Free Practice Questions for CompTIA CS0-003 Exam

Determining the asset value of each system is the best action to perform first, as it helps to categorize and prioritize the systems based on the sensitivity of the data they host. The asset value is a measure of how important a system is to the organization, in terms of its financial, operational, or reputational impact. The asset value can help the security analyst to assign a risk level and a protection level to each system, and to allocate resources accordingly. The other actions are not as effective as determining the asset value, as they do not directly address the goal of promoting confidentiality, availability, and integrity of the data. Interviewing the users who access these systems may provide some insight into how the systems are used and what data they contain, but it may not reflect the actual value or sensitivity of the data from an organizational perspective. Scanning the systems to see which vulnerabilities currently exist may help to identify and remediate some security issues, but it does not help to categorize or prioritize the systems based on their data sensitivity. Configuring alerts for vendor-specific zero-day exploits may help to detect and respond to some emerging threats, but it does not help to protect the systems based on their data sensitivity.

The vulnerability scan shows that the version information is visible in the http-server-header, which can be exploited by attackers to identify vulnerabilities specific to that version. Removing or obfuscating this information can enhance security.

Comprehensive and Detailed Explanation From Exact Extract:

The key phrase is “analyzes suspicious data after scanning”. Before you can prioritize remediation, you must first ensure the scan results are valid—i.e., determine whether the findings are true positives vs. false positives. That validation step is a core part of vulnerability management because it prevents wasting time remediating issues that do not actually exist and ensures your prioritization decisions are based on accurate findings.

The All-in-One CySA+ CS0-003 guide explicitly states that after receiving vulnerability scan data, the analyst’s review process must focus on validating reported vulnerabilities (true/false positives). It also directly ties this to remediation/prioritization.

Exact extract (All-in-One Exam Guide):

“It is up to the analyst to review and make sense of vulnerability data and findings… The two most important outcomes of the review process are to determine the validity of reported vulnerabilities…”

It further emphasizes the importance of differentiating true positives from false positives for remediation and prioritization:

Exact extract (All-in-One Exam Guide):

“Distinguishing true positives from false positives… can be a tricky part of vulnerability remediation and prioritization.”

So, Option B (determine true/false positives) is the best action specifically to prioritize remediation tasks based on scan results.

Why the other options are not best:

A: Sending to IR may be appropriate if there is evidence of an active incident, but the question is framed as post-scan vulnerability management (not confirmed incident handling). Validation comes first.

C: Tickets and timeframes are important (often driven by SLAs/SLOs), but setting those correctly depends on confirming the findings are real and understanding severity/impact first.

D: Compensating controls and risk register entries are appropriate when remediation is not immediately feasible, but again you must confirm validity and then prioritize based on risk/impact.

References (CompTIA CySA+ CS0-003 documents / study guides used):

Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): validating vulnerability scan results; true/false positives; link to remediation prioritization

===========

The output shows the results of a port scan, which is a technique used to identify open ports and services running on a network host. Port scanning can be used by attackers to discover potential vulnerabilities and exploit them, or by defenders to assess the security posture and configuration of their network devices1

The output lists six ports that are open on the target host, along with the service name and version associated with each port. The service name indicates the type of application or protocol that is using the port, while the version indicates the specific release or update of the service. The service name and version can provide useful information for both attackers and defenders, as they can reveal the capabilities, features, and weaknesses of the service.

Among the six ports listed, two are particularly risky and should be investigated further by the security team: port 23 and port 636.

Port 23 is used by Telnet, which is an old and insecure protocol for remote login and command execution. Telnet does not encrypt any data transmitted over the network, including usernames and passwords, which makes it vulnerable to eavesdropping, interception, and modification by attackers. Telnet also has many known vulnerabilities that can allow attackers to gain unauthorized access, execute arbitrary commands, or cause denial-of-service attacks on the target host23

Port 636 is used by LDAP over SSL/TLS (LDAPS), which is a protocol for accessing and modifying directory services over a secure connection. LDAPS encrypts the data exchanged between the client and the server using SSL/TLS certificates, which provide authentication, confidentiality, and integrity. However, LDAPS can also be vulnerable to attacks if the certificates are not properly configured, verified, or updated. For example, attackers can use self-signed or expired certificates to perform man-in-the-middle attacks, spoofing attacks, or certificate revocation attacks on LDAPS connections.

Therefore, the security team should investigate further why port 23 and port 636 are open on the target host, and what services are running on them. The security team should also consider disabling or replacing these services with more secure alternatives, such as SSH for port 23 and StartTLS for port 6362

AUSB drop attackis acommon method for delivering ransomware, where an attacker leaves infected USB drives in strategic locations,tricking employees into plugging them into corporate devices​.

