CompTIA CompTIA CySA+ CS0-002 Questions & Answers

• Question 121:

  Massivelog.log has grown to 40GB on a Windows server. At this size, local tools are unable to read the file, and it cannot be moved off the virtual server where it is located.

  Which of the following lines of PowerShell script will allow a user to extract the last 10,000 lines of the log for review?

  A. tail -10000 Massivelog.log > extract.txt

  B. info tail n -10000 Massivelog.log | extract.txt;

  C. get content `./Massivelog.log' -Last 10000 | extract.txt

  D. get-content `./Massivelog.log' -Last 10000 > extract.txt;

  Correct Answer: D

• Question 122:

  A financial institution's business unit plans to deploy a new technology in a manner that violates existing information security standards. Which of the following actions should the Chief Information Security Officer (CISO) take to manage any type of violation?

  A. Enforce the existing security standards and controls

  B. Perform a risk analysis and qualify the risk with legal

  C. Perform research and propose a better technology

  D. Enforce the standard permits

  Correct Answer: B

  The International Standards Organization, or ISO, develops standards for businesses around the world so that they may operate using a uniform set of best practices. These standards are not enforceable laws, but companies who choose to follow them stand to gain international credibility from their compliance; standards are set as guidance for best practices but are not enforceable laws

• Question 123:

  An organization used a third party to conduct a security audit and discovered several deficiencies in the cybersecurity program. The findings noted many external vulnerabilities that were not caught by the vulnerability scanning software, numerous weaknesses that allowed lateral movement, and gaps in monitoring that did not detect the activity of the auditors. Based on these findings, which of the following would be the BEST long-term enhancement to the security program?

  A. Quarterly external penetration testing

  B. Monthly tabletop scenarios

  C. Red-team exercises

  D. Audit exercises

  Correct Answer: D

• Question 124:

  Which of the following should a database administrator implement to BEST protect data from an untrusted server administrator?

  A. Data deidentification

  B. Data encryption

  C. Data masking

  D. Data minimization

  Correct Answer: B

• Question 125:

  An organization wants to mitigate against risks associated with network reconnaissance. ICMP is already blocked at the firewall; however, a penetration testing team has been able to perform reconnaissance against the organization's network and identify active hosts. An analyst sees the following output from a packet capture:

  

  Which of the following phrases from the output provides information on how the testing team is successfully getting around the ICMP firewall rule?

  A. flags=RA indicates the testing team is using a Christmas tree attack

  B. ttl=64 indicates the testing team is setting the time to live below the firewall's threshold

  C. 0 data bytes indicates the testing team is crafting empty ICMP packets

  D. NO FLAGS are set indicates the testing team is using hping

  Correct Answer: D

• Question 126:

  A security analyst is investigating malicious traffic from an internal system that attempted to download proxy avoidance as identified from the firewall logs, but the destination IP is blocked and not captured. Which of the following should the analyst do?

  A. Shut down the computer

  B. Capture live data using Wireshark

  C. Take a snapshot

  D. Determine if DNS logging is enabled

  E. Review the network logs

  Correct Answer: D

• Question 127:

  An organization is assessing risks so it can prioritize its mitigation actions. Following are the risks and their probability and impact:

  

  Which of the following is the order of priority for risk mitigation from highest to lowest?

  A. A, B, C, D

  B. A, D, B, C

  C. B, C, A, D

  D. C, B, D, A

  E. D, A, C, B

  Correct Answer: B

• Question 128:

  The Chief Information Officer (CIO) of a large healthcare institution is concerned about all machines having direct access to sensitive patient information. Which of the following should the security analyst implement to BEST mitigate the risk of sensitive data exposure?

  A. A cloud access service broker system

  B. NAC to ensure minimum standards are met

  C. MFA on all workstations

  D. Network segmentation

  Correct Answer: D

• Question 129:

  A company is moving from the use of web servers hosted in an internal datacenter to a containerized cloud platform. An analyst has been asked to identify indicators of compromise in the containerized environment. Which of the following would BEST indicate a running container has been compromised?

  A. A container from an approved software image has drifted

  B. An approved software orchestration container is running with root privileges

  C. A container from an approved software image has stopped responding

  D. A container from an approved software image fails to start

  Correct Answer: A

• Question 130:

  A security analyst received a series of antivirus alerts from a workstation segment, and users reported ransomware messages. During lessons-learned activities, the analyst determines the antivirus was able to alert to abnormal behavior but did not stop this newest variant of ransomware. Which of the following actions should be taken to BEST mitigate the effects of this type of threat in the future?

  A. Enabling sandboxing technology

  B. Purchasing cyber insurance

  C. Enabling application blacklisting

  D. Installing a firewall between the workstations and Internet

  Correct Answer: A