate cloud shared-IP attribution limits, but it would not avoid unsupported ransomware impact claim.

Question 981

An incident report says 'user error caused breach' without examining missing MFA and access controls. Which next step is MOST defensible for the security team?

Document contributing technical and process weaknesses beyond the initial click.
Prioritize lessons and assign verified corrective actions with deadlines.
Validate that control changes or exercises actually address the recorded gaps.
State the entry vector as unresolved and list evidence and next steps.

Explanation

Correct Answer

Root cause review should expose remediable systemic failures. Provide systemic phishing breach root cause.

Incorrect Answers

Recommendations without accountability rarely improve security posture. It would make incident lessons learned actionable, but it would not provide systemic phishing breach root cause.

Participation metrics do not prove reduced security risk. It could help verify lessons learned control outcomes, but it would not provide systemic phishing breach root cause.

Honest uncertainty preserves credibility and guides investigation. That is relevant to root cause and lessons learned reporting, not to provide systemic phishing breach root cause.

Question 982

A customer says their records were stolen but available logs only show failed access attempts. Which action BEST aligns with sound security operations?

Preserve the deadline while validating core facts and coordinating appropriate provisional notice.
Explain the investigation's verified results and evidence gaps without asserting confirmed theft.
Have legal map affected subjects, jurisdictions and trigger dates separately.
Document known detection and discovery milestones without fabricating a first-access date.

Explanation

Correct Answer

Public confidence requires accurate scope and uncertainty. Handle unverified customer data theft complaint.

Incorrect Answers

Time pressure does not justify unsupported factual claims. It would coordinate urgent notification with incomplete evidence, but it would not handle unverified customer data theft complaint.

Notification timing and content may differ by law and affected population. That is relevant to regulatory timing and multi-jurisdiction, not to handle unverified customer data theft complaint.

Legal reporting clocks may hinge on defined knowledge events rather than guessed intrusion onset. It would distinguish discovery time from attack start, but it would not handle unverified customer data theft complaint.

Question 983

The SOC reports no data loss from an incident but telemetry retention expired before the breach window. Which response BEST addresses the security problem described?

Track recurrence and residual identity risk in postincident reporting.
Define and test detection or response outcomes for each investment.
Report evidence limitations rather than definitive absence of theft.
Compare activity onset, detection and containment milestones consistently.

Explanation

Correct Answer

Missing historical logs cannot support confident no-exfiltration claims. Disclose incident data loss visibility limits.

Incorrect Answers

One-dimensional closure metrics hide persistent systemic weakness. It could help report recurring incident root weakness, but it would not disclose incident data loss visibility limits.

Spending activity is not evidence of better security. That is relevant to postincident metrics and review governance, not to disclose incident data loss visibility limits.

Late detection can make apparent post-alert response look fast while impact grows. It could help detect misleading response metric improvement, but it would not disclose incident data loss visibility limits.

Question 984

An incident reaches a legal-notification threshold but the playbook has no designated escalation owner. Which investigative or response action BEST fits the evidence?

Apply severity criteria based on confirmed exposure and potential impact.
Correlate the cases and assign an accountable incident manager.
Escalate per major-incident criteria and alert response leadership immediately.
Escalate to approved legal and privacy authority and correct the missing decision routing.

Explanation

Correct Answer

Statutory triggers require accountable reporting workflows. Route incident statutory escalation.

Incorrect Answers

Prevention events should not automatically consume major-incident resources. That is relevant to incident declaration and escalation, not to route incident statutory escalation.

Coordinated ownership prevents fragmented containment. It would consolidate linked identity incidents under commander, but it would not route incident statutory escalation.

Active business impact justifies coordinated urgent incident command. It could help declare major incident for active ransomware, but it would not route incident statutory escalation.

Question 985

The incident was contained successfully but after-action analysis finds a new data-retention obligation. What is the MOST appropriate analyst action based on the evidence?

Coordinate updated legal retention rules and evidence-handling controls.
Assess systemic process and control factors in a blameless evidence-led review.
Redact or aggregate sensitive details for the approved external audience.
Set owner, deadline, success measure and follow-up test for each action.

Explanation

Correct Answer

Postincident governance findings can outlast initial technical closure. Address new evidence retention obligation after incident.

Incorrect Answers

Individualized blame obscures defects that can cause repeat incidents. It could help produce nonpunitive root cause postmortem, but it would not address new evidence retention obligation after incident.

Useful lessons can be shared without exposing affected individuals. That is relevant to incident postmortem communication maturity, not to address new evidence retention obligation after incident.

Improvements require accountable execution and verification. It would make postmortem recommendations measurable, but it would not address new evidence retention obligation after incident.

Question 986

Confirmed exposure of regulated records triggers a potential statutory notification obligation. Which next step is MOST defensible for the security team?

Provide verified data classes, impacted populations and incident chronology through approved counsel.
Engage legal and privacy decision owners to assess applicable deadlines and evidence.
Preserve scoped evidence under legal guidance before any disposition.
Describe the visibility limit and use bounded estimates only when evidence supports them.

Explanation

Correct Answer

Regulatory reporting requires jurisdiction-specific authorized judgment. Activate legal breach notification assessment.

