CompTIA CS0-001 Online Practice Questions and Exam Preparation

CompTIA CS0-001 Online Questions & Answers

• Question 351:

  Which of the following countermeasures should the security administrator apply to MOST effectively mitigate Bootkit-level infections of the organization's workstation devices?

  A. Remove local administrator privileges.
  B. Configure a BIOS-level password on the device.
  C. Install a secondary virus protection application.
  D. Enforce a system state recovery after each device reboot.
  A. Remove local administrator privileges.

• Question 352:

  In order to the leverage the power of data correlation with Nessus, a cybersecurity analyst must first be able to create a table for the scan results. Given the following snippet of code:

  

  Which of the following output items would be correct?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

• Question 353:

  A vulnerability scan has returned the following information:

  

  Which of the following describes the meaning of these results?

  A. There is an unknown bug in a Lotus server with no Bugtraq ID.
  B. Connecting to the host using a null session allows enumeration of share names.
  C. Trend Micro has a known exploit that must be resolved or patched.
  D. No CVE is present, so it is a false positive caused by Lotus running on a Windows server.
  B. Connecting to the host using a null session allows enumeration of share names.

• Question 354:

  Risk management wants IT to implement a solution that will permit an analyst to intercept, execute, and analyze potentially malicious files that are downloaded from the Internet. Which of the following would BEST provide this solution?

  A. File fingerprinting
  B. Decomposition of malware
  C. Risk evaluation
  D. Sandboxing
  D. Sandboxing

• Question 355:

  A threat intelligence feed has posted an alert stating there is a critical vulnerability in the kernel. Unfortunately, the company's asset inventory is not current. Which of the following techniques would a cybersecurity analyst perform to find all affected servers within an organization?

  A. A manual log review from data sent to syslog
  B. An OS fingerprinting scan across all hosts
  C. A packet capture of data traversing the server network
  D. A service discovery scan on the network
  B. An OS fingerprinting scan across all hosts

• Question 356:

  A security analyst has noticed an alert from the SIEM. A workstation is repeatedly trying to connect to port 445 of a file server on the production network. All of the attempts are made with invalid credentials. Which of the following describes what is occurring?

  A. Malware has infected the workstation and is beaconing out to the specific IP address of the file server.
  B. The file server is attempting to transfer malware to the workstation via SMB.
  C. An attacker has gained control of the workstation and is attempting to pivot to the file server by creating an SMB session.
  D. An attacker has gained control of the workstation and is port scanning the network.
  C. An attacker has gained control of the workstation and is attempting to pivot to the file server by creating an SMB session.

• Question 357:

  An organization has recently experienced a data breach. A forensic analysis confirmed the attacker found a legacy web server that had not been used in over a year and was not regularly patched. After a discussion with the security team, management decided to initiate a program of network reconnaissance and penetration testing. They want to start the process by scanning the network for active hosts and open ports. Which of the following tools is BEST suited for this job?

  A. Ping
  B. Nmap
  C. Netstat
  D. ifconfig
  E. Wireshark
  F. L0phtCrack
  B. Nmap

• Question 358:

  A security analyst is assisting with a computer crime investigation and has been asked to secure a PC and deliver it to the forensic lab. Which of the following items would be MOST helpful to secure the PC? (Choose three.)

  A. Tamper-proof seals
  B. Faraday cage
  C. Chain of custody form
  D. Drive eraser
  E. Write blockers
  F. Network tap
  G. Multimeter
  A. Tamper-proof seals
  B. Faraday cage
  C. Chain of custody form

• Question 359:

  Which of the allowing is a best practice with regard to interacting with the media during an incident?

  A. Allow any senior management level personnel with knowledge of the incident to discuss it.
  B. Designate a single port of contact and at least one backup for contact with the media.
  C. Stipulate that incidents are not to be discussed with the media at any time during the incident.
  D. Release financial information on the impact of damages caused by the incident.
  B. Designate a single port of contact and at least one backup for contact with the media.

• Question 360:

  Due to new regulations, a company has decided to institute an organizational vulnerability management program and assign the function to the security team. Which of the following frameworks would BEST support the program? (Choose two.)

  A. COBIT
  B. NIST
  C. ISO 27000 series
  D. ITIL
  E. COSO
  B. NIST
  D. ITIL