Free CS0-002 Exam Dumps Preview

A security analyst is performing ongoing scanning and continuous monitoring of the corporate datacenter.
Over time, these scans are repeatedly showing susceptibility to the same vulnerabilities and an increase in new vulnerabilities on a specific group of servers that are clustered to run the same application.

Which of the following vulnerability management processes should be implemented?

An information security analyst is compiling data from a recent penetration test and reviews the following output:

The analyst wants to obtain more information about the web-based services that are running on the target.

Which of the following commands would MOST likely provide the needed information?

A company creates digitally signed packages for its devices.

Which of the following BEST describes the method by which the security packages are delivered to the company's customers?

A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geographic zones, all of which were initiated through the web-based mail server. The logs indicate all domain accounts experienced two login attempts during the same time frame.

Which of the following is the MOST likely cause of this issue?

A cyber-incident response team is responding to a network intrusion incident on a hospital network.

Which of the following must the team prepare to allow the data to be used in court as evidence?

Which of the following BEST articulates the benefit of leveraging SCAP in an organization's cybersecurity analysis toolset?

An organization is required to be able to consume multiple threat feeds simultaneously and to provide actionable intelligence to various teams. The organization would also like to be able to leverage the intelligence to enrich security event data.

Which of the following functions would most likely help the security analyst meet the organization's requirements?

A security analyst is reviewing vulnerability scan results and notices new workstations are being flagged as having outdated antivirus signatures. The analyst observes the following plugin output:

Antivirus is installed on the remote host: Installation path: C:\Program Files\AVProduct\Win32\
Product Engine: 14.12.101
Engine Version: 3.5.71
Scanner does not currently have information about AVProduct version 3.5.71. It may no longer be supported.
The engine version is out of date. The oldest supported version from the vendor is 4.2.11.
The analyst uses the vendor's website to confirm the oldest supported version is correct.

Which of the following BEST describes the situation?

Which of the following describes why it is important for an organization's incident response team and legal department to meet and discuss communication processes during the incident response process?

In order to leverage the power of data correlation within Nessus, a cybersecurity analyst needs to write an SQL statement that will provide how long a vulnerability has been present on the network.

Given the following output table:

Which of the following SQL statements would provide the resulted output needed for this correlation?

A technician working at company.com received the following email:

After looking at the above communication, which of the following should the technician recommend to the security team to prevent exposure of sensitive information and reduce the risk of corporate data being stored on non-corporate assets?

A security analyst sees the following OWASP ZAP output from a scan that was performed against a modern version of Windows while testing for client-side vulnerabilities:

Alert Detail
Low (Medium) Web Browser XSS Protection not enabled
Description: Web browser XSS protection not enabled, or disabled by the configuration of the HTTP Response header

URL: https://domain.com/sun/ray

Which of the following is the MOST likely solution to the listed vulnerability?

A security analyst performed a review of an organization's software development life cycle. The analyst reports that the life cycle does not contain in a phase in which team members evaluate and provide critical feedback on another developer's code.

Which of the following assessment techniques is BEST for describing the analyst's report?

While planning segmentation for an ICS environment, a security engineer determines IT resources will need access to devices within the ICS environment without compromising security.

To provide the MOST secure access model in this scenario, the jumpbox should be __________.

During an audit several customer order forms were found to contain inconsistencies between the actual price of an item and the amount charged to the customer Further investigation narrowed the cause of the issue to manipulation of the public-facing web form used by customers to order products.

Which of the following would be the BEST way to locate this issue?

A security analyst is concerned that unauthorized users can access confidential data stored in the production server environment. All workstations on a particular network segment have full access to any server in production.

Which of the following should be deployed in the production environment to prevent unauthorized access? (Choose two.)

A network technician is concerned that an attacker is attempting to penetrate the network, and wants to set a rule on the firewall to prevent the attacker from learning which IP addresses are valid on the network.

Which of the following protocols needs to be denied?

The security team has determined that the current incident response resources cannot meet management's objective to secure a forensic image for all serious security incidents within 24 hours.

Which of the following compensating controls can be used to help meet management's expectations?