Incorrect Answers

Regulators need protected information impact, not just technical artifacts. It could help tailor regulatory breach response facts, but it would not activate legal breach notification assessment.

Litigation or preservation duties can continue beyond technical containment. It would prevent deletion of legally held incident logs, but it would not activate legal breach notification assessment.

Missing telemetry prevents definitive no-access conclusions. It could help communicate unknown breach scope honestly, but it would not activate legal breach notification assessment.

Question 987

A contractor requests all incident logs to help investigate one affected service. Which action BEST aligns with sound security operations?

Clarify contractual notification responsibility and obtain legal approval for actual notices.
Distinguish provider infrastructure security from customer identity compromise.
Share scoped relevant logs with approved confidentiality and access controls.
Establish a shared authorized event chronology with source attribution.

Explanation

Correct Answer

Third-party assistance does not justify unrestricted evidence disclosure. Limit incident evidence shared with vendor.

Incorrect Answers

Shared-response ambiguity can cause deadline failures. That is relevant to response communication with external vendors, not to limit incident evidence shared with vendor.

Shared responsibility can yield tenant incidents without provider breach. It would classify cloud provider versus tenant incident, but it would not limit incident evidence shared with vendor.

Coordinated timeline reconciles cross-provider evidence while preserving provenance. That is relevant to response communication with external vendors, not to limit incident evidence shared with vendor.

Question 988

Lessons learned result in tool purchases but no measured coverage improvement. Which response BEST addresses the security problem described?

Track recurrence and residual identity risk in postincident reporting.
Compare activity onset, detection and containment milestones consistently.
Report evidence limitations rather than definitive absence of theft.
Define and test detection or response outcomes for each investment.

Explanation

Correct Answer

Spending activity is not evidence of better security. Tie incident improvement cost to effectiveness.

Incorrect Answers

One-dimensional closure metrics hide persistent systemic weakness. It would report recurring incident root weakness, but it would not tie incident improvement cost to effectiveness.

Late detection can make apparent post-alert response look fast while impact grows. It could help detect misleading response metric improvement, but it would not tie incident improvement cost to effectiveness.

Missing historical logs cannot support confident no-exfiltration claims. That is relevant to postincident metrics and review governance, not to tie incident improvement cost to effectiveness.

Question 989

An incident disables authentication for a remote service but local operations remain safe. Which investigative or response action BEST fits the evidence?

Describe business service availability and fallback status distinctly.
Evaluate potential domain-wide privilege reach, not just compromised-host count.
Report actual availability impact rather than assuming enterprise data breach.
Emphasize integrity impact and reconciliation requirements.

Explanation

Correct Answer

Impact reporting should differentiate affected and unaffected operations. Communicate bounded authentication outage impact.

Incorrect Answers

Small observed host scope can carry broad credential impact. That is relevant to incident severity versus impact reporting, not to communicate bounded authentication outage impact.

Host count alone does not imply confidentiality loss. It would separate large host count from data breach, but it would not communicate bounded authentication outage impact.

Data tampering can have severe financial consequences without exfiltration. It could help report significant integrity incident without theft, but it would not communicate bounded authentication outage impact.

Question 990

A containment playbook runs automatically at 10:05 but isolation completes only at 10:17. What is the MOST appropriate analyst action based on the evidence?

Track technical eradication and legal case closure as separate milestones.
Measure completed containment from appropriate start, not API submission.
Flag the metric as limited and assess better event-onset evidence.
Normalize workload by complexity and relevant operational scope.

Explanation

Correct Answer

Asynchronous action initiation is not achieved response outcome. Report true automation containment completion time.

Incorrect Answers

Operational response time should not be conflated with administrative lifecycle. That is relevant to incident response metric definitions, not to report true automation containment completion time.

Detection-time metrics cannot be precise without a consistent true start. It could help qualify MTTD when onset unknown, but it would not report true automation containment completion time.

Raw counts can penalize analysts handling complex incidents. That is relevant to incident response metric definitions, not to report true automation containment completion time.

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests

CompTIA CS0-003 Practice Test 97 - 10 Questions (Last Reviewed 06-Oct-2026)
CompTIA CS0-003 Practice Test 98 - 10 Questions (Last Reviewed 05-Oct-2026)
CompTIA CS0-003 Practice Test 99 - 10 Questions (Last Reviewed 04-Oct-2026)
CompTIA CS0-003 Practice Test 100 - 10 Questions (Last Reviewed 03-Oct-2026)

Pass Your CompTIA CS0-003 Exam Easy!

Question 980

Explanation

Correct Answer

Incorrect Answers

Question 981

Explanation

Correct Answer

Incorrect Answers

Question 982

Explanation

Correct Answer

Incorrect Answers

Question 983

Explanation

Correct Answer

Incorrect Answers

Question 984

Explanation

Correct Answer

Incorrect Answers

Question 985

Explanation

Correct Answer

Incorrect Answers

Question 986

Explanation

Correct Answer

Incorrect Answers

Question 987

Explanation

Correct Answer

Incorrect Answers

Question 988

Explanation

Correct Answer

Incorrect Answers

Question 989

Explanation

Correct Answer

Incorrect Answers

Question 990

Explanation

Correct Answer

Incorrect Answers

CompTIA CySA+ (CS0-003) (CS0-003) Practice Tests