CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 1011:

  A threat intelligence feed has posted an alert stating there is a critical vulnerability in the kernel. Unfortunately, the company's asset inventory is not current. Which of the following techniques would a cybersecurity analyst perform to find all affected servers within an organization?

  A. A manual log review from data sent to syslog
  B. An OS fingerprinting scan across all hosts
  C. A packet capture of data traversing the server network
  D. A service discovery scan on the network
  B. An OS fingerprinting scan across all hosts

• Question 1012:

  A Chief Executive Officer (CEO) is concerned about the company's intellectual property being leaked to competitors. The security team performed an extensive review but did not find any indication of an outside breach. The data sets are currently encrypted using the Triple Data Encryption Algorithm. Which of the following courses of action is appropriate?

  A. Limit all access to the sensitive data based on geographic access requirements with strict role-based access controls.
  B. Enable data masking and reencrypt the data sets using AES-256.
  C. Ensure the data is correctly classified and labeled, and that DLP rules are appropriate to prevent disclosure.
  D. Use data tokenization on sensitive fields, reencrypt the data sets using AES-256, and then create an MD5 hash.
  C. Ensure the data is correctly classified and labeled, and that DLP rules are appropriate to prevent disclosure.

• Question 1013:

  An organization has the following risk mitigation policies

  Risks without compensating controls will be mitigated first if the risk value is greater than $50,000.

  Other risk mitigation will be prioritized based on risk value.

  The following risks have been identified:

  

  Which of the following is the order of priority for risk mitigation from highest to lowest?

  A. A, C, D, B
  B. B, C, D, A
  C. C, B, A, D
  D. C. D, A, B
  E. D, C, B, A
  C. C, B, A, D

• Question 1014:

  The human resources division is moving all of its applications to an IaaS cloud. The Chief Information Officer (CIO) has asked the security architect to design the environment securely to prevent the IaaS provider from accessing its data-atrest and data-in-transit within the infrastructure. Which of the following security controls should the security architect recommend?

  A. Implement a non-data breach agreement
  B. Ensure all backups are remote outside the control of the IaaS provider
  C. Ensure all of the IaaS provider's workforce passes stringent background checks
  D. Render data unreadable through the use of appropriate tools and techniques
  D. Render data unreadable through the use of appropriate tools and techniques

• Question 1015:

  A Chief Information Security Officer (CISO) is concerned developers have too much visibility into customer data Which of the following controls should be implemented to BEST address these concerns?

  A. Data masking
  B. Data loss prevention
  C. Data minimization
  D. Data sovereignty
  A. Data masking

• Question 1016:

  A security administrator determines several months after the first instance that a local privileged user has been routinely logging into a server interactively as "root" and browsing the Internet. The administrator determines this by performing an annual review of the security logs on that server. For which of the following security architecture areas should the administrator recommend review and modification? (Select TWO).

  A. Log aggregation and analysis
  B. Software assurance
  C. Encryption
  D. Acceptable use policies
  E. Password complexity
  F. Network isolation and separation
  A. Log aggregation and analysis
  D. Acceptable use policies

• Question 1017:

  A cybersecurity analyst has access to several threat feeds and wants to organize them while simultaneously comparing intelligence against network traffic. Which of the following would BEST accomplish this goal?

  A. Continuous integration and deployment
  B. Automation and orchestration
  C. Static and dynamic analysis
  D. Information sharing and analysis
  B. Automation and orchestration

• Question 1018:

  An organization announces that all employees will need to work remotely for an extended period of time. All employees will be provided with a laptop and supported hardware to facilitate this requirement. The organization asks the information security division to reduce the risk during this time. Which of the following is a technical control that will reduce the risk of data loss if a laptop is lost or stolen?

  A. Requiring the use of the corporate VPN
  B. Requiring the screen to be locked after five minutes of inactivity
  C. Requiring the laptop to be locked in a cabinet when not in use
  D. Requiring full disk encryption
  D. Requiring full disk encryption

  ---

  Explanation/Reference:

  Full disk encryption (FDE) is a technical control that encrypts all the data on a disk drive, including the operating system and applications. FDE prevents unauthorized access to the data if the disk drive is lost or stolen, as it requires a password or key to decrypt the data. FDE can be implemented using software or hardware solutions and can protect data at rest on laptops and other devices. The other options are not technical controls or do not reduce the risk of data loss if a laptop is lost or stolen. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 10; https://docs.microsoft.com/en-us/windows/security/information- protection/bitlocker/bitlocker-overview

• Question 1019:

  A security team is struggling with alert fatigue, and the Chief Information Security Officer has decided to purchase a SOAR platform to alleviate this issue. Which of the following BEST describes how a SOAR platform will help the security team?

  A. SOAR will integrate threat intelligence into the alerts, which will help the security team decide which events should be investigated first.
  B. A SOAR platform connects the SOC with the asset database, enabling the security team to make informed decisions immediately based on asset criticality.
  C. The security team will be able to use the SOAR framework to integrate the SIEM with a TAXII server, which has an automated intelligence feed that will enhance the alert data.
  D. Logic can now be created that will allow the SOAR platform to block specific traffic at the firewall according to predefined event triggers and actions.
  A. SOAR will integrate threat intelligence into the alerts, which will help the security team decide which events should be investigated first.

• Question 1020:

  Which of the following are considered PII by themselves? (Choose two.)

  A. Government ID
  B. Job title
  C. Employment start date
  D. Birth certificate
  E. Credit card
  F. Mother's maiden name
  A. Government ID
  D. Birth certificate