A cybersecurity analyst was asked to discover the hardware address of 30 networked assets.
From a command line, which of the following tools would be used to provide ARP scanning and reflects the MOST efficient method for accomplishing the task?

While reviewing log files, a security analyst uncovers a brute-force attack that is being performed against an external webmail portal.

Which of the following would be BEST to prevent this type of attack from being successful?

An executive tasked a security analyst to aggregate past logs, traffic, and alerts on a particular attack vector. The analyst was then tasked with analyzing the data and making predictions on future complications regarding this attack vector.

Which of the following types of analysis is the security analyst MOST likely conducting?

A security analyst has discovered suspicious traffic and determined a host is connecting to a known malicious website. The MOST appropriate action for the analyst to take would be lo implement a change request to:

A security analyst is reviewing the following server statistics:

Which of the following is MOST likely occurring?

Which of the following MOST accurately describes an HSM?

A security analyst recently discovered two unauthorized hosts on the campus's wireless network segment from a man-m-the-middle attack .

The security analyst also verified that privileges were not escalated, and the two devices did not gain access to other network devices Which of the following would BEST mitigate and improve the security posture of the wireless network for this type of attack?

During a review of vulnerability scan results an analyst determines the results may be flawed because a control-baseline system which is used to evaluate a scanning tools effectiveness was reported as not vulnerable Consequently, the analyst verifies the scope of the scan included the control-baseline host which was available on the network during the scan. The use of a control-baseline endpoint in this scenario assists the analyst in confirming.

Simulation

Malware is suspected on a server in the environment.

The analyst is provided with the output of commands from servers in the environment and needs to review all output files in order to determine which process running on one of the servers may be malware.

INSTRUCTIONS

Servers 1, 2, and 4 are clickable. Select the Server and the process that host the malware.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

During a recent audit, there were a lot of findings similar to and including the following:

Which of the following would be the BEST way to remediate these findings and minimize similar findings in the future?

A hacker issued a command and received the following response:

Which of the following describes what the hacker is attempting?

An analyst needs to understand how an attacker compromised a server.

Which of the following procedures will best deliver the information that is necessary to reconstruct the steps taken by the attacker?

Using a heuristic system to detect an anomaly in a computer's baseline, a system administrator was able to detect an attack even though the company signature based IDS and antivirus did not detect it. Further analysis revealed that the attacker had downloaded an executable file onto the company PC from the USB port, and executed it to trigger a privilege escalation flaw.

Which of the following attacks has MOST likely occurred?

The Chief Information Security Officer (CISO) asked for a topology discovery to be conducted and verified against the asset inventory. The discovery is failing and not providing reliable or complete data. The syslog shows the following information:

Which of the following describes the reason why the discovery is failing?

A cybersecurity analyst has received the laptop of a user who recently left the company. The analyst types
`history' into the prompt, and sees this line of code in the latest bash history:

This concerns the analyst because this subnet should not be known to users within the company.

Which of the following describes what this code has done on the network?

An internally developed file-monitoring system identified the following excerpt as causing a program to crash often:

char filedata[100];
fp = fopen(`access.log`, `r`);
srtcopy (filedata, fp);
printf (`%s\n`, filedata);

Which of the following should a security analyst recommend to fix the issue?

After reading about data breaches at a competing company, senior leaders in an organization have grown increasingly concerned about social engineering attacks. They want to increase awareness among staff regarding this threat, but do not want to use traditional training methods because they regard these methods as ineffective.

Which of the following approaches would BEST meet the requirements?

A contained section of a building is unable to connect to the Internet A security analyst. A security analyst investigates me issue but does not see any connections to the corporate web proxy However the analyst does notice a small spike in traffic to the Internet. The help desk technician verifies all users are connected to the connect SSID. but there are two of the same SSIDs listed in the network connections.

Which of the following BEST describes what is occurring?

A security analyst is correlating, ranking, and enriching raw data into a report that will be interpreted by humans or machines to draw conclusions and create actionable recommendations.

Which of the following steps in the intelligence cycle is the security analyst performing?

An organization needs to limit its exposure to accidental disclosure when employees send emails that contain personal information to recipients outside the company

Which of the following technical controls would BEST accomplish this goal?

