CompTIA CS0-001 Online Practice Questions and Exam Preparation

CompTIA CS0-001 Online Questions & Answers

• Question 1:

  Due to a security breach initiated from South America, the Chief Security Officer (CSO) instructed a team to design and implement an appropriate security control to prevent such an attack from reoccurring. The company has sales and consulting teams across the United States that need access to company resources. The security manager implemented a location-based authentication to prevent non-US-based access to the company networks. Three months later, the same incident reoccurred with an attack originating from a country in Asia. Which of the following security design defects could be the cause?

  A. The team did not account for the VPN access and did not ensure non-repudiation
  B. The company just replaced a firewall that had a DDoS vulnerability
  C. The sales and supports are reusing the same passwords for their personal accounts, such as banking and email
  D. The hackers left a backdoor within the company networks that was not cleaned successfully
  A. The team did not account for the VPN access and did not ensure non-repudiation

• Question 2:

  A cyber-incident response team is responding to a network intrusion incident on a hospital network. Which of the following must the team prepare to allow the data to be used in court as evidence?

  A. Computer forensics form
  B. HIPAA response form
  C. Chain of custody form
  D. Incident form
  B. HIPAA response form

• Question 3:

  An analyst was investigating the attack that took place on the network. A user was able to access the system without proper authentication. Which of the following will the analyst recommend, related to management approaches, in order to control access? (Choose three.)

  A. RBAC
  B. LEAP
  C. DAC
  D. PEAP
  E. MAC
  F. SCAP
  G. BCP
  A. RBAC
  C. DAC
  E. MAC

• Question 4:

  A system is experiencing noticeably slow response times, and users are being locked out frequently. An analyst asked for the system security plan and found the system comprises two servers: an application server in the DMZ and a database server inside the trusted domain. Which of the following should be performed NEXT to investigate the availability issue?

  A. Review the firewall logs.
  B. Review syslogs from critical servers.
  C. Perform fuzzing.
  D. Install a WAF in front of the application server.
  C. Perform fuzzing.

• Question 5:

  Nmap scan results on a set of IP addresses returned one or more lines beginning with "cpe:/o:" followed by a company name, product name, and version. Which of the following would this string help an administrator to identify?

  A. Operating system
  B. Running services
  C. Installed software
  D. Installed hardware
  A. Operating system

• Question 6:

  A cybersecurity analyst is currently auditing a new Active Directory server for compliance. The analyst uses Nessus to do the initial scan, and Nessus reports the following:

  

  Which of the following critical vulnerabilities has the analyst discovered?

  A. Known backdoor
  B. Zero-day
  C. Path disclosure
  D. User enumeration
  A. Known backdoor

• Question 7:

  An HR employee began having issues with a device becoming unresponsive after attempting to open an email attachment. When informed, the security analyst became suspicious of the situation, even though there was not any unusual behavior on the IDS or any alerts from the antivirus software. Which of the following BEST describes the type of threat in this situation?

  A. Packet of death
  B. Zero-day malware
  C. PII exfiltration
  D. Known virus
  B. Zero-day malware

• Question 8:

  A company discovers an unauthorized device accessing network resources through one of many network drops in a common area used by visitors. The company decides that it wants to quickly prevent unauthorized devices from accessing

  the network but policy prevents the company from making changes on every connecting client.

  Which of the following should the company implement?

  A. Port security
  B. WPA2
  C. Mandatory Access Control
  D. Network Intrusion Prevention
  A. Port security

• Question 9:

  A security analyst has just completed a vulnerability scan of servers that support a business critical application that is managed by an outside vendor. The results of the scan indicate the devices are missing critical patches. Which of the following factors can inhibit remediation of these vulnerabilities? (Choose two.)

  A. Inappropriate data classifications
  B. SLAs with the supporting vendor
  C. Business process interruption
  D. Required sandbox testing
  E. Incomplete asset inventory
  C. Business process interruption
  D. Required sandbox testing

• Question 10:

  A cybersecurity analyst has several log files to review. Instead of using grep and cat commands, the analyst decides to find a better approach to analyze the logs. Given a list of tools, which of the following would provide a more efficient way for the analyst to conduct a timeline analysis, do keyword searches, and output a report?

  A. Kali
  B. Splunk
  C. Syslog
  D. OSSIM
  B. Splunk