CompTIA CompTIA CySA+ CS0-002 Questions & Answers

• Question 991:

  A security analyst for a large financial institution is creating a threat model for a specific threat actor that is likely targeting an organization's financial assets. Which of the following is the BEST example of the level of sophistication this threat actor is using?

  A. Social media accounts attributed to the threat actor

  B. Custom malware attributed to the threat actor from prior attacks

  C. Email addresses and phone numbers tied to the threat actor

  D. Network assets used in previous attacks attributed to the threat actor

  E. IP addresses used by the threat actor for command and control

  Correct Answer: B

  Because you cannot create a threat model for the malware because you do not know exactly what it is, but if you know how this bad actor infiltrates and what is exploited you will be able to be on the lookout for network anomalies and the such. I would assume that they may use the same malware signatures but they'd probably go for another zero day with the same network tactic imo.. attack vectors

• Question 992:

  Bootloader malware was recently discovered on several company workstations. All the workstations run Windows and are current models with UEFI capability. Which of the following UEFI settings is the MOST likely cause of the infections?

  A. Compatibility mode

  B. Secure boot mode

  C. Native mode

  D. Fast boot mode

  Correct Answer: A

• Question 993:

  A security analyst is providing a risk assessment for a medical device that will be installed on the corporate network. During the assessment, the analyst discovers the device has an embedded operating system that will be at the end of its life in two years. Due to the criticality of the device, the security committee makes a risk- based policy decision to review and enforce the vendor upgrade before the end of life is reached. Which of the following risk actions has the security committee taken?

  A. Risk exception

  B. Risk avoidance

  C. Risk tolerance

  D. Risk acceptance

  Correct Answer: D

• Question 994:

  During a cyber incident, which of the following is the BEST course of action?

  A. Switch to using a pre-approved, secure, third-party communication system.

  B. Keep the entire company informed to ensure transparency and integrity during the incident.

  C. Restrict customer communication until the severity of the breach is confirmed.

  D. Limit communications to pre-authorized parties to ensure response efforts remain confidential.

  Correct Answer: D

• Question 995:

  Which of the following BEST describes the process by which code is developed, tested, and deployed in small batches?

  A. Agile

  B. Waterfall

  C. SDLC

  D. Dynamic code analysis

  Correct Answer: A

  Reference: https://www.cleverism.com/software-development-life-cycle-sdlc-methodologies/

• Question 996:

  Which of the following types of policies is used to regulate data storage on the network?

  A. Password

  B. Acceptable use

  C. Account management

  D. Retention

  Correct Answer: D

  Reference: http://www.css.edu/administration/information-technologies/computing-policies/computer-and- network-policies.html

• Question 997:

  A security team wants to make SaaS solutions accessible from only the corporate campus. Which of the following would BEST accomplish this goal?

  A. Geofencing

  B. IP restrictions

  C. Reverse proxy

  D. Single sign-on

  Correct Answer: A

  Reference: https://bluedot.io/library/what-is-geofencing/

• Question 998:

  Data spillage occurred when an employee accidentally emailed a sensitive file to an external recipient. Which of the following controls would have MOST likely prevented this incident?

  A. SSO

  B. DLP

  C. WAF

  D. VDI

  Correct Answer: B

  Reference: https://greenlightcorp.com/blog/cyber-security-solutions-data-spillage-and-how-to-create-an- after-incident-to-do-list/

• Question 999:

  A storage area network (SAN) was inadvertently powered off while power maintenance was being performed in a datacenter. None of the systems should have lost all power during the maintenance. Upon review, it is discovered that a SAN

  administrator moved a power plug when testing the SAN's fault notification features.

  Which of the following should be done to prevent this issue from reoccurring?

  A. Ensure both power supplies on the SAN are serviced by separate circuits, so that if one circuit goes down, the other remains powered.

  B. Install additional batteries in the SAN power supplies with enough capacity to keep the system powered on during maintenance operations.

  C. Ensure power configuration is covered in the datacenter change management policy and have the SAN administrator review this policy.

  D. Install a third power supply in the SAN so loss of any power intuit does not result in the SAN completely powering off.

  Correct Answer: A

• Question 1000:

  A cybersecurity analyst has access to several threat feeds and wants to organize them while simultaneously comparing intelligence against network traffic. Which of the following would BEST accomplish this goal?

  A. Continuous integration and deployment

  B. Automation and orchestration

  C. Static and dynamic analysis

  D. Information sharing and analysis

  Correct Answer: B