Simulation

Part2: AppServ4

You are a cybersecurity analyst tasked with interpreting scan data from Company A's servers. You must verify the requirements are being met for all of the servers and recommend changes if you find they are not.

The company's hardening guidelines indicate the following:

1. TLS 1.2 is the only version of TLS running.
2. Apache 2.4.18 or greater should be used.
3. Only default ports should be used.

INSTRUCTIONS

Using the supplied data, record the status of compliance with the company's guidelines for each server.
The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for issues based ONLY on the hardening guidelines provided.

A security analyst performs a weekly vulnerability scan on a network that has 240 devices and receives a report with 2.450 pages.

Which of the following would most likely decrease the number of false positives?

Which of the following are considered PII by themselves? (Choose two.)

A company that is hiring a penetration tester wants to exclude social engineering from the list of authorized activities.

Which of the following documents should include these details?

A security analyst is reviewing packet captures from a system that was compromised. The system was already isolated from the network, but it did have network access for a few hours after being compromised.
When viewing the capture in a packet analyzer, the analyst sees the following:

Which of the following can the analyst conclude?

A security analyst recently observed evidence of an attack against a company's web server. The analyst investigated the issue but was unable to find an exploit that adequately explained the observations.

Which of the following is the MOST likely cause of this issue?

A vulnerability scanner has identified an out-of-support database software version running on a server. The software update will take six to nine months to complete. The management team has agreed to a one-year extended support contract with the software vendor.

Which of the following BEST describes the risk treatment in this scenario?

A security analyst is running a routine vulnerability scan against a web farm. The farm consists of a single server acting as a load-balancing reverse proxy and offloads cryptographic processes to the backend servers. The backend servers consist of four servers that process the inquiries for the front end.

A web service SSL query of each server responds with the same output:

Connected (0x000003)
depth=0 /0=farm.company.com/CN=farm.company.com/OU=Domain Control Validated

Which of the following results BEST addresses these findings?

Which of the following could be directly impacted by an unpatched vulnerability in vSphere ESXi?

Which of the following policies would state an employee should not disable security safeguards, such as host firewalls and antivirus on company systems?

Which of the following threat classifications would MOST likely use polymorphic code?

A security analyst is reviewing output from a CVE-based vulnerability scanner. Before conducting the scan, the analyst was careful to select only Windows-based servers in a specific datacenter. The scan revealed that the datacenter includes 27 machines running Windows 2003 Server Edition (Win2003SE). In 2015, there were 36 new vulnerabilities discovered in the Win2003SE environment.

Which of the following statements are MOST likely applicable? (Choose two.)

A security technician is testing a solution that will prevent outside entities from spoofing the company's email domain, which is comptia.org. The testing is successful, and the security technician is prepared to fully implement the solution.

Which of the following actions should the technician take to accomplish this task?

A company's security officer needs to implement geographical IP blocks for nation-state actors from a foreign country.
On which of the following should the blocks be implemented?

A logistics company's vulnerability scan identifies the following vulnerabilities on Internet-facing devices in the DMZ: SQL injection on an infrequently used web server that provides files to vendors SSL/TLS not used for a website that contains promotional information
The scan also shows the following vulnerabilities on internal resources: Microsoft Office Remote Code Execution on test server for a human resources system TLS downgrade vulnerability on a server in a development network In order of risk, which of the following should be patched FIRST?

The Chief Executive Officer (CEO) of a large insurance company has reported phishing emails that contain malicious links are targeting the entire organization.

Which of the following actions would work BEST to prevent against this type of attack?

During routine monitoring a security analyst identified the following enterpnse network traffic:

Packet capture output:

Which of the following BEST describes what the security analyst observed?

During a routine review of firewall logs, an analyst identified that an IP address from the organization's server subnet had been connecting during nighttime hours to a foreign IP address, and had been sending between 150 and 500 megabytes of data each time. This had been going on for approximately one week, and the affected server was taken offline for forensic review.

Which of the following is MOST likely to drive up the incident's impact assessment?

During an investigation, a security analyst determines suspicious activity occurred during the night shift over the weekend. Further investigation reveals the activity was initiated from an internal IP going to an external website.

