CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 121:

  In order to the leverage the power of data correlation with Nessus, a cybersecurity analyst must first be able to create a table for the scan results.

  Given the following snippet of code:

  

  Which of the following output items would be correct?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

• Question 122:

  A cybersecurity analyst routinely checks logs, querying for login attempts. While querying for unsuccessful login attempts during a five-day period, the analyst produces the following report:

  

  Which of the following BEST describes what the analyst Just found?

  A. Users 4 and 5 are using their credentials to transfer files to multiple servers.
  B. Users 4 and 5 are using their credentials to run an unauthorized scheduled task targeting some servers In the cloud.
  C. An unauthorized user is using login credentials in a script.
  D. A bot is running a brute-force attack in an attempt to log in to the domain.
  D. A bot is running a brute-force attack in an attempt to log in to the domain.

• Question 123:

  A security analyst for a large pharmaceutical company was given credentials from a threat intelligence resources organisation for Internal users, which contain usernames and valid passwords for company accounts. Which of the following is the FIRST action the analyst should take as part of security operations monitoring?

  A. Run scheduled antivirus scans on all employees' machines to look for malicious processes.
  B. Reimage the machines of all users within the group in case of a malware infection.
  C. Change all the user passwords to ensure the malicious actors cannot use them.
  D. Search the event logs for event identifiers that indicate Mimikatz was used.
  C. Change all the user passwords to ensure the malicious actors cannot use them.

• Question 124:

  Which of the following BEST describes the primary role of a risk assessment as it relates to compliance with risk-based frameworks?

  A. It demonstrated the organization's mitigation of risks associated with internal threats.
  B. It serves as the basis for control selection.
  C. It prescribes technical control requirements.
  D. It is an input to the business impact assessment.
  A. It demonstrated the organization's mitigation of risks associated with internal threats.

• Question 125:

  Which of the following systems would be at the GREATEST risk of compromise if found to have an open vulnerability associated with perfect forward secrecy?

  A. Endpoints
  B. VPN concentrators
  C. Virtual hosts
  D. SIEM
  E. Layer 2 switches
  B. VPN concentrators

• Question 126:

  A company is experiencing a malware attack within its network. A security engineer notices many of the impacted assets are connecting outbound to a number of remote destinations and exfiltrating data. The security engineer also see that deployed, up-to-date antivirus signatures are ineffective. Which of the following is the BEST approach to prevent any impact to the company from similar attacks in the future?

  A. IDS signatures
  B. Data loss prevention
  C. Port security
  D. Sinkholing
  B. Data loss prevention

  ---

  Explanation/Reference:

  "Preventing data exfiltration is possible with security solutions that ensure data loss and leakage prevention. For example, firewalls can block unauthorized access to resources and systems storing sensitive information. On the other hand, a security information and event management system (SIEM) can secure data in motion, in use, and at rest, secure endpoints, and identify suspicious data transfers" https://www.fortinet.com/resources/cyberglossary/data-exfiltration

• Question 127:

  A company has received the results of an external vulnerability scan from its approved scanning vendor. The company is required to remediate these vulnerabilities for clients within 72 hours of acknowledgement of the scan results.

  Which of the following contract breaches would result if this remediation is not provided for clients within the time frame?

  A. Service level agreement
  B. Regulatory compliance
  C. Memorandum of understanding
  D. Organizational governance
  A. Service level agreement

• Question 128:

  During a review of SIEM alerts, a security analyst discovers the SIEM is receiving many alerts per day from the file-integrity monitoring tool about files from a newly deployed application that should not change. Which of the following steps should the analyst complete FIRST to respond to the issue?

  A. Warn the incident response team that the server can be compromised.
  B. Open a ticket informing the development team about the alerts.
  C. Check if temporary files are being monitored.
  D. Dismiss the alert, as the new application is still being adapted to the environment.
  C. Check if temporary files are being monitored.

• Question 129:

  A storage area network (SAN) was inadvertently powered off while power maintenance was being performed in a datacenter. None of the systems should have lost all power during the maintenance. Upon review, it is discovered that a SAN

  administrator moved a power plug when testing the SAN's fault notification features.

  Which of the following should be done to prevent this issue from reoccurring?

  A. Ensure both power supplies on the SAN are serviced by separate circuits, so that if one circuit goes down, the other remains powered.
  B. Install additional batteries in the SAN power supplies with enough capacity to keep the system powered on during maintenance operations.
  C. Ensure power configuration is covered in the datacenter change management policy and have the SAN administrator review this policy.
  D. Install a third power supply in the SAN so loss of any power intuit does not result in the SAN completely powering off.
  A. Ensure both power supplies on the SAN are serviced by separate circuits, so that if one circuit goes down, the other remains powered.

• Question 130:

  Law enforcement has notified an organization that one of its internal servers is suspected of being a command-and-control server for a malicious botnet. The organization's security analyst has been tasked with analyzing the internal server for indications of compromise. During the investigation, the analyst reviews the processes running on the server and sees the following:

  

  Which of the following processes warrants further investigation?

  A. cmd.exe
  B. iexplore
  C. nc.exe
  D. notepad.exe
  C. nc.exe