CompTIA CS0-001 Online Practice Questions and Exam Preparation

CompTIA CS0-001 Online Questions & Answers

• Question 151:

  Alerts have been received from the SIEM, indicating infections on multiple computers. Based on threat characteristics, these files were quarantined by the host-based antivirus program. At the same time, additional alerts in the SIEM show multiple blocked URLs from the address of the infected computers; the URLs were classified as uncategorized. The domain location of the IP address of the URLs that were blocked is checked, and it is registered to an ISP in Russia. Which of the following steps should be taken NEXT?

  A. Remove those computers from the network and replace the hard drives. Send the infected hard drives out for investigation.
  B. Run a full antivirus scan on all computers and use Splunk to search for any suspicious activity that happened just before the alerts were received in the SIEM.
  C. Run a vulnerability scan and patch discovered vulnerabilities on the next pathing cycle. Have the users restart their computers. Create a use case in the SIEM to monitor failed logins on the infected computers.
  D. Install a computer with the same settings as the infected computers in the DMZ to use as a honeypot. Permit the URLs classified as uncategorized to and from that host.
  B. Run a full antivirus scan on all computers and use Splunk to search for any suspicious activity that happened just before the alerts were received in the SIEM.

• Question 152:

  Which of the following is the BEST way to share incident-related artifacts to provide non-repudiation?

  A. Secure email
  B. Encrypted USB drives
  C. Cloud containers
  D. Network folders
  B. Encrypted USB drives

• Question 153:

  An employee was conducting research on the Internet when a message from cyber criminals appeared on the screen, stating the hard drive was just encrypted by a ransomware variant. An analyst observes the following: Antivirus signatures were updated recently The desktop background was changed Web proxy logs show browsing to various information security sites and ad network traffic There is a high volume of hard disk activity on the file server SMTP server shown the employee recently received several emails from blocked senders The company recently switched web hosting providers There are several IPS alerts for external port scans

  Which of the following describes how the employee got this type of ransomware?

  A. The employee fell victim to a CSRF attack
  B. The employee was using another user's credentials
  C. The employee opened an email attachment
  D. The employee updated antivirus signatures
  A. The employee fell victim to a CSRF attack

• Question 154:

  A vulnerability scan returned the following results for a web server that hosts multiple wiki sites:

  Apache-HTTPD-cve-2014-023: Apache HTTPD: mod_cgid denial of service CVE-2014-0231

  Due to a flaw found in mog_cgid, a server using mod_cgid to host CGI scripts could be vulnerable to a DoS attack caused by a remote attacker who is exploiting a weakness in non-standard input, causing processes to hang indefinitely.

  

  The security analyst has confirmed the server hosts standard CGI scripts for the wiki sites, does not have mod_cgid installed, is running Apache 2.2.22, and is not behind a WAF. The server is located in the DMZ, and the purpose of the server is to allow customers to add entries into a publicly accessible database.

  Which of the following would be the MOST efficient way to address this finding?

  A. Place the server behind a WAF to prevent DoS attacks from occurring.
  B. Document the finding as a false positive.
  C. Upgrade to the newest version of Apache.
  D. Disable the HTTP service and use only HTTPS to access the server.
  B. Document the finding as a false positive.

• Question 155:

  In order to meet regulatory compliance objectives for the storage of PHI, vulnerability scans must be conducted on a continuous basis. The last completed scan of the network returned 5,682 possible vulnerabilities. The Chief Information Officer (CIO) would like to establish a remediation plan to resolve all known issues. Which of the following is the BEST way to proceed?

  A. Attempt to identify all false positives and exceptions, and then resolve all remaining items.
  B. Hold off on additional scanning until the current list of vulnerabilities have been resolved.
  C. Place assets that handle PHI in a sandbox environment, and then resolve all vulnerabilities.
  D. Reduce the scan to items identified as critical in the asset inventory, and resolve these issues first.
  D. Reduce the scan to items identified as critical in the asset inventory, and resolve these issues first.

• Question 156:

  The IT department at a growing law firm wants to begin using a third-party vendor for vulnerability monitoring and mitigation. The executive director of the law firm wishes to outline the assumptions and expectations between the two companies. Which of the following documents might be referenced in the event of a security breach at the law firm?

  A. SLA
  B. MOU
  C. SOW
  D. NDA
  A. SLA

• Question 157:

  An organization recently had its strategy posted to a social media website. The document posted to the website is an exact copy of a document stored on only one server in the organization. A security analyst sees the following output from a command-line entry on the server suspected of the problem:

  

  Which of the following would be the BEST course of action?

  A. Remove the malware associated with PID 773
  B. Monitor all the established TCP connections for data exfiltration
  C. Investigate the malware associated with PID 123
  D. Block all TCP connections at the firewall
  E. Figure out which of the Firefox processes is the malware
  A. Remove the malware associated with PID 773

• Question 158:

  An organization wants to harden its web servers. As part of this goal, leadership has directed that vulnerability scans be performed, and the security team should remediate the servers according to industry best practices. The team has already chosen a vulnerability scanner and performed the necessary scans, and now the team needs to prioritize the fixes. Which of the following would help to prioritize the vulnerabilities for remediation in accordance with industry best practices?

  A. CVSS
  B. SLA
  C. ITIL
  D. OpenVAS
  E. Qualys
  A. CVSS

• Question 159:

  An alert is issued from the SIEM that indicates a large number of failed logins for the same account name on one of the application servers starting at 10:20 a.m. No other significant failed login activity is detected. Using Splunk to search for activity pertaining to that account name, a security analyst finds the account has been authenticating successfully for some time and started to fail this morning. The account is attempting to authenticate from an internal server that is running a database to an application server. No other security activity is detected on the network. The analyst discovers the account owner is a developer who no longer works for the company. Which of the following is the MOST likely reason for the failed login attempts for that account?

  A. The account that is failing to authenticate has not been maintained, and the company password change policy time frame has been reached for that account
  B. The host-based firewall is blocking port 389 LDAP communication, preventing the login credentials from being received by the application server
  C. The license for the application has expired, and the failed logins will continue to occur until a new license key is installed on the application
  D. A successful malware attack has provided someone access to the network, and failed login attempts are an indication of an attempt to privilege access to the application
  A. The account that is failing to authenticate has not been maintained, and the company password change policy time frame has been reached for that account

• Question 160:

  An organization has recently recovered from an incident where a managed switch had been accessed and reconfigured without authorization by an insider. The incident response team is working on developing a lessons learned report with recommendations. Which of the following recommendations will BEST prevent the same attack from occurring in the future?

  A. Remove and replace the managed switch with an unmanaged one.
  B. Implement a separate logical network segment for management interfaces.
  C. Install and configure NAC services to allow only authorized devices to connect to the network.
  D. Analyze normal behavior on the network and configure the IDS to alert on deviations from normal.
  B. Implement a separate logical network segment for management interfaces.