Which of the following would be the MOST appropriate recommendation to prevent the activity from happening in the future?

A cybersecurity analyst is currently auditing a new Active Directory server for compliance. The analyst uses Nessus to do the initial scan, and Nessus reports the following:

Which of the following critical vulnerabilities has the analyst discovered?

A security analyst needs to provide the development learn with secure connectivity from the corporate network to a three-tier cloud environment. The developers require access to servers in all three tiers in order to perform various configuration tasks.

Which of the following technologies should the analyst implement to provide secure transport?

A cybersecurity analyst is retained by a firm for an open investigation. Upon arrival, the cybersecurity
analyst reviews several security logs.

Given the following snippet of code:

Which of the following combinations BEST describes the situation and recommendations to be made for this situation?

While conducting research on malicious domains, a threat intelligence analyst received a blue screen of death. The analyst rebooted and received a message stating that the computer had been locked and could only be opened by following the instructions on the screen.

Which of the following combinations describes the MOST likely threat and the PRIMARY mitigation for the threat?

A malware infection spread to numerous workstations within the marketing department. The workstations were quarantined and replaced with machines.

Which of the following represents a FINAL step in the eradication of the malware?

An organization has the following risk mitigation policies

Risks without compensating controls will be mitigated first it the nsk value is greater than $50,000
Other nsk mitigation will be pnontized based on risk value.

The following risks have been identified:

Which of the following is the ordei of priority for risk mitigation from highest to lowest?

An organization has not had an incident for several months. The Chief Information Security Officer (CISO) wants to move to a more proactive stance for security investigations.

Which of the following would BEST meet that goal?

Following a recent security breach, a company decides to investigate account usage to ensure privileged accounts are only being utilized during typical business hours. During the investigation, a security analyst determines an account was consistently utilized in the middle of the night.

Which of the following actions should the analyst take NEXT?

Which of the following is a control that allows a mobile application to access and manipulate information which should only be available by another application on the same mobile device (e.g.
a music application posting the name of the current song playing on the device on a social media site)?

Which of the following should be found within an organization's acceptable use policy?

When network administrators observe an increased amount of web traffic without an increased number of financial transactions, the company is MOST likely experiencing which of the following attacks?

During the forensic a phase of a security investigation, it was discovered that an attacker was able to find private keys on a poorly secured team shared drive. The attacker used those keys to intercept and decrypt sensitive traffic on a web server.

Which of the following describes this type of exploit and the potential remediation?

An organization has a strict policy that if elevated permissions are needed, users should always run commands under their own account, with temporary administrator privileges if necessary. A security analyst is reviewing syslog entries and sees the following:

Which of the following entries should cause the analyst the MOST concern?

At which of the following phases of the SDLC shoukJ security FIRST be involved?

A business recently installed a kiosk that is running on a hardened operating system as a restricted user.
The kiosk user application is the only application that is allowed to run. A security analyst gets a report that pricing data is being modified on the server, and management wants to know how this is happening. After reviewing the logs, the analyst discovers the root account from the kiosk is accessing the files. After validating the permissions on the server, the analyst confirms the permissions from the kiosk do not allow to write to the server data.

Which of the following is the MOST likely reason for the pricing data modifications on the server?

A development team is testing a new application release. The team needs to import existing client PHI data records from the production environment to the test environment to test accuracy and functionality.

Which of the following would BEST protect the sensitivity of this data while still allowing the team to perform the testing?

The following IDS log was discovered by a company's cybersecurity analyst:

Which of the following was launched against the company based on the IDS log?

A medical organization recently started accepting payments over the phone. The manager is concerned about the impact of the storage of different types of data.

Which of the following types of data incurs the highest regulatory constraints?

A security analyst discovered a specific series of IP addresses that are targeting an organization. None of the attacks have been successful.

Which of the following should the security analyst perform NEXT?

A security analyst needs to develop a brief that will include the latest incidents and the attack phases of the incidents. The goal is to support threat intelligence and identify whether or not the incidents are linked.

Which of the following methods would be MOST appropriate to use?

An email analysis system notifies a security analyst that the following message was quarantined and requires further review.

