CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 171:

  As part of a review of incident response plans, which of the following is MOST important for an organization to understand when establishing the breach notification period?

  A. Organizational policies

  B. Vendor requirements and contracts

  C. Service-level agreements

  D. Legal requirements

  Correct Answer: D

• Question 172:

  A security analyst is reviewing the following requirements (or new time clocks that will be installed in a shipping warehouse:

  1.

  The clocks must be configured so they do not respond to ARP broadcasts.

  2.

  The server must be configured with static ARP entries for each clock.

  Which of the following types of attacks will this configuration mitigate?

  A. Spoofing

  B. Overflows

  C. Rootkits

  D. Sniffing

  Correct Answer: A

• Question 173:

  Which of the following BEST describes the primary role ol a risk assessment as it relates to compliance with risk-based frameworks?

  A. It demonstrates the organization's mitigation of risks associated with internal threats.

  B. It serves as the basis for control selection.

  C. It prescribes technical control requirements.

  D. It is an input to the business impact assessment.

  Correct Answer: A

• Question 174:

  A bad actor bypasses authentication and reveals all records in a database through an SQL injection. Implementation of which of the following would work BEST to prevent similar attacks in

  A. Strict input validation

  B. Blacklisting

  C. SQL patching

  D. Content filtering

  E. Output encoding

  Correct Answer: A

• Question 175:

  A Chief Information Security Officer (CISO) is concerned developers have too much visibility into customer data Which of the following controls should be implemented to BEST address these concerns?

  A. Data masking

  B. Data loss prevention

  C. Data minimization

  D. Data sovereignty

  Correct Answer: A

• Question 176:

  An analyst is searching a log for potential credit card leaks. The log stores all data encoded in hexadecimal. Which of the following commands will allow the security analyst to confirm the incident?

  A. cat log xxd -r -p | egrep ' [0-9] {16}

  B. egrep '(3(0-9)) (16) ' log

  C. cat log | xxd -r -p egrep '(0-9) (16)'

  D. egrep ' (0-9) (16) ' log | xxdc

  Correct Answer: C

• Question 177:

  During a review of vulnerability scan results an analyst determines the results may be flawed because a control-baseline system which is used to evaluate a scanning tools effectiveness was reported as not vulnerable Consequently, the analyst verifies the scope of the scan included the control-baseline host which was available on the network during the scan. The use of a control- baseline endpoint in this scenario assists the analyst in confirming.

  A. verification of mitigation

  B. false positives

  C. false negatives

  D. the criticality index

  E. hardening validation.

  Correct Answer: B

• Question 178:

  A contained section of a building is unable to connect to the Internet A security analyst. A security analyst investigates me issue but does not see any connections to the corporate web proxy However the analyst does notice a small spike in traffic to the Internet. The help desk technician verifies all users are connected to the connect SSID. but there are two of the same SSIDs listed in the network connections. Which of the following BEST describes what is occurring?

  A. Bandwidth consumption

  B. Denial of service

  C. Beaconing

  D. Rogue device on the network

  Correct Answer: A

• Question 179:

  A user reports the system is behaving oddly following the installation of an approved third-party software application. The application executable was sourced from an internal repository Which of the following will ensure the application is valid?

  A. Ask the user to refresh the existing definition file for the antivirus software

  B. Perform a malware scan on the file in the internal repository

  C. Hash the application's installation file and compare it to the hash provided by the vendor

  D. Remove the user's system from the network to avoid collateral contamination

  Correct Answer: C

• Question 180:

  A security analyst is reviewing vulnerability scan results and notices new workstations are being flagged as having outdated antivirus signatures. The analyst observes the following plugin output:

  Antivirus is installed on the remote host:

  Installation path: C:\Program Files\AVProduct\Win32\

  Product Engine: 14.12.101

  Engine Version: 3.5.71

  Scanner does not currently have information about AVProduct version 3.5.71.

  It may no longer be supported.

  The engine version is out of date. The oldest supported version from the vendor is 4.2.11.

  The analyst uses the vendor's website to confirm the oldest supported version is correct. Which of the following BEST describes the situation?

  A. This is a false positive and the scanning plugin needs to be updated by the vendor

  B. This is a true negative and the new computers have the correct version of the software

  C. This is a true positive and the new computers were imaged with an old version of the software

  D. This is a false negative and the new computers need to be updated by the desktop team

  Correct Answer: C