This is the free Comptia CS0-003 practice question bank —
270 of 535 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-10-13.
Every answer is verified against official Comptia documentation —
see our methodology.
Question 1
An analyst receives the following summary report for vulnerabilities on multiple hosts:
Which of the following servers should the analyst remediate first?
A. COMPTIA-WEB01
B. COMPTIA-APP01
C. COMPTIA-FS01
D. COMPTIA-DC01
Show Answer
Correct Answer: B
Explanation: COMPTIA-APP01 has 31 high-severity vulnerabilities, far more than any other server in the report. Based on the information provided, it is the strongest remediation priority.
Question 1
HOTSPOT
An organization receives an indication that one of its hosts is part of a DDoS attack against a victim. The proxy server is supposed to handle all web page requests from all internal hosts.
INSTRUCTIONS
Click on each workstation and server to review outputs and a log file.
Identify the compromised host and executable, and determine an appropriate remediation for the issue.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Explanation: Workstation 2’s mozilla.exe has a direct HTTPS connection to the DDoS target, bypassing the required proxy. Reimaging restores the compromised host to a clean state.
Question 2
A systems administrator is concerned after reviewing the results of a vulnerability scan:
Which of the following mitigation strategies best addresses the risk?
A. Create an exception.
B. Wait for a patch release.
C. Apply compensating controls.
D. Disable the affected application.
Show Answer
Correct Answer: C
Explanation: Apply compensating controls to reduce exposure where a patch is not available, especially for the high-severity application on the perimeter network. An exception or simply waiting leaves the risk unaddressed, while disabling the application may be unnecessarily disruptive. Where a patch is available, it should be applied.
Question 2
A security analyst discovers several vulnerabilities on a critical legacy system. The analyst must recommend a solution with the following limitations:
• No downtime is permitted due to criticality.
• Patches for the vulnerabilities do not exist.
• No redundancy systems are in place.
Which of the following is the best risk management strategy to implement?
A. Transference
B. Mitigation
C. Avoidance
D. Acceptance
Show Answer
Correct Answer: D
Explanation: Accept the risk: the system cannot be taken offline, no patch is available, and there is no redundancy to support a safe replacement or maintenance window. The organization should formally document the risk and its acceptance. Transference would not remove the underlying vulnerability.
Question 3
An analyst reviews alerts that indicate a number of different users had a spike in login attempts from the same IP. Using the security information and event management (SIEM) system, the analyst finds that a number of users received the following email:
Which of the following best describes this activity?
A. URL shortening
B. Whaling
C. Spoofing
D. Social engineering
Show Answer
Correct Answer: D
Explanation: The email uses a deceptive benefits offer and a link to induce recipients to take action, which is social engineering (specifically, a phishing attempt). The sender may be impersonating HR, but spoofing is a possible technique within the broader activity, not the best overall description.
Question 3
A security analyst is scanning an ICS host (192.168.1.5) in an industrial plant for insecure ports while minimizing the impact to uptime or performance. Which of following commands should the analyst use to perform the task?
A. nmap 192.168.1.5 -Т1 -P 21
B. nmap 192.168.1.5 -T2 -P 3389
C. nmap 192.168.1.5 -T3 -P 22
D. nmap 192.168.1.5 -T5 -P 80
Show Answer
Correct Answer: A
Explanation: Option A uses the slowest timing template shown, `-T1`, which minimizes scan traffic and is the cautious choice for a sensitive ICS host. Port 21 is FTP, which is commonly considered insecure because it may transmit credentials unencrypted. Nmap’s port-selection flag is lowercase `-p`, so the command should be written `nmap -T1 -p 21 192.168.1.5`; the option appears to have a capitalization typo.
Question 4
Which of the following is the best technical method to protect sensitive data at an organizational level?
A. Deny all traffic on port 8080 with sensitive information on the VLAN.
B. Develop a Python script to review email traffic for PII.
C. Employ a restrictive policy for the use and distribution of sensitive information.
D. Implement a DLP for all egress and ingress of sensitive information on the network.
Show Answer
Correct Answer: D
Explanation: A data loss prevention (DLP) solution is the most comprehensive technical option listed for detecting and controlling sensitive data moving into or out of the organization. Blocking one port is too narrow, an email-review script covers only one channel, and a restrictive policy is an administrative rather than technical control.
Question 4
A security analyst is testing a web application for vulnerabilities using Burp Suite. During the assessment, a capture of the following HTTP request and response is shown in the command-line interface:
After inspecting the request, the security analyst notices that it does not include any additional protections or validation mechanisms. Which of the following vulnerabilities is most likely present in the web application?
A. IDOR
B. CSRF
C. SQLi
D. XSS
Show Answer
Correct Answer: B
Explanation: The POST request changes the account email and relies on the session cookie, but shows no CSRF token or other visible anti-CSRF mechanism. That makes CSRF the most likely vulnerability among the options; the request does not show an object identifier or injection payload pointing to IDOR, SQLi, or XSS.
Question 4
A Chief Information Security Officer wants to map all of the attack vectors that the company faces each day. Which of the following recommendations should the company align its security controls around?
A. OSSTMM
B. Diamond Model of Intrusion Analysis
C. ОWASP
D. MITRE ATT&CK
Show Answer
Correct Answer: D
Explanation: MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and procedures (TTPs) used to map likely attack vectors and align detection and defensive security controls. OSSTMM is a security testing methodology, the Diamond Model is an intrusion analysis framework, and OWASP primarily focuses on web application security.
Question 5
A security analyst is investigating an unusually high volume of requests received on a web server. Based on the following command and output:
Which of the following best describes the activity that the analyst will confirm?
A. SQL injection
B. Directory brute force
C. Remote command execution
D. Cross-site scripting
Show Answer
Correct Answer: B
Explanation: The log shows many rapid GET requests to different guessed paths, most returning 404 Not Found. This pattern is characteristic of directory brute forcing, where automated requests probe for existing files and directories.
$19
Get all 535 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
