CS0-003 — frequently asked questions

Testing occurs in a sandbox environment before deployment, per CompTIA remediation guidance. Since the technician already applied the patch, the remaining step is validation on the production server.

Validation confirms the patch installed successfully and the vulnerability is closed—often by rescanning with the vulnerability tool—plus checking logs and verifying the server and its connected systems still work as intended.

Rollback is only selected when validation shows the patch failed to remediate the vulnerability or caused functionality issues; it is a conditional corrective action, not the standard next step.

Option B includes 'Yes' for Smear and Channing, which are explicitly lower priority. Since we want to patch the most urgent risks based on the team's preferences, maximizing high-priority metrics is superior.

Treat custom names as placeholders. Map them to their described importance (e.g., 'more important' vs 'less important') rather than guessing their meaning from the name itself.

IP ranges are dynamic and easily spoofed. If there is no business need for the country, blocking the entire region is a more robust and manageable long-term strategy.

While it can impact legitimate users, the question specifies no business exists there, implying zero expected legitimate traffic. Thus, the broad block is justified by the risk profile.

Copying files misses deleted data, slack space, and unallocated clusters. An image captures the entire disk structure bit-for-bit.

No, generating a hash is a read-only operation. It calculates a value based on the data without altering the data itself.

Legal hold prevents deletion or modification going forward but does not capture the current state of the device, including deleted files or volatile data.

While SHA-1 is deprecated for security cryptography, it is still widely accepted in forensics for verifying the integrity of a copied image against the original.

Yes, through OS fingerprinting techniques analyzing network responses and service banners.

The scanner is configured with subnets, so it actively probes and discovers the IP addresses within those ranges.

No. Base score combines exploitability and impact. A vuln can have a low base score (hard to exploit) but high impact if successfully used.

Option A has High Confidentiality and Integrity impacts. The question asks for 'least impactful,' not 'lowest risk score.'

MFA prevents unauthorized access going forward, but it does not negate the fact that the stolen passwords are still valid for existing sessions or other services where MFA isn't used.

Encryption protects passwords at rest. Once they are leaked, encryption is irrelevant to stopping the attacker who already has the data; changing the password removes the risk entirely.

Shutting down the email server causes unnecessary business disruption. Since the infected workstation was already isolated, the immediate threat of lateral movement from that specific machine is contained.

No. While identifying other victims is important, the evidence on the confirmed infected system must be preserved first. Receiving an email does not guarantee infection, making imaging the higher-priority action.

While closely related, CompTIA often treats the 'investigation' as determining what happened, and 'root cause analysis' as the subsequent deep-dive into why it happened during the post-incident phase.

IRPs are updated during the post-incident activity phase based on lessons learned from root cause analysis, but the update itself is not the immediate action of analyzing the specific incident.

CySA+ names executives, managers, IT staff, and external partners as report audiences, not product owners; product owners are a business role, while administrators handle remediation.

Executives need the summarized risk posture to prioritize funding, while systems administration needs detailed findings to patch and reconfigure affected systems.

The question says the malware disables host security services, so the exam treats EDR as unavailable; the cleanup left registry and file system metadata as the intended surviving sources.

The scenario explicitly says the malware removes prefetch files and event log entries, which eliminates D and F before analysis.

CASB blocking is containment, but it cannot recall the already-sent PII and may prompt the employee to delete evidence; the mailbox legal hold must come first.

Usually no; legal or compliance executes the hold, but the analyst should immediately recommend it so mailbox retention and evidence preservation begin.

An audit tool is a detective control: it records or verifies changes after they occur, but it does not provide a rollback path or identify dependent assets that will be impacted.

No. A post-change backup captures the already-modified state; rollback needs a documented recovery plan and a restorable pre-change state.

A lockout could break authentication, but the scenario gives no failed-logon or lockout evidence and points to one feed failing while unrelated open feeds remain healthy.

Only if there were a subscription or billing failure, which the question never mentions; open feeds continuing alone does not prove the firewall feed is paid.

IDS logs show network detections and signatures, but they do not provide the account-level authentication context—source, timing, MFA result—needed to judge whether IdP access is malicious.

It could capture cleartext traffic for confirmation, but tcpdump is a packet-capture tool, not an account log, and it is not the log source for determining user malicious intent.

shtml.exe only enables a denial-of-service crash of FrontPage extensions, which affects availability. phpList exposes an admin login using default credentials, giving an attacker direct administrative control.

No. The tiki entry depends on a specific vulnerable build being reachable, while the phpList line already names a working default admin credential plus documented remote admin access.

The 41.21.18.102 login succeeds from an external address just before the /var/www/index.html write; 32.111.16.37 shows only one failed attempt after a valid login, which is weaker evidence.

Change the sjames account password to evict the compromised credential, and block external SFTP access so the same external path cannot be reused.

