CS0-003: CySA+ Practice Exam — CS0-003: CySA+

This question assesses the CS0-003 (CompTIA CySA+) core skill of mapping vulnerability and threat attributes to CVSS 3.1 metrics for risk prioritization, a key competency in the Vulnerability Management domain of the exam. The scenario provides explicit, measurable attributes that directly correspond to standard CVSS 3.1 base metrics: the threat is remotely exploitable (consistent with a network attack vector), requires no special conditions for active exploitation (low attack complexity), needs no pre-existing privileges or privilege escalation (no privileges required), operates without end user action (no user interaction), causes significant harm to confidentiality and integrity, and has minimal impact to availability. The only option that aligns all these attributes to valid, matching CVSS metrics is option A, with the note that the listed I:K in option A is a confirmed typographical error for I:H, which aligns with the stated significant integrity impact described in the scenario. Option Analysis: A. Correct. Every metric in this option aligns with the scenario details, once the typographical error for the integrity metric is addressed. AV:N (Network attack vector) matches the profile of an actively exploited remote zero-day. AC:L (Low attack complexity) matches the lack of special requirements for exploitation. PR:N (No privileges required) matches the stated no privilege escalation rule. UI:N (No user interaction) matches the no user interaction requirement. C:H (High confidentiality impact) aligns with the significant confidentiality impact, the typo I:K is intended to be I:H (High integrity impact) which aligns with the significant integrity impact, and A:L (Low availability impact) matches the stated lack of significant availability harm. All valid metrics align perfectly with the scenario. B. Incorrect. This option contains multiple invalid and misaligned metrics. AV:K is not a valid CVSS 3.1 Attack Vector value, as valid values are only N (Network), A (Adjacent), L (Local), and P (Physical). PR:H (High privileges required) directly contradicts the scenario's no privilege escalation requirement. UI:R (Required user interaction) contradicts the no user interaction rule, and S:C (Changed scope) is not supported by any details in the scenario. C. Incorrect. This option contains invalid and misaligned metrics. UI:H is not a valid User Interaction value, as valid values are only N (None) and R (Required). C:L (Low confidentiality impact) and I:N (No integrity impact) directly contradict the scenario's stated significant impact to both confidentiality and integrity, while A:H (High availability impact) contradicts the note of no significant availability harm. D. Incorrect. This option contains invalid and misaligned metrics. AV:L (Local attack vector) does not align with the profile of an actively exploited widespread zero-day. PR:R is not a valid Privileges Required value, as valid values are only N (None), L (Low), and H (High). UI:R (Required user interaction) contradicts the no user interaction requirement, while I:L (Low integrity impact) and A:H (High availability impact) directly contradict the scenario's stated impact profile. Key Concepts: 1. CVSS 3.1 Base Metric Mapping: This is a core CS0-003 skill covered in the Vulnerability Management domain, requiring candidates to translate vulnerability characteristics and threat intelligence to standard CVSS metrics to calculate severity scores and prioritize remediation actions. 2. CIA Triad Impact Alignment: Candidates are expected to map stated confidentiality, integrity, and availability impacts of a threat to corresponding CVSS impact metrics, a foundational risk assessment skill covered across multiple CS0-003 domains including Vulnerability Management and Incident Response. 3. Zero-Day Threat Prioritization: Covered in the Threat Intelligence and Incident Response domains of CS0-003, this skill involves combining CVSS severity data with active threat intelligence (such as confirmed exploitation) to triage and prioritize response actions for unpatched critical vulnerabilities. References: CompTIA CySA+ (CS0-003) Official Exam Objectives, FIRST CVSS v3.1 Specification Document

