hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A scanner flags TLS 1.0 on a server, but the…
A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For tool configuration, Which scanner or pipeline change most directly improves result quality?
⚠ Common exam trap
CompTIA often tests the concept that scanner results must be validated through active, protocol-specific testing rather than relying on configuration assertions or passive detection, and the trap here is assuming that a service owner's claim or a scanner's default detection is sufficient without manual verification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Manually test the service with a TLS client or scanner profile that negotiates protocol versions
The most reliable way to validate whether TLS 1.0 is truly disabled is to perform an active, negotiated test using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to connect using only TLS 1.0. This bypasses any potential misconfiguration in the scanner's service detection or version negotiation logic, and directly confirms whether the server accepts a TLS 1.0 handshake. Relying solely on the scanner's banner grab or the owner's assertion can miss cases where the server still supports the protocol on certain ports or under specific cipher suites.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the severity to informational automatically
Why it's wrong here
Severity should reflect verified exposure, not disagreement.
- ✗
Delete the server from the scan scope
Why it's wrong here
Removing assets hides risk and breaks governance.
- ✗
Close the finding because the owner disagrees
Why it's wrong here
Owner statements need evidence before closure.
- ✓
Manually test the service with a TLS client or scanner profile that negotiates protocol versions
Why this is correct
Direct protocol validation determines whether TLS 1.0 is actually accepted.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.