CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 1041:

  A Chief Information Security Officer (CISO) wants to upgrade an organization's security posture by improving proactive activities associated with attacks from internal and external threats.

  Which of the following is the MOST proactive tool or technique that feeds incident response capabilities?

  A. Development of a hypothesis as part of threat hunting
  B. Log correlation, monitoring, and automated reporting through a SIEM platform
  C. Continuous compliance monitoring using SCAP dashboards
  D. Quarterly vulnerability scanning using credentialed scans
  A. Development of a hypothesis as part of threat hunting

• Question 1042:

  A cybersecurity analyst needs to rearchitect the network using a firewall and a VPN server to achieve the highest level of security To BEST complete this task, the analyst should place the:

  A. firewall behind the VPN server
  B. VPN server parallel to the firewall
  C. VPN server behind the firewall
  D. VPN on the firewall
  C. VPN server behind the firewall

• Question 1043:

  A software developer is correcting the error-handling capabilities of an application following the initial coding of the fix. Which of the following would the software developer MOST likely performed to validate the code poor to pushing it to production?

  A. Web-application vulnerability scan
  B. Static analysis
  C. Packet inspection
  D. Penetration test
  B. Static analysis

• Question 1044:

  A security analyst receives an alert to expect increased and highly advanced cyberattacks originating from a foreign country that recently had sanctions implemented. Which of the following describes the type of threat actors that should concern the security analyst?

  A. Insider threat
  B. Nation-state
  C. Hacktivist
  D. Organized crime
  B. Nation-state

• Question 1045:

  Which of the following attack techniques has the GREATEST likelihood of quick success against Modbus assets?

  A. Remote code execution
  B. Buffer overflow
  C. Unauthenticated commands
  D. Certificate spoofing
  C. Unauthenticated commands

• Question 1046:

  A malicious hacker wants to gather guest credentials on a hotel 802.11 network. Which of the following tools is the malicious hacker going to use to gain access to information found on the hotel network?

  A. Nikto
  B. Aircrak-ng
  C. Nessus
  D. tcpdump
  B. Aircrak-ng

• Question 1047:

  A cybersecurity analyst is retained by a firm for an open investigation. Upon arrival, the cybersecurity analyst reviews several security logs.

  Given the following snippet of code:

  

  Which of the following combinations BEST describes the situation and recommendations to be made for this situation?

  A. The cybersecurity analyst has discovered host 192.168.0.101 using Windows Task Scheduler at 13:30 to runnc.exe; recommend proceeding with the next step of removing the host from the network.
  B. The cybersecurity analyst has discovered host 192.168.0.101 to be running thenc.exe file at 13:30 using the auto cron job remotely, there are no recommendations since this is not a threat currently.
  C. The cybersecurity analyst has discovered host 192.168.0.101 is beaconing every day at 13:30 using thenc.exe file; recommend proceeding with the next step of removing the host from the network.
  D. The security analyst has discovered host 192.168.0.101 is a rogue device on the network, recommend proceeding with the next step of removing the host from the network.
  A. The cybersecurity analyst has discovered host 192.168.0.101 using Windows Task Scheduler at 13:30 to runnc.exe; recommend proceeding with the next step of removing the host from the network.

• Question 1048:

  A cybersecurity professional typed in a URL and discovered the admin panel for the e-commerce application is accessible over the open web with the default password. Which of the following is the MOST secure solution to remediate this vulnerability?

  A. Rename the URL to a more obscure name, whitelist all corporate IP blocks, and require two-factor authentication.
  B. Change the default password, whitelist specific source IP addresses, and require two-factor authentication.
  C. Whitelist all corporate IP blocks, require an alphanumeric passphrase for the default password, and require two-factor authentication.
  D. Change the username and default password, whitelist specific source IP addresses, and require two-factor authentication.
  D. Change the username and default password, whitelist specific source IP addresses, and require two-factor authentication.

• Question 1049:

  An analyst was testing the latest version of an internally developed CRM system. The analyst created a basic user account. Using a few tools in Kali's latest distribution, the analyst was able to access configuration files, change permissions on folders and groups, and delete and create new system objects. Which of the following techniques did the analyst use to perform these unauthorized activities?

  A. Impersonation
  B. Privilege escalation
  C. Directory traversal
  D. Input injection
  C. Directory traversal

• Question 1050:

  A security analyst is conducting traffic analysis and observes an HTTP POST to the company's main web server. The POST header is approximately 1000 bytes in length. During transmission, one byte is delivered every ten seconds. Which of the following attacks is the traffic indicative of?

  A. Exfiltration
  B. DoS
  C. Buffer overflow
  D. SQL injection
  A. Exfiltration