CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 1001:

  Which of the following sets of attributes BEST illustrates the characteristics of an insider threat from a security perspective?

  A. Unauthorized, unintentional, benign
  B. Unauthorized, intentional, malicious
  C. Authorized, intentional, malicious
  D. Authorized, unintentional, benign
  C. Authorized, intentional, malicious

  ---

  Explanation/Reference:

  Reference: https://www.sciencedirect.com/topics/computer-science/insider-attack

• Question 1002:

  An organization is conducting penetration testing to identify possible network vulnerabilities. The penetration tester has already identified active hosts in the network and is now scanning individual hosts to determine if any are running a web server. The output from the latest scan is shown below:

  

  Which of the following commands would have generated the output above?

  A. map V 192.168.1.13 80
  B. map P 192.168.1.0/24 ALL
  C. map V 192.168.1.1 80
  D. map P 192.168.1.13 ALL
  A. map V 192.168.1.13 80

• Question 1003:

  An organization is assessing risks so it can prioritize its mitigation actions. Following are the risks and their probability and impact:

  

  Which of the following is the order of priority for risk mitigation from highest to lowest?

  A. A, B, C, D
  B. A, D, B, C
  C. B, C, A, D
  D. C, B, D, A
  E. D, A, C, B
  B. A, D, B, C

• Question 1004:

  An audit has revealed an organization is utilizing a large number of servers that are running unsupported operating systems.

  As part of the management response phase of the audit, which of the following would BEST demonstrate senior management is appropriately aware of and addressing the issue?

  A. Copies of prior audits that did not identify the servers as an issue
  B. Project plans relating to the replacement of the servers that were approved by management
  C. Minutes from meetings in which risk assessment activities addressing the servers were discussed
  D. ACLs from perimeter firewalls showing blocked access to the servers
  E. Copies of change orders relating to the vulnerable servers
  B. Project plans relating to the replacement of the servers that were approved by management

• Question 1005:

  A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verify that a user's data is not altered without the user's consent. Which of the following would be an appropriate course of action?

  A. Automate the use of a hashing algorithm after verified users make changes to their data.
  B. Use encryption first and then hash the data at regular, defined times.
  C. Use a DLP product to monitor the data sets for unauthorized edits and changes.
  D. Replicate the data sets at regular intervals and continuously compare the copies for unauthorized changes.
  A. Automate the use of a hashing algorithm after verified users make changes to their data.

• Question 1006:

  A security analyst is probing a company's public-facing servers for vulnerabilities and obtains the following output:

  

  Which of the following changes should the analyst recommend FIRST?

  A. Implement File Transfer Protocol Secure on the upload server
  B. Disable anonymous login on the web server
  C. Configure firewall changes to close port 445 on 124.45.23.112
  D. Apply a firewall rule to filter the number of requests per second on port 80 on 124.45.23.108
  C. Configure firewall changes to close port 445 on 124.45.23.112

  ---

  Explanation/Reference:

  SMB exploitation and remote code execution can do a lot more damage to files/network compared to a DoS causing a site to be down.

• Question 1007:

  While preparing of an audit of information security controls in the environment an analyst outlines a framework control that has the following requirements:

  1. All sensitive data must be classified

  2. All sensitive data must be purged on a quarterly basis

  3. Certificates of disposal must remain on file for at least three years

  This framework control is MOST likely classified as:

  A. prescriptive
  B. risk-based
  C. preventive
  D. corrective
  C. preventive

• Question 1008:

  A vulnerability scan has returned the following information:

  

  Which of the following describes the meaning of these results?

  A. There is an unknown bug in a Lotus server with no Bugtraq ID.
  B. Connecting to the host using a null session allows enumeration of share names.
  C. Trend Micro has a known exploit that must be resolved or patched.
  D. No CVE is present, so it is a false positive caused by Lotus running on a Windows server.
  B. Connecting to the host using a null session allows enumeration of share names.

• Question 1009:

  A security analyst is investigate an no client related to an alert from the threat detection platform on a host (10.0 1.25) in a staging environment that could be running a cryptomining tool because it in sending traffic to an IP address that are related to Bitcoin.

  The network rules for the instance are the following:

  

  Which of the following is the BEST way to isolate and triage the host?

  A. Remove rules 1.2. and 3.
  B. Remove rules 1.2. 4. and 5.
  C. Remove rules 1.2. 3.4. and 5.
  D. Remove rules 1.2. and 5.
  E. Remove rules 1.4. and 5.
  F. Remove rules 4 and 5
  D. Remove rules 1.2. and 5.

• Question 1010:

  A penetration tester is preparing for an audit of critical systems that may impact the security of the environment. This includes the external perimeter and the internal perimeter of the environment. During which of the following processes is this type of information normally gathered?

  A. Timing
  B. Scoping
  C. Authorization
  D. Enumeration
  B. Scoping