From: [email protected] <[email protected]>
To: [email protected] <[email protected]>
Subject: [EXTERNAL] Gift card purchase ASAP
Body:
Please purchase gift cards to any major electronics store and reply with pictures of them to this email!

Which of the following actions should the security analyst take?

Which of the following types of policies is used to regulate data storage on the network?

A security analyst discovers a standard user has unauthorized access to the command prompt, PowerShell, and other system utilities.

Which of the following is the BEST action for the security analyst to take?

A cybersecurity analyst has identified a new mission-essential function that utilizes a public cloud-based system. The analyst needs to classify the information processed by the system with respect to CIA.

Which of the following should provide the CIA classification for the information?

The management team assigned the following values to an inadvertent breach of privacy regulations during the original risk assessment:

1. Probability = 25%
2. Magnitude = $1,015 per record
3. Total records = 10,000

Two breaches occurred during the fiscal year. The first compromised 35 records, and the second compromised 65 records.

Which of the following is the value of the records that were compromised?

A security is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS.

Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise?

A security analyst has noticed an alert from the SIEM. A workstation is repeatedly trying to connect to port 445 of a file server on the production network. All of the attempts are made with invalid credentials.

Which of the following describes what is occurring?

Which of the following are important reasons for performing proactive threat-hunting activities? (Choose two.)

An organizational policy requires one person to input accounts payable and another to do accounts receivable. A separate control requires one person to write a check and another person to sign all checks greater than $5,000 and to get an additional signature for checks greater than $10,000.

Which of the following controls has the organization implemented?

A security engineer is reviewing security products that identify malicious actions by users as part of a
company's insider threat program.

Which of the following is the MOST appropriate product category for this purpose?

An analyst has noticed unusual activities in the SIEM to a .cn domain name.

Which of the following should the analyst use to identify the content of the traffic?

In an effort to be proactive, an analyst has run an assessment against a sample workstation before auditors visit next month. The scan results are as follows:

Based on the output of the scan, which of the following is the BEST answer?

An organization wants to harden its web servers. As part of this goal, leadership has directed that vulnerability scans be performed, and the security team should remediate the servers according to industry best practices. The team has already chosen a vulnerability scanner and performed the necessary scans, and now the team needs to prioritize the fixes.

Which of the following would help to prioritize the vulnerabilities for remediation in accordance with industry best practices?

A security analyst has observed several incidents within an organization that are affecting one specific piece of hardware on the network. Further investigation reveals the equipment vendor previously released a patch.

Which of the following is the MOST appropriate threat classification for these incidents?

In SIEM software, a security analysis selected some changes to hash signatures from monitored files during the night followed by SMB brute-force attacks against the file servers.

Based on this behavior, which of the following actions should be taken FIRST to prevent a more serious compromise?

An organization uses Common Vulnerability Scoring System (CVSS) scores to prioritize remediation of vulnerabilities.

Management wants to modify the priorities based on a difficulty factor so that vulnerabilities with lower CVSS scores may get a higher priority if they are easier to implement with less risk to system functionality.
Management also wants to quantify the priority.

Which of the following would achieve management's objective?

A company has alerted planning the implemented a vulnerability management procedure. However, to security maturity level is low, so there are some prerequisites to complete before risk calculation and prioritization.

Which of the following should be completed FIRST?

A security analyst at an organization is reviewing vulnerability reports from a newly deployed vulnerability management platform. The organization is not receiving information about devices that rarely connect to the network.

Which of the following will the analyst most likely do to obtain vulnerability information about these devices?

Which of the following is the BEST way to share incident-related artifacts to provide non-repudiation?

An analyst is reviewing the following output:

Which of the following was MOST likely used to discover this?

An information security analyst discovered a virtual machine server was compromised by an attacker.

Which of the following should be the FIRST step to confirm and respond to the incident?

An organization's Chief Information Security Officer (CISO) has asked department leaders to coordinate on communication plans that can be enacted in response to different cybersecurity incident triggers.

Which of the following is a benefit of having these communication plans?

Security awareness and compliance programs are most effective at reducing the likelihood and impact of attacks from: