How many Troubleshooting Scenario Questions questions are on this page?

This page has 14 Troubleshooting Scenario Questions scenario questions for the CS0-003 exam, each with detailed explanations and wrong-answer analysis.

How should I approach CS0-003 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CompTIA CySA+ CS0-003 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise CompTIA CySA+ CS0-003 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CS0-003

exam code

CompTIA

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the evidence source phase, Which evidence source best supports or refutes the detection?

A
Only the user's browser cache
Why wrong: Browser cache is not the authoritative source for sign-in and mailbox-rule activity.
B
Sign-in logs, MFA result, device details, and mailbox audit events
Impossible travel plus forwarding rule creation is a strong account-compromise pattern; identity and mailbox audit data confirm whether the activity is malicious.
C
Only DHCP logs from the London office
Why wrong: DHCP logs cannot explain the remote sign-in or mailbox change.
D
The organisation's public DNS zone file
Why wrong: DNS zone data is unrelated to mailbox-forwarding abuse.

Full breakdown with real-world context →

Question 2easymultiple choice

Full question →

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For tool configuration, Which scanner or pipeline change most directly improves result quality?

A
Authenticated scanning with a test account and session handling
DAST needs valid authentication and session management to test protected functionality.
B
Reduce the scan to only the landing page
Why wrong: That further limits coverage.
C
Disable all application authentication
Why wrong: This would change the application and create risk.
D
Treat absence of findings as proof of security
Why wrong: Unreached pages were not tested.

Full breakdown with real-world context →

Question 3easymultiple choice

Full question →

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

A
Disable all application authentication
Why wrong: This would change the application and create risk.
B
Treat absence of findings as proof of security
Why wrong: Unreached pages were not tested.
C
Authenticated scanning with a test account and session handling
DAST needs valid authentication and session management to test protected functionality.
D
Reduce the scan to only the landing page
Why wrong: That further limits coverage.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the alert triage phase, Which action gives the analyst the clearest next triage step?

A
Only the user's browser cache
Why wrong: Browser cache is not the authoritative source for sign-in and mailbox-rule activity.
B
The organisation's public DNS zone file
Why wrong: DNS zone data is unrelated to mailbox-forwarding abuse.
C
Sign-in logs, MFA result, device details, and mailbox audit events
Impossible travel plus forwarding rule creation is a strong account-compromise pattern; identity and mailbox audit data confirm whether the activity is malicious.
D
Only DHCP logs from the London office
Why wrong: DHCP logs cannot explain the remote sign-in or mailbox change.

Full breakdown with real-world context →

Question 5easymultiple choice

Full question →

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For business prioritization, Which recommendation gives the best risk-based order of work?

A
Treat absence of findings as proof of security
Why wrong: Unreached pages were not tested.
B
Authenticated scanning with a test account and session handling
DAST needs valid authentication and session management to test protected functionality.
C
Reduce the scan to only the landing page
Why wrong: That further limits coverage.
D
Disable all application authentication
Why wrong: This would change the application and create risk.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the containment trade-off phase, Which response balances containment with evidence preservation?

A
Sign-in logs, MFA result, device details, and mailbox audit events
Impossible travel plus forwarding rule creation is a strong account-compromise pattern; identity and mailbox audit data confirm whether the activity is malicious.
B
The organisation's public DNS zone file
Why wrong: DNS zone data is unrelated to mailbox-forwarding abuse.
C
Only the user's browser cache
Why wrong: Browser cache is not the authoritative source for sign-in and mailbox-rule activity.
D
Only DHCP logs from the London office
Why wrong: DHCP logs cannot explain the remote sign-in or mailbox change.

Full breakdown with real-world context →

Question 7easymultiple choice

Full question →

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For validation, Which action should be taken before closing or downgrading the finding?

A
Disable all application authentication
Why wrong: This would change the application and create risk.
B
Treat absence of findings as proof of security
Why wrong: Unreached pages were not tested.
C
Authenticated scanning with a test account and session handling
DAST needs valid authentication and session management to test protected functionality.
D
Reduce the scan to only the landing page
Why wrong: That further limits coverage.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For control selection, Which control best addresses the stated weakness without hiding risk?

A
Disable all application authentication
Why wrong: This would change the application and create risk.
B
Treat absence of findings as proof of security
Why wrong: Unreached pages were not tested.
C
Reduce the scan to only the landing page
Why wrong: That further limits coverage.
D
Authenticated scanning with a test account and session handling
DAST needs valid authentication and session management to test protected functionality.

Full breakdown with real-world context →

Question 9mediummulti select

Full question →

An organization has just experienced a successful phishing attack that led to credential theft. The incident response team is performing analysis. Which three of the following indicators of compromise (IOCs) would be most relevant to investigate? (Choose three.)

