hardMultiple Choice
CS0-003 Practice Question: A scanner flags TLS 1.0 on a server, but the…
A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For tool configuration, Which scanner or pipeline change most directly improves result quality?
⚠ Common exam trap
CompTIA often tests the concept that scanner results must be validated through active, protocol-specific testing rather than relying on configuration assertions or passive detection, and the trap here is assuming that a service owner's claim or a scanner's default detection is sufficient without manual verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Manually test the service with a TLS client or scanner profile that negotiates protocol versions
The most reliable way to validate whether TLS 1.0 is truly disabled is to perform an active, negotiated test using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to connect using only TLS 1.0. This bypasses any potential misconfiguration in the scanner's service detection or version negotiation logic, and directly confirms whether the server accepts a TLS 1.0 handshake. Relying solely on the scanner's banner grab or the owner's assertion can miss cases where the server still supports the protocol on certain ports or under specific cipher suites.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the severity to informational automatically
Why it's wrong here
Downgrading the finding to informational suppresses the TLS 1.0 alert without confirming whether the service truly disabled it, leaving the risk unverified. It is tempting to silence false positives, but the correct approach is re-scanning with protocol-specific probes or inspecting the listener configuration directly.
- ✗
Delete the server from the scan scope
Why it's wrong here
Removing the host from scope suppresses the TLS 1.0 finding without verifying whether the service actually negotiates that protocol, so the false positive persists undetected. Scope exclusion suits decommissioned or out-of-scope assets, not disputed findings on live servers.
- ✗
Close the finding because the owner disagrees
Why it's wrong here
Closing the finding on the owner's assurance records no evidence that TLS 1.0 is disabled, leaving the exposure unverified. Disposition by attestation suits findings already confirmed as false positives through independent testing, not unresolved disagreements.
- ✓
Manually test the service with a TLS client or scanner profile that negotiates protocol versions
Why this is correct
Negotiating protocol versions directly with a TLS client or version-aware scanner profile confirms whether TLS 1.0 is genuinely accepted, satisfying the need to validate the conflicting scanner finding. Passive inspection or configuration review cannot prove the listener's actual handshake behaviour.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.