CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 171:

  Which of the following secure coding techniques can be used to prevent cross-site request forgery attacks?

  A. Input validation
  B. Output encoding
  C. Parameterized queries
  D. Tokenization
  D. Tokenization

• Question 172:

  Portions of a legacy application are being refactored to discontinue the use of dynamic SQL. Which of the following would be BEST to implement in the legacy application?

  A. Input validation
  B. SQL injection
  C. Parameterized queries
  D. Web-application firewall
  E. Multifactor authentication
  C. Parameterized queries

• Question 173:

  An organization is upgrading its network and all of its workstations. The project will occur in phases, with infrastructure upgrades each month and workstation installs every other week. The schedule should accommodate the enterprise-wide changes, while minimizing the impact to the network.

  Which of the following schedules BEST addresses these requirements?

  A. Monthly vulnerability scans, biweekly topology scans, daily host discovery scans
  B. Monthly topology scans, biweekly host discovery scans, monthly vulnerability scans
  C. Monthly host discovery scans, biweekly vulnerability scans, monthly topology scans
  D. Monthly topology scans, biweekly host discovery scans, weekly vulnerability scans
  B. Monthly topology scans, biweekly host discovery scans, monthly vulnerability scans

• Question 174:

  To validate local system-hardening requirements, which of the following types of vulnerability scans would work BEST to verify the scanned device meets security policies?

  A. SCAP
  B. SAST
  C. DAST
  D. DACS
  A. SCAP

  ---

  Explanation/Reference:

  Reference: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/scanning-the-system-for-configuration-compliance-and-vulnerabilities_security-hardening

• Question 175:

  During routine monitoring a security analyst identified the following enterpnse network traffic:

  Packet capture output:

  

  Which of the following BEST describes what the security analyst observed?

  A. 66.187.224.210 set up a DNS hijack with 192.168.12.21.
  B. 192.168.12.21 made a TCP connection to 66 187 224 210
  C. 192.168.12.21 made a TCP connection to 209 132 177 50
  D. 209.132.177.50 set up a TCP reset attack to 192 168 12 21
  C. 192.168.12.21 made a TCP connection to 209 132 177 50

• Question 176:

  A security analyst at a small regional bank has received an alert that nation states are attempting to infiltrate financial institutions via phishing campaigns. Which of the following techniques should the analyst recommend as a proactive measure to defend against this type of threat?

  A. Honeypot
  B. Location-based NAC
  C. System isolation
  D. Mandatory access control
  E. Bastion host
  B. Location-based NAC

• Question 177:

  A security analyst has been asked to remediate a server vulnerability. Once the analyst has located a patch for the vulnerability, which of the following should happen NEXT?

  A. Start the change control process.
  B. Rescan to ensure the vulnerability still exists.
  C. Implement continuous monitoring.
  D. Begin the incident response process.
  A. Start the change control process.

• Question 178:

  A company is developing its first mobile application, which will be distributed via the official application stores of the two major mobile platforms.

  Which of the following is a prerequisite to making the applications available in the application stores?

  A. Distribute user certificates.
  B. Deploy machine/computer certificates.
  C. Obtain a code-signing certificate.
  D. Implement a CRL.
  B. Deploy machine/computer certificates.

• Question 179:

  During the threal modeling process for a new application that a company is launching, a security analyst needs to define methods and items to take into consideralion. Whitch of the following are part of a known threat modeling method?

  A. Threat profile, infrastructure and application vulnerabilities, security strategy and plans
  B. Purpose, objective, scope, (earn management, cost, roles and responsibilities
  C. Spoofing tampering, repudiation, information disclosure, denial of service elevation of privilege
  D. Human impact, adversary's motivation, adversary's resources, adversary's methods
  C. Spoofing tampering, repudiation, information disclosure, denial of service elevation of privilege

• Question 180:

  A company has contracted with a software development vendor to design a web portal for customers to access a medical records database. Which of the following should the security analyst recommend to BEST control the unauthorized disclosure of sensitive data when sharing the development database with the vendor?

  A. Establish an NDA with the vendor.
  B. Enable data masking of sensitive data tables in the database.
  C. Set all database tables to read only.
  D. Use a de-identified data process for the development database.
  B. Enable data masking of sensitive data tables in the database.