Question 10mediummultiple choice

Full question →

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

A
Only DHCP logs from the London office
Why wrong: DHCP logs cannot explain the remote sign-in or mailbox change.
B
The organisation's public DNS zone file
Why wrong: DNS zone data is unrelated to mailbox-forwarding abuse.
C
Only the user's browser cache
Why wrong: Browser cache is not the authoritative source for sign-in and mailbox-rule activity.
D
Sign-in logs, MFA result, device details, and mailbox audit events
Impossible travel plus forwarding rule creation is a strong account-compromise pattern; identity and mailbox audit data confirm whether the activity is malicious.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full VPN explanation →

A company uses a SIEM platform that ingests logs from various sources. The SOC team receives an alert for a high number of failed login attempts (over 100 in 5 minutes) on the domain controller from a single IP address. The analyst investigates and finds that the failed attempts are for multiple different usernames, including some disabled accounts. The source IP is traced to an external VPN service. The analyst also notices that a few accounts had successful logins from the same IP after the failed attempts. Which of the following is the MOST likely attack type?

A
Brute-force attack.
Why wrong: This would show many attempts on a single account, not across multiple accounts.
B
Kerberoasting.
Why wrong: Targets service account hashes, not login attempts.
C
Password spraying.
Attacker tries common passwords across many accounts to avoid lockout.
D
Pass-the-hash.
Why wrong: Involves using NTLM hashes; does not manifest as failed login attempts.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

An organization uses a SIEM with a rule that triggers when a user fails to authenticate five times within 10 minutes. Last night, the rule fired for a service account from an internal IP. What should be the first triage step?

A
Disable the service account immediately
Why wrong: Could break critical services.
B
Block the internal IP address at the firewall
Why wrong: Could be a legitimate service.
C
Review the account's recent activity and correlate with system logs
Determines if failures are legitimate or malicious.
D
Reset the service account password
Why wrong: Without investigation, could lock out automated processes.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full DNS explanation →

A SOC analyst receives an alert about a potential data exfiltration via DNS tunneling. Which of the following tools would best help the analyst investigate the alert?

A
Endpoint Detection and Response (EDR)
Why wrong: EDR may capture process and network connections but not necessarily the full DNS payload.
B
Antivirus logs
Why wrong: Antivirus logs do not capture DNS traffic details.
C
NetFlow
Why wrong: NetFlow provides flow metadata but not the content of DNS queries.
D
PCAP capture
Full packet capture allows examination of DNS payloads to detect tunneling.

Full breakdown with real-world context →

Question 14hardmultiple choice

Full question →

During a vulnerability scan, the scanner reports a high number of open ports on a server that is supposed to be a hardened web server. The analyst investigates and finds that the server is running unnecessary services. Which of the following is the MOST effective long-term solution?

A
Implement a configuration management baseline and enforce it
Configuration management ensures consistent hardening and drift detection.
B
Disable the unnecessary services manually
Why wrong: Manual process is error-prone and not sustainable.
C
Increase the frequency of vulnerability scans
Why wrong: Scans detect issues but do not prevent them.
D
Install a host-based firewall to block the ports
Why wrong: Firewalls can be disabled or misconfigured; not a long-term solution.

Full breakdown with real-world context →

These CS0-003 practice questions are part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style CS0-003 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related CS0-003 topic practice pages

Security Operations practice questions

Vulnerability Management practice questions

Incident Response and Management practice questions

Reporting and Communication practice questions

CompTIA A+ hardware practice questions

CompTIA A+ mobile devices practice questions

CompTIA A+ networking practice questions

CompTIA A+ operating systems practice questions

CompTIA A+ security practice questions

CompTIA A+ software troubleshooting questions

CompTIA A+ operational procedures questions

Practice scenarios

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the evidence source phase, Which evidence source best supports or refutes the detection?

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For tool configuration, Which scanner or pipeline change most directly improves result quality?

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the alert triage phase, Which action gives the analyst the clearest next triage step?

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For business prioritization, Which recommendation gives the best risk-based order of work?

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the containment trade-off phase, Which response balances containment with evidence preservation?

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For validation, Which action should be taken before closing or downgrading the finding?

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For control selection, Which control best addresses the stated weakness without hiding risk?

An organization has just experienced a successful phishing attack that led to credential theft. The incident response team is performing analysis. Which three of the following indicators of compromise (IOCs) would be most relevant to investigate? (Choose three.)

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

An organization uses a SIEM with a rule that triggers when a user fails to authenticate five times within 10 minutes. Last night, the rule fired for a service account from an internal IP. What should be the first triage step?

A SOC analyst receives an alert about a potential data exfiltration via DNS tunneling. Which of the following tools would best help the analyst investigate the alert?

During a vulnerability scan, the scanner reports a high number of open ports on a server that is supposed to be a hardened web server. The analyst investigates and finds that the server is running unnecessary services. Which of the following is the MOST effective long-term solution?