Question 26

Question

HOTSPOT The developers recently deployed new code to three web servers. A daffy automated external device scan report shows server vulnerabilities that are failure items according to PCI DSS. If the venerability is not valid, the analyst must take the proper steps to get the scan clean. If the venerability is valid, the analyst must remediate the finding. After reviewing the information provided in the network diagram, select the STEP 2 tab to complete the simulation by selecting the correct Validation Result and Remediation Action for each server listed using the drop-down options. INTRUCTIONS: The simulation includes 2 steps. Step1:Review the information provided in the network diagram and then move to the STEP 2 tab. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Analyst+_CS0-003/page_102_img_1.jpg https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Analyst+_CS0-003/page_103_img_1.jpg STEP 2: Given the Scenario, determine which remediation action is required to address the vulnerability. https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Analyst+_CS0-003/page_104_img_1.jpg

Ben · Answer

Are we absolutely sure the vulnerability on WEB_SERVER02 isn't a scan artifact? I see a lot of reports flagging it, but there's no actual finding tied to that IP in the diagram or report. Wouldn't that make it a false positive, so submitting as non-issue is correct here? PCI DSS just wants you to formally dispute if it's not valid, right?

Sofia M. · Answer

For WEB_SERVER01, you’d mark it as true positive and fix by encrypting the session, since cleartext is flagged. WEB_SERVER02 is false positive so just submit as non-issue. WEB_SERVER03 also true positive, needs secure cookies. That lines up with PCI DSS, I think-anyone see another angle?

MeeraM · Answer

Yeah, WEB_SERVER01 and WEB_SERVER03 are both true positives, so those need encryption fixes (full session for 01, cookie flag for 03). WEB_SERVER02 is a false positive since nothing is actually wrong from the scan. Submit as non-issue there. I think this matches PCI DSS process.

Sofia H. · Answer

Pretty sure WEB_SERVER01 and WEB_SERVER03 are true positives. The first one has data sent in cleartext, needs full session encryption. The third is missing 'secure' flag on cookies, so fix by encrypting cookies. For WEB_SERVER02, looks like a false positive if there's no actual finding listed, so just submit as non-issue. Anyone see it differently?

MethodicalCandidate2553 · Answer

Submit as non-issue is correct only if the scan requirement is PCI DSS, right? If that's external/internal or uses a different compliance framework then remediation might change.

CompTIA (CYSA+) Analyst+ CS0-003 Real Exam Questions [2026 Update] Quiz

Premium Access Includes