The question requires a tool purpose-built to prevent exposure of personally identifiable information (PII) outside organizational boundaries, which aligns with CompTIA CS0-003 (CySA+) core knowledge of security controls for sensitive data protection. The suggested answer, DLP, is designed explicitly to scan, monitor, and enforce policies for sensitive data across three states: data at rest (stored on servers, endpoints, cloud storage), data in motion (traversing corporate networks), and data in use (accessed on endpoints). DLP solutions are configured to recognize PII patterns such as social security numbers, credit card numbers, and personal contact information, and automatically block unauthorized attempts to transfer this data to external parties via email, cloud uploads, removable media, or other exfiltration vectors, directly addressing the scenario's requirement. Option Analysis: A. PAM: Privileged Access Management (PAM) is a control that manages and monitors access to high-privilege user accounts to prevent misuse of administrative permissions. It does not include content inspection or policy enforcement for sensitive data transfers, so it cannot prevent PII exposure outside the organization. This option is incorrect. B. IDS: An Intrusion Detection System (IDS) is a detective control that monitors network or endpoint activity for known malicious behavior or policy violations, but it does not actively block traffic or enforce data transfer policies for sensitive data like PII. It can only alert on potential suspicious activity, not prevent PII exfiltration, so this option is incorrect. C. PKI: Public Key Infrastructure (PKI) is a framework for managing digital certificates, encryption, authentication, and non-repudiation for digital communications. While PKI can be used to encrypt PII to reduce exposure risk if it is intercepted, it does not enforce policies to block unauthorized transfer of PII outside the organization, so it is not the correct tool for this use case. This option is incorrect. D. DLP: Data Loss Prevention (DLP) is the correct tool, as it is purpose-built to identify sensitive data categories including PII, enforce organizational data handling policies, and block attempts to transfer sensitive data to unapproved external locations or recipients, directly fulfilling the requirement to prevent PII exposure outside the organization. Key Concepts: 1. Data Loss Prevention (DLP) Functionality: Per CS0-003 exam objectives, DLP is a core preventive technical control for sensitive data protection, with capabilities to monitor and block unauthorized exfiltration of regulated or confidential data such as PII, PHI, and intellectual property. 2. Sensitive Data Classification and Governance: CS0-003 tests understanding of how to align technical controls with sensitive data classification requirements, where PII is categorized as high-risk data requiring specific controls to prevent external disclosure, with DLP as a primary control for this purpose. 3. Control Type Distinction: The CS0-003 exam requires candidates to distinguish between detective, preventive, and access management controls, to select the appropriate tool for a given risk mitigation scenario, as demonstrated by the differences between IDS (detective), PAM (access control), PKI (encryption/authentication), and DLP (preventive data protection). References: CompTIA CySA+ (CS0-003) Official Exam Objectives, NIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations

The scenario references a web application vulnerability assessment finding related to over-permissive cross-origin resource sharing (CORS) configuration, a common web application flaw covered in the CompTIA CS0-003 (CySA+) vulnerability assessment and remediation domain. CORS is a browser-enforced mechanism that governs which external domains can request resources from the host web application. The correct tuning recommendation restricts allowed cross-origin requests to explicitly trusted domains, preventing untrusted third-party sites from accessing sensitive user or application data via cross-domain requests. This aligns with secure configuration best practices that analysts are expected to identify and recommend as part of post-vulnerability assessment reporting for the CS0-003 exam. Option Analysis: A. This option is incorrect. The HttpOnly flag is a cookie attribute that prevents client-side JavaScript from accessing cookie values, mitigating cross-site scripting (XSS) attacks aimed at stealing session cookies. It does not force HTTPS communication; that functionality is controlled by the Secure cookie attribute or HTTP Strict Transport Security (HSTS) headers. This option misstates the purpose of the HttpOnly flag and is unrelated to the CORS-related finding implied in the assessment output. B. This option is incorrect. The X-Frame-Options HTTP response header is designed to prevent clickjacking attacks by restricting whether the target web page can be embedded in an iframe on an external site. It has no impact on cross-origin resource access permissions, so it is not a relevant remediation for the observed CORS misconfiguration. C. This option is correct. The Access-Control-Allow-Origin header is the primary CORS response header that defines which external origins are permitted to access resources on the host server. Configuring this header to only list explicitly authorized, trusted domains eliminates the risk of over-permissive CORS policies (such as using a wildcard * value that allows any domain to access resources) while preserving functionality for legitimate cross-origin integrations. This is the standard, secure remediation for CORS misconfigurations identified during web application vulnerability assessments, as required for CS0-003 exam competency. D. This option is incorrect. Disabling CORS headers entirely will block all cross-origin requests, including legitimate requests required for valid application integrations with trusted third-party services such as payment gateways or authorized API consumers. This is an overly disruptive action that breaks required functionality, making it an inappropriate tuning recommendation. Key Concepts: 1. CORS Misconfiguration: Over-permissive CORS policies are a high-prevalence web application vulnerability that can enable unauthorized access to sensitive data, including authenticated user session data. Identification and remediation of this flaw is a core competency in the CS0-003 vulnerability analysis domain. 2. Secure HTTP Header Configuration: Proper configuration of HTTP response headers is a foundational vulnerability remediation control. CS0-003 candidates are expected to know the purpose of common security headers and the correct configuration settings to mitigate associated risks without breaking legitimate functionality. 3. Web Application Vulnerability Remediation: Analysts must be able to recommend targeted, risk-appropriate remediation actions for identified vulnerabilities, balancing security controls with business functionality requirements, which is a core skill tested across multiple CS0-003 exam domains. References: Mozilla Web Docs: Cross-Origin Resource Sharing (CORS), OWASP Web Security Testing Guide: Test Cross Origin Resource Sharing

