CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 231:

  A security analyst for a large financial institution is creating a threat model for a specific threat actor that is likely targeting an organization's financial assets. Which of the following is the BEST example of the level of sophistication this threat actor is using?

  A. Social media accounts attributed to the threat actor
  B. Custom malware attributed to the threat actor from prior attacks
  C. Email addresses and phone numbers tied to the threat actor
  D. Network assets used in previous attacks attributed to the threat actor
  E. IP addresses used by the threat actor for command and control
  B. Custom malware attributed to the threat actor from prior attacks

  ---

  Explanation/Reference:

  Because you cannot create a threat model for the malware because you do not know exactly what it is, but if you know how this bad actor infiltrates and what is exploited you will be able to be on the lookout for network anomalies and the such. I would assume that they may use the same malware signatures but they'd probably go for another zero day with the same network tactic imo.. attack vectors

• Question 232:

  A security analyst is logged on to a jump server to audit the system configuration and status. The organization's policies for access to and configuration of the jump server include the following:

  No network access is allowed to the internet.

  SSH is only for management of the server.

  Users must utilize their own accounts, with no direct login as an administrator.

  Unnecessary services must be disabled.

  The analyst runs netstar with elevated permissions and receives the following output:

  

  Which of the following policies does the server violate?

  A. Unnecessary services must be disabled.
  B. SSH is only for management of the server.
  C. No network access is allowed to the internet.
  D. Users must utilize their own accounts, with no direct login as an administrator.
  C. No network access is allowed to the internet.

  ---

  Explanation/Reference:

  The server violates the policy of no network access to the internet because it has an established connection to an external IP address (216.58.194.174) on port 443, which is used for HTTPS traffic. This indicates that the server is communicating with a web server on the internet, which is not allowed by the policy. The other policies are not violated because SSH is only used for management of the server (not for accessing other devices), users are utilizing their own accounts (not logging in as an administrator), and unnecessary services are not enabled (only SSH and HTTPS are running). References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 9; https:// en.wikipedia.org/wiki/Jump_server

• Question 233:

  A security analyst who works in the SOC receives a new requirement to monitor for indicators of compromise. Which of the following is the first action the analyst should take in this situation?

  A. Develop a dashboard to track the indicators of compromise.
  B. Develop a query to search for the indicators of compromise.
  C. Develop a new signature to alert on the indicators of compromise.
  D. Develop a new signature to block the indicators of compromise.
  B. Develop a query to search for the indicators of compromise.

• Question 234:

  A security analyst received a SIEM alert regarding high levels of memory consumption for a critical system. After several attempts to remediate the issue, the system went down. A root cause analysis revealed a bad actor forced the

  application to not reclaim memory. This caused the system to be depleted of resources.

  Which of the following BEST describes this attack?

  A. Injection attack
  B. Memory corruption
  C. Denial of service
  D. Array attack
  C. Denial of service

  ---

  Explanation/Reference:

  Reference: https://economictimes.indiatimes.com/definition/memory-corruption

• Question 235:

  A corporation employs a number of small-form-factor workstations and mobile devices, and an incident response team is therefore required to build a forensics kit with tools to support chip-off analysis. Which of the following tools would BEST meet this requirement?

  A. JTAG adapters
  B. Last-level cache readers
  C. Write-blockers
  D. ZIF adapters
  A. JTAG adapters

• Question 236:

  Due to continued support of legacy applications, an organization's enterprise password complexity rules are inadequate for its required security posture. Which of the following is the BEST compensating control to help reduce authentication compromises?

  A. Smart cards
  B. Multifactor authentication
  C. Biometrics
  D. Increased password-rotation frequency
  B. Multifactor authentication

• Question 237:

  A company's Chief Information Officer wants to use a CASB solution to ensure policies are being met during cloud access. Due to the nature of the company's business and risk appetite, the management team elected to not store financial information in the cloud. A security analyst needs to recommend a solution to mitigate the threat of financial data leakage into the cloud. Which of the following should the analyst recommend?

  A. Utilize the CASB to enforce DLP data-at-rest protection for financial information that is stored on premises.
  B. Do not utilize the CASB solution for this purpose, but add DLP on premises for data in motion.
  C. Utilize the CASB to enforce DLP data-in-motion protection for financial information moving to the cloud.
  D. Do not utilize the CASB solution for this purpose, but add DLP on premises for data at rest.
  C. Utilize the CASB to enforce DLP data-in-motion protection for financial information moving to the cloud.

  ---

  Explanation/Reference:

  "CASB solutions generally offer their own DLP policