CompTIA CS0-001 Online Practice Questions and Exam Preparation

CompTIA CS0-001 Online Questions & Answers

• Question 11:

  A security analyst wants to scan the network for active hosts. Which of the following host characteristics help to differentiate between a virtual and physical host?

  A. Reserved MACs
  B. Host IPs
  C. DNS routing tables
  D. Gateway settings
  A. Reserved MACs

• Question 12:

  In the development stage of the incident response policy, the security analyst needs to determine the stakeholders for the policy. Who of the following would be the policy stakeholders?

  A. Human resources, legal, public relations, management
  B. Chief information Officer (CIO), Chief Executive Officer, board of directors, stockholders
  C. IT, human resources, security administrator, finance
  D. Public information officer, human resources, audit, customer service
  B. Chief information Officer (CIO), Chief Executive Officer, board of directors, stockholders

• Question 13:

  A company has received the results of an external vulnerability scan from its approved scanning vendor. The company is required to remediate these vulnerabilities for clients within 72 hours of acknowledgement of the scan results. Which of the following contract breaches would result if this remediation is not provided for clients within the time frame?

  A. Service level agreement
  B. Regulatory compliance
  C. Memorandum of understanding
  D. Organizational governance
  A. Service level agreement

• Question 14:

  An organization is attempting to harden its web servers and reduce the information that might be disclosed by potential attackers. A security analyst is reviewing vulnerability scan results from a recent web server scan. Portions of the scan results are shown below:

  

  Which of the following lines indicates information disclosure about the host that needs to be remediated?

  A. Response: :\Documents\MarySmith\mailingList.pdf
  B. Finding#5144322
  C. First Time Detected 10 Nov 2015 09:00 GMT-0600
  D. Access Path: http://myOrg.com/mailingList.htm
  E. Request: GET http://myOrg.com/mailingList.aspx?content=volunteer
  A. Response: :\Documents\MarySmith\mailingList.pdf

• Question 15:

  An alert has been distributed throughout the information security community regarding a critical Apache vulnerability. Which of the following courses of action would ONLY identify the known vulnerability?

  A. Perform an unauthenticated vulnerability scan on all servers in the environment.
  B. Perform a scan for the specific vulnerability on all web servers.
  C. Perform a web vulnerability scan on all servers in the environment.
  D. Perform an authenticated scan on all web servers in the environment.
  B. Perform a scan for the specific vulnerability on all web servers.

• Question 16:

  While a threat intelligence analyst was researching an indicator of compromise on a search engine, the web proxy generated an alert regarding the same indicator. The threat intelligence analyst states that related sites were not visited but were searched for in a search engine. Which of the following MOST likely happened in this situation?

  A. The analyst is not using the standard approved browser.
  B. The analyst accidently clicked a link related to the indicator.
  C. The analyst has prefetch enabled on the browser in use.
  D. The alert in unrelated to the analyst's search.
  C. The analyst has prefetch enabled on the browser in use.

• Question 17:

  A security analyst is reviewing packet captures to determine the extent of success during an attacker's reconnaissance phase following a recent incident. The following is a hex and ASCII dump of one such packet:

  

  Which of the following BEST describes this packet?

  A. DNS BIND version request
  B. DNS over UDP standard query
  C. DNS over TCP server status query
  D. DNS zone transfer request
  A. DNS BIND version request

• Question 18:

  A cybersecurity analyst is hired to review the security measures implemented within the domain controllers of a company. Upon review, the cybersecurity analyst notices a brute force attack can be launched against domain controllers that run on a Windows platform. The first remediation step implemented by the cybersecurity analyst is to make the account passwords more complex. Which of the following is the NEXT remediation step the cybersecurity analyst needs to implement?

  A. Disable the ability to store a LAN manager hash.
  B. Deploy a vulnerability scanner tool.
  C. Install a different antivirus software.
  D. Perform more frequent port scanning.
  E. Move administrator accounts to a new security group.
  E. Move administrator accounts to a new security group.

• Question 19:

  An analyst finds that unpatched servers have undetected vulnerabilities because the vulnerability scanner does not have the latest set of signatures. Management directed the security team to have personnel update the scanners with the latest signatures at least 24 hours before conducting any scans, but the outcome is unchanged. Which of the following is the BEST logical control to address the failure?

  A. Configure a script to automatically update the scanning tool.
  B. Manually validate that the existing update is being performed.
  C. Test vulnerability remediation in a sandbox before deploying.
  D. Configure vulnerability scans to run in credentialed mode.
  A. Configure a script to automatically update the scanning tool.

• Question 20:

  A company that is hiring a penetration tester wants to exclude social engineering from the list of authorized activities. Which of the following documents should include these details?

  A. Acceptable use policy
  B. Service level agreement
  C. Rules of engagement
  D. Memorandum of understanding
  E. Master service agreement
  C. Rules of engagement