CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 11:

  There have been several exploits to critical devices within the network. However, there is currently no process to perform vulnerability analysis.

  Which of the following should the security analyst implement during production hours to identify critical threats and vulnerabilities?

  A. Asset inventory of all critical devices
  B. Vulnerability scanning frequency that does not interrupt workflow
  C. Daily automated reports of exploited devices
  D. Scanning of all types of data regardless of sensitivity levels
  B. Vulnerability scanning frequency that does not interrupt workflow

• Question 12:

  Which of the following tools should a cybersecurity analyst use to verify the integrity of a forensic image before and after an investigation?

  A. strings
  B. sha1sum
  C. file
  D. dd
  E. gzip
  B. sha1sum

• Question 13:

  SIMULATION

  Part2: AppServ1

  You are a cybersecurity analyst tasked with interpreting scan data from Company A's servers. You must verify the requirements are being met for all of the servers and recommend changes if you find they are not.

  The company's hardening guidelines indicate the following:

  1. TLS 1.2 is the only version of TLS running.

  2. Apache 2.4.18 or greater should be used.

  3. Only default ports should be used.

  INSTRUCTIONS

  Using the supplied data, record the status of compliance with the company's guidelines for each server. The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for issues based ONLY on the hardening guidelines provided.

  Hot Area:

  

  

  ---

  Explanation/Reference:

  AppServ1 - Nothing to do here

• Question 14:

  A Chief Security Officer (CSO) is working on the communication requirements (or an organization's incident response plan. In addition to technical response activities, which of the following is the main reason why communication must be addressed in an effective incident response program?

  A. Public relations must receive information promptly in order to notify the community.
  B. Improper communications can create unnecessary complexity and delay response actions.
  C. Organizational personnel must only interact with trusted members of the law enforcement community.
  D. Senior leadership should act as the only voice for the incident response team when working with forensics teams.
  B. Improper communications can create unnecessary complexity and delay response actions.

• Question 15:

  Scan results identify critical Apache vulnerabilities on a company's web servers. A security analyst believes many of these results are false positives because the web environment mostly consists of Windows servers.

  Which of the following is the BEST method of verifying the scan results?

  A. Run a service discovery scan on the identified servers.
  B. Refer to the identified servers in the asset inventory.
  C. Perform a top-ports scan against the identified servers.
  D. Review logs of each host in the SIEM.
  A. Run a service discovery scan on the identified servers.

• Question 16:

  Which of the following could be directly impacted by an unpatched vulnerability in vSphere ESXi?

  A. The organization's physical routers
  B. The organization's mobile devices
  C. The organization's virtual infrastructure
  D. The organization's VPN
  C. The organization's virtual infrastructure

• Question 17:

  A security administrator needs to provide access from partners to an Isolated laboratory network inside an organization that meets the following requirements:

  The partners' PCs must not connect directly to the laboratory network. The tools the partners need to access while on the laboratory network must be available to all partners The partners must be able to run analyses on the laboratory network, which may take hours to complete

  Which of the following capabilities will MOST likely meet the security objectives of the request?

  A. Deployment of a jump box to allow access to the laboratory network and use of VDI in persistent mode to provide the necessary tools for analysis
  B. Deployment of a firewall to allow access to the laboratory network and use of VDI in non-persistent mode to provide the necessary tools tor analysis
  C. Deployment of a firewall to allow access to the laboratory network and use of VDI In persistent mode to provide the necessary tools for analysis
  D. Deployment of a jump box to allow access to the Laboratory network and use of VDI in non-persistent mode to provide the necessary tools for analysis
  A. Deployment of a jump box to allow access to the laboratory network and use of VDI in persistent mode to provide the necessary tools for analysis

• Question 18:

  A security administrator needs to create an IDS rule to alert on FTP login attempts by root. Which of the following rules is the BEST solution?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B

• Question 19:

  A cyber-incident response team is responding to a network intrusion incident on a hospital network. Which of the following must the team prepare to allow the data to be used in court as evidence?

  A. Computer forensics form
  B. HIPAA response form
  C. Chain of custody form
  D. Incident form
  B. HIPAA response form

• Question 20:

  A security analyst is performing a stealth black-box audit of the local WiFi network and is running a wireless sniffer to capture local WiFi network traffic from a specific wireless access point. The SSID is not appearing in the sniffing logs of the local wireless network traffic. Which of the following is the best action that should be performed NEXT to determine the SSID?

  A. Set up a fake wireless access point
  B. Power down the wireless access point
  C. Deauthorize users of that access point
  D. Spoof the MAC addresses of adjacent access points
  A. Set up a fake wireless access point