CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 1051:

  A security analyst found an old version of OpenSSH running on a DMZ server and determined the following piece of code could have led to a command execution through an integer overflow;

  

  Which of the following controls must be in place to prevent this vulnerability?

  A. Convert all integer numbers in strings to handle the memory buffer correctly.
  B. Implement float numbers instead of integers to prevent integer overflows.
  C. Use built-in functions from libraries to check and handle long numbers properly.
  D. Sanitize user inputs, avoiding small numbers that cannot be handled in the memory.
  C. Use built-in functions from libraries to check and handle long numbers properly.

• Question 1052:

  The SOC has received reports of slowness across all workstation network segments. The currently installed antivirus has not detected anything, but a different anti-malware product was just downloaded and has revealed a worm is spreading

  Which of the following should be the NEXT step in this incident response?

  A. Enable an ACL on all VLANs to contain each segment
  B. Compile a list of loCs so the IPS can be updated to halt the spread.
  C. Send a sample of the malware to the antivirus vendor and request urgent signature creation.
  D. Begin deploying the new anti-malware on all uninfected systems.
  D. Begin deploying the new anti-malware on all uninfected systems.

• Question 1053:

  After a breach involving the exfiltration of a large amount of sensitive data a security analyst is reviewing the following firewall logs to determine how the breach occurred:

  

  Which of the following IP addresses does the analyst need to investigate further?

  A. 192.168.1.1
  B. 192.168.1.10
  C. 192.168.1.12
  D. 192.168.1.193
  C. 192.168.1.12

• Question 1054:

  Which of the following BEST describes the process by which code is developed, tested, and deployed in small batches?

  A. Agile
  B. Waterfall
  C. SDLC
  D. Dynamic code analysis
  A. Agile

  ---

  Explanation/Reference:

  Reference: https://www.cleverism.com/software-development-life-cycle-sdlc-methodologies/

• Question 1055:

  A large amount of confidential data was leaked during a recent security breach. As part of a forensic investigation, the security team needs to identify the various types of traffic that were captured between two compromised devices. Which of the following should be used to identify the traffic?

  A. Carving
  B. Disk imaging
  C. Packet analysis
  D. Memory dump
  E. Hashing
  C. Packet analysis

• Question 1056:

  An analyst has been asked to provide feedback regarding the control required by a revised regulatory framework At this time, the analyst only needs to focus on the technical controls. Which of the following should the analyst provide an assessment of?

  A. Tokenization of sensitive data
  B. Establishment o' data classifications
  C. Reporting on data retention and purging activities
  D. Formal identification of data ownership
  E. Execution of NDAs
  A. Tokenization of sensitive data

• Question 1057:

  Which of the following APT adversary archetypes represent non-nation-state threat actors? (Select TWO)

  A. Kitten
  B. Panda
  C. Tiger
  D. Jackal
  E. Bear
  F. Spider
  D. Jackal
  F. Spider

• Question 1058:

  A security manager has asked an analyst to provide feedback on the results of a penetration lest. After reviewing the results the manager requests information regarding the possible exploitation of vulnerabilities Much of the following information data points would be MOST useful for the analyst to provide to the security manager who would then communicate the risk factors to senior management? (Select TWO)

  A. Probability
  B. Adversary capability
  C. Attack vector
  D. Impact
  E. Classification
  F. Indicators of compromise
  A. Probability
  D. Impact

• Question 1059:

  During an Incident, it Is determined that a customer database containing email addresses, first names, and last names was exfiltrated. Which ot the following should the security analyst do NEXT?

  A. Consult with the legal department for regulatory impact.
  B. Encrypt the database with available tools.
  C. Email the customers to inform them of the breach.
  D. Follow the incident communications process.
  D. Follow the incident communications process.