The Cyber Kill Chain describes the stages of an intrusion after an adversary acts; it does not map the data flows, trust boundaries, or exposed services that define a new environment's attack surface.

During design, threat modeling maps data flows, trust boundaries, open ports, and exposed services so the attack surface can be reduced before deployment.

A blanket rewrite happens before the asset data is verified, so the same decommissioned resources get re-embedded and sound procedures may be damaged. Fix the inventory first, then update only the affected steps.

Those playbooks still cover valid threat scenarios and are needed during an incident. The stale asset references should be corrected, not the entire procedure retired.

DLP detects policy violations and possible data exfiltration, but it gives limited visibility into the sequence of adversary behaviors; UEBA and EDR map broader TTPs across identity and endpoint activity.

They are pre-employment or identity-assurance controls, not continuous detection tools, so they cannot identify the TTPs of an insider who is already working inside the company.

ICS/OT devices often cannot tolerate normal scan pacing; -T3 is more aggressive than -T1 'sneaky' and raises disruption risk.

Port 22 is SSH, an encrypted remote-admin service, so it does not match the question's insecure-port requirement; FTP port 21 does.

Acceptance is a last resort when no feasible control exists; here segmentation, WAF/IPS, access restrictions, and monitoring can still reduce risk, so mitigation is preferred.

No. Transference shifts financial impact but leaves the vulnerability in place; the organization still needs compensating controls to reduce the risk.

A PIN provides a direct technical barrier preventing unauthorized access immediately, whereas training relies on human behavior which is prone to error.

HIPAA requires reasonable safeguards to protect Protected Health Information (PHI), making technical controls like PINs essential for physical media access.

Traceroute shows the physical or logical path packets take, but it does not verify the ownership of the networks at each hop. A hijacked route might still show a valid path structure, making ASN verification essential to detect malicious rerouting.

The Cymru ASN service allows users to query IP addresses via DNS to retrieve the associated Autonomous System Number (ASN) and owner information, helping verify if traffic is coming from the expected network.

Because the ransomware is 'new,' its specific file hashes or process names are likely unknown. You cannot block what you do not yet know exists. Sandboxing helps discover these attributes.

Not directly. It provides the intelligence needed to update detection rules and blocklists to stop the spread and mitigate further damage from similar variants.

Forensic analysis is most effective when performed during containment or eradication while evidence is fresh. Once a system is recovered to its previous state, critical volatile evidence may be overwritten, making accurate forensic reconstruction difficult.

It includes documenting the incident timeline, conducting a lessons-learned meeting, updating security policies, and reporting findings to management to improve future response capabilities.

Vulnerability testing often relies on known signatures (CVEs) and may miss logic flaws or custom implementation errors. Dynamic testing provides a broader evaluation of runtime behavior and input handling.

Dynamic Testing (DAST) automates or semi-automates the identification of vulnerabilities by observing runtime output. Penetration Testing involves manual, creative exploitation of those vulnerabilities to prove business impact.

Immediate patching can disrupt business operations or introduce new errors. Standard procedure requires a risk assessment to validate the impact and ensure the patch is approved and tested before implementation.

A security analyst identifies, analyzes, and reports vulnerabilities. A system administrator typically executes the remediation (patching) based on the analyst's recommendations and organizational change management policies.

The scenario specifies that blocking the traffic at the perimeter would require shutting down the port, causing a massive outage for legitimate users. You must balance security with business continuity.

Yes. SIEM (Option B) only generates alerts and is reactive. EDR (Option A) can actively enforce policies to deny connections or processes, providing immediate protection against the malicious IP.

No. Framework guidelines like NIST or ISO are voluntary best practices. Organizations adopt them internally for structure and certification. They are not legally imposed by an external authority unless specified in a contract.

Law enforcement is only involved in incidents involving criminal activity (e.g., fraud, theft). Routine operational incidents (e.g., server downtime) do not require police involvement, making it a situational choice, not a universal external requirement.

No, OpenID Connect is an authentication protocol/standard built on top of OAuth 2.0. It is not a vendor-delivered service model like ZTNA or SWG.

ZTNA centralizes access policies based on identity and context, eliminating the need to configure individual firewall rules or complex VPN setups for each SaaS application.

You cannot assume all recipients clicked. You must match the source IPs or domains from the email log against the destination URLs in the web access log. Only users whose IPs appear in both logs clicked the link.

Visiting the site is shown in web logs. Infection is confirmed by the execution of a malicious process in the endpoint logs. If a user visited the site but no corresponding suspicious process started shortly after, they likely did not download or execute the malware.

IDOR focuses on accessing resources by manipulating object identifiers (like IDs). This scenario focuses on preventing unauthorized actions via request validation, which is the domain of CSRF.

These refer to anti-CSRF tokens, custom headers, or SameSite cookie flags that ensure the request originated from the trusted site, not a malicious third-party site.