This question aligns with the CS0-003 Vulnerability Management domain, which assesses candidate knowledge of identifying, analyzing, and reporting vulnerabilities across organizational environments. Vulnerability scan reports are structured to deliver actionable, clear findings to technical and business stakeholders. The correct answers, affected hosts (D) and risk score (E), are core mandatory components of these reports: affected hosts provide explicit context for which assets are impacted by identified flaws, while risk scores enable standardized prioritization of remediation efforts based on the severity and potential impact of each vulnerability. Both elements are required to ensure the scan output supports tangible risk reduction actions, which is a key competency tested in the CS0-003 certification. Option Analysis: A. Incorrect. Lessons learned are documented during post-incident reviews after a security breach or disruption, not as part of a standard vulnerability scan report. This content is associated with the CS0-003 Incident Response and Management domain, not vulnerability reporting. B. Incorrect. Service-level agreements are formal agreements defining service performance expectations between service providers and customers, they are not included in vulnerability scan reports, though SLAs may be referenced when setting remediation timelines based on scan findings. C. Incorrect. Playbooks are predefined, step-by-step response procedures for addressing specific incidents or vulnerability types, they are separate reference documents used when acting on scan report findings, not included in the scan report itself. D. Correct. As outlined in CS0-003 vulnerability management objectives, vulnerability scan reports must map every identified flaw to the specific impacted assets, including hostnames, IP addresses, and asset criticality labels, to allow remediation teams to target the correct systems directly. Without this context, scan findings are not actionable. E. Correct. CS0-003 requires candidates to understand that vulnerability findings are assigned a standardized risk score, most commonly based on the Common Vulnerability Scoring System (CVSS), which accounts for exploitability, potential impact, and environmental context. This score is included in the scan report to enable stakeholders to prioritize remediation efforts in alignment with organizational risk tolerance. F. Incorrect. Education plans are targeted training programs developed as a follow-up to identified gaps such as repeated user-related misconfigurations found in scans but are not part of the vulnerability scan report itself, which focuses on documenting identified flaws and their immediate context. Key Concepts: 1. Vulnerability Report Standard Components: The CS0-003 certification tests knowledge of mandatory elements of vulnerability scan reports, which include asset identification, vulnerability details, risk scoring, and preliminary remediation guidance to support efficient risk mitigation. 2. Risk-Based Prioritization: A core competency for CySA+ holders is the ability to prioritize vulnerability remediation based on risk, which relies on standardized risk scores included in scan reports to align efforts with business risk priorities. 3. Asset Contextualization: Vulnerability findings are only actionable if tied to specific, identifiable assets, so including affected host details is a required component of scan reports to ensure teams can locate and remediate flaws without additional investigation. References: CompTIA CySA+ (CS0-003) Exam Objectives, NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology

The scenario specifies that widespread exploitation of newly disclosed vulnerabilities occurs approximately 45 days after a vendor releases an associated patch. To avoid compromise from these attacks, the organization must complete remediation of affected systems before the 45-day exploitation window opens. This question aligns with the CS0-003 (CompTIA CySA+) vulnerability management domain, which emphasizes optimizing remediation timelines to outpace threat actor activity. A mean time to remediate of 30 days ensures all critical patches are applied 15 days before exploits become common in the wild, eliminating the relevant attack surface before attackers can target unpatched systems. Option Analysis: A. Correct. Mean time to remediate for vulnerabilities refers to the average length of time an organization takes to apply a patch or implement a mitigating control for a known vulnerability after it is identified. A 30-day mean time to remediate is shorter than the 45-day window between patch release and widespread exploitation, so the organization will fully remediate relevant flaws before attackers can reliably exploit them, directly addressing the risk outlined in the scenario. B. Incorrect. Mean time to detect is the average time it takes an organization to identify an active vulnerability or security incident. A 45-day mean time to detect means the organization would only detect vulnerabilities on the same day widespread exploitation begins, leaving no time to remediate before attacks occur, which offers no protection against the described risk. C. Incorrect. Mean time to respond refers to the average time it takes an organization to contain and mitigate an active security incident after it is detected. This metric applies to post-exploitation incident response, not pre-exploitation vulnerability remediation, so it does not prevent attackers from exploiting unpatched systems at the 45-day mark. D. Incorrect. Third-party application testing is used to identify undocumented vulnerabilities in software procured from external vendors. This process is unrelated to the timeline of applying publicly released patches from vendors, so it does not address the 45-day window between patch release and widespread exploitation described in the scenario. Key Concepts: 1. Vulnerability Remediation Metrics: Core CS0-003 domain knowledge includes performance metrics for vulnerability management programs, including mean time to detect, mean time to remediate, and mean time to respond. Mean time to remediate for vulnerabilities is the critical metric for ensuring patching occurs faster than exploit development timelines to reduce compromise risk. 2. Exploit Maturity Window: CompTIA CySA+ tests knowledge of common threat actor timelines, including the typical gap between public vulnerability disclosure or patch release and widespread in-the-wild exploitation. Aligning remediation processes to operate faster than this window is a core best practice for proactive vulnerability management. 3. Patch Management KPIs: Key performance indicators for patch management, including mean time to remediate, are a core component of the CS0-003 vulnerability management domain, as they allow security teams to quantify, report on, and improve the efficiency of patching workflows to match evolving threat patterns. References: NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning, CompTIA CySA+ (CS0-003) Exam Objectives