Option B (LFI - Local File Inclusion)exploitsweb applications, but the scenario lacksnetwork intrusion indicators.

Option C (Cross-site request forgery - CSRF)is used forexploiting authenticated web sessions, not ransomware delivery.

Option D (SQL injection)is used fordatabase exploitation, not file encryption malware.

Thus,A (USB drop) is the correct answer, asphysical malware introduction is a known ransomware attack vector​.

Implementing controls to block execution of untrusted applications can prevent privilege escalation attacks that leverage native Windows tools, such as PowerShell, WMIC, or Rundll32. These tools canbe used by attackers to run malicious code or commands with elevated privileges, bypassing system security policies and controls. By restricting the execution of untrusted applications, organizations can reduce the attack surface and limit the potential damage of privilege escalation attacks.

The threat was detected from the time the emails were sent at 8:30 a.m. to when the recipients started alerting the organization’s help desk about the email at 8:45 a.m., taking a total of 15 minutes. The detection time is the time elapsed between the occurrence of an incident and its discovery by the security team . The other options are either too short or too long based on the given information. References: : Detection Time : Incident Response Metrics: Mean Time to Detect and Mean Time to Respond

Wireshark is a network protocol analyzer that allows analysts to capture and inspect data packets traveling through a network. This makes it ideal for investigating unusual network activity, as it provides detailed insights into the nature and content of network traffic. In this case, Wireshark can help identify potentially malicious packets and understand the nature of the observed traffic. Options A (WAF) and C (EDR) are primarily used for monitoring and protecting web applications and endpoints, respectively, and Nmap (D) is typically used for network discovery and mapping, not detailed traffic analysis. According to CompTIA CySA+, packet analysis tools like Wireshark are invaluable for deep-dive investigations into network anomalies.

Comprehensive and Detailed Explanation From Exact Extract:

The question asks for the best technical method to protect sensitive data at an organizational level. Among the options, Data Loss Prevention (DLP) is explicitly a technical control category designed to prevent sensitive data leakage/exfiltration across the organization, especially at network boundaries (egress points) and via endpoints.

Why DLP (Option D) is best:

DLP is built specifically to stop sensitive data from leaving where it should be contained (data exfiltration/leakage prevention) and can be applied broadly across the enterprise (network + endpoints). The Sybex CySA+ Study Guide defines DLP this way:Exact extract (Sybex Study Guide): “DLP systems and software work to protect data from leaving the organization…”

DLP is commonly implemented at network egress points (and also endpoints), which aligns directly with “egress and ingress” monitoring in the option wording. The Secbay Press guide reinforces this deployment model:Exact extract (Secbay Press): “Network DLP… Installed at network egress points near the perimeter”

DLP is also a key technique to help detect/prevent data exfiltration, which is a major concern for sensitive data protection programs:Exact extract (All-in-One Exam Guide): “Implement DLP tools to detect and prevent sensitive data from being transferred outside the organization.”

Finally, DLP is explicitly part of the CS0-003 exam objectives under Sensitive data protection, making it the most “officially aligned” technical method in the answer choices:Exact extract (CompTIA CS0-003 Objectives): “Sensitive data protection – Data loss prevention (DLP)”

Why the other options are not “best”:

A (Block port 8080 / VLAN): Too narrow and mis-scoped. Port-based blocking doesn’t reliably stop sensitive data movement (data could leave on 443/HTTPS, email, cloud apps, etc.). Also, “traffic on port 8080 with sensitive information” is not how traffic filtering is normally expressed and isn’t an enterprise-wide sensitive data protection strategy.

B (Python script for email PII): Helpful as a tactical control, but limited to email only, brittle to evasion/encryption, and not an enterprise-wide standardized control like DLP. (Also corrected typo: “Pll” → PII.)

C (Restrictive policy): A policy is an administrative/managerial control, not a technical method. The question explicitly asks for the best technical method.

References (CompTIA CySA+ CS0-003 documents / study guides used):

CompTIA CySA+ CS0-003 Exam Objectives (v4.0): Sensitive data protection includes DLP

Mike Chapple & David Seidl, CompTIA CySA+ Study Guide (CS0-003): DLP “protect[s] data from leaving the organization…”

Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): Network DLP at egress points

Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): DLP helps “detect and prevent sensitive data” transfer outside

Comprehensive and Detailed Step-by-Step Explanation:The SPF = PASS result confirms the email came from an authorized server, but DKIM = FAIL indicates the message was not properly signed with the expected DomainKeys Identified Mail (DKIM) signature. DMARC = FAIL suggests that because DKIM failed, the overall email authentication failed. This scenario is consistent with a legitimate server sending an unsigned email.