mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: A security analyst is configuring a vulnerability…
A security analyst is configuring a vulnerability scan for a demilitarized zone (DMZ) containing public-facing web servers. The analyst wants to minimize the risk of causing a denial-of-service condition on the servers. Which of the following scan settings should be configured?
⚠ Common exam trap
CompTIA often tests the misconception that increasing timeout values or disabling safe checks will reduce the risk of denial-of-service, when in fact these settings either increase load or remove protections, making the scan more dangerous.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Limit the number of concurrent checks.
Limiting the number of concurrent checks (option D) reduces the simultaneous requests sent to the target servers, which prevents overwhelming the web server's connection pool or CPU. This is the most direct way to minimize the risk of a denial-of-service condition during a vulnerability scan, especially in a DMZ with public-facing servers that may have limited resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable a full port scan.
Why it's wrong here
Enabling a full port scan instructs the vulnerability scanner to probe all 65,535 TCP and UDP ports on target systems. While this provides the most comprehensive discovery of open services, it is an extremely aggressive and resource-intensive operation. This significantly increases network traffic and the load on target systems, making it highly prone to causing service disruption or triggering network intrusion detection systems due to its volume and nature.
- ✗
Disable safe checks to speed up the scan.
Why it's wrong here
Disabling safe checks means the vulnerability scanner will execute potentially disruptive or destructive tests, such as denial-of-service simulations, buffer overflows, or other exploit-like behaviors. While this might accelerate the scan by not adhering to non-intrusive methodologies, it dramatically elevates the risk of crashing applications, services, or even entire systems. This approach prioritizes speed over operational stability, making it unsuitable for most production environments.
- ✗
Increase the scan timeout values.
Why it's wrong here
Increasing scan timeout values means the scanner will wait for a longer duration for responses from target systems before marking a port or service as unresponsive. While this can be beneficial for accurately assessing slow or heavily loaded systems, it significantly prolongs the overall scan duration. This extended waiting period ties up scanner resources, increases network congestion, and can lead to higher resource consumption on both the scanner and the target, potentially impacting operational performance.
- ✓
Limit the number of concurrent checks.
Why this is correct
Limiting the number of concurrent checks directly controls how many vulnerability tests or network connections the scanner initiates simultaneously against a target system or across the network. This crucial configuration reduces the immediate load placed on the target and the network infrastructure, preventing resource exhaustion. By pacing the scan, it significantly lowers the risk of inadvertently causing a denial-of-service condition or overwhelming critical services, thereby ensuring operational stability during the assessment.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.