CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 1:

  During a cyber incident, which of the following is the BEST course of action?

  A. Switch to using a pre-approved, secure, third-party communication system.
  B. Keep the entire company informed to ensure transparency and integrity during the incident.
  C. Restrict customer communication until the severity of the breach is confirmed.
  D. Limit communications to pre-authorized parties to ensure response efforts remain confidential.
  D. Limit communications to pre-authorized parties to ensure response efforts remain confidential.

• Question 2:

  Which of following allows Secure Boot to be enabled?

  A. eFuse
  B. UEFI
  C. MSM
  D. PAM
  B. UEFI

• Question 3:

  A security analyst is investigating malicious traffic from an internal system that attempted to download proxy avoidance software as identified from the firewall logs but the destination IP is blocked and not captured. Which of the following should the analyst do?

  A. Shut down the computer
  B. Capture live data using Wireshark
  C. Take a snapshot
  D. Determine if DNS logging is enabled.
  E. Review the network logs.
  D. Determine if DNS logging is enabled.

  ---

  Explanation/Reference:

  The DNS debug log provides extremely detailed data about all DNS information that is sent and received by the DNS server, similar to the data that can be gathered using packet capture tools such as network monitor.

• Question 4:

  An organization wants to consolidate a number of security technologies throughout the organization and standardize a workflow for identifying security issues prioritizing the severity and automating a response.

  Which of the following would best meet the organization's needs'?

  A. MaaS
  B. SIEM
  C. SOAR
  D. CI/CD
  C. SOAR

  ---

  Explanation/Reference:

  A security orchestration, automation, and response (SOAR) system is a solution that combines various security technologies and workflows to identify security issues, prioritize their severity, and automate a response. A SOAR system can help an organization consolidate its security tools and processes and standardize its workflow for incident response. The other options are not relevant or comprehensive for this purpose. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0- 002), page 15; https://www.gartner.com/en/information-technology/glossary/security-orchestration-automation-and-response-soar

• Question 5:

  Which of the following has the GREATEST impact to the data retention policies of an organization?

  A. The CIA classification matrix assigned to each piece of data
  B. The level of sensitivity of the data established by the data owner
  C. The regulatory requirements concerning the data set
  D. The technical constraints of the technology used to store the data
  D. The technical constraints of the technology used to store the data

• Question 6:

  A security operations manager wants to build out an internal threat-hunting capability. Which of the following should be the first priority when creating a threat-hunting program?

  A. Establishing a hypothesis about which threats are targeting which systems
  B. Profiling common threat actors and activities to create a list of IOCs
  C. Ensuring logs are sent to a centralized location with search and filtering capabilities
  D. Identifying critical assets that will be used to establish targets for threat-hunting activities
  C. Ensuring logs are sent to a centralized location with search and filtering capabilities

  ---

  Explanation/Reference:

  By aggregating logs in a centralized location with search and filtering capabilities, security analysts can quickly and easily identify anomalous behavior that may indicate a potential threat. Additionally, a centralized location makes it easier to correlate events across multiple systems and identify patterns that may be indicative of an attack.

• Question 7:

  Clients are unable to access a company's API to obtain pricing data. An analyst discovers sources other than clients are scraping the API for data, which is causing the servers to exceed available resources. Which of the following would be BEST to protect the availability of the APIs?

  A. IP whitelisting
  B. Certificate-based authentication
  C. Virtual private network
  D. Web application firewall
  D. Web application firewall

• Question 8:

  Which of the following is a best practice when sending a file/data to another individual in an organization?

  A. When encrypting, split the file, and then compress each file.
  B. Encrypt and then compress the file.
  C. Encrypt the file but do not compress it.
  D. Compress and then encrypt the file.
  D. Compress and then encrypt the file.

• Question 9:

  An executive assistant wants to onboard a new cloud based product to help with business analytics and dashboarding. When of the following would be the BEST integration option for the service?

  A. Manually log in to the service and upload data files on a regular basis.
  B. Have the internal development team script connectivity and file translate to the new service.
  C. Create a dedicated SFTP sue and schedule transfers to ensue file transport security
  D. Utilize the cloud products API for supported and ongoing integrations
  D. Utilize the cloud products API for supported and ongoing integrations

• Question 10:

  For machine learning to be applied effectively toward security analysis automation, it requires __________.

  A. relevant training data.
  B. a threat feed API.
  C. a multicore, multiprocessor system.
  D. anomalous traffic signatures.
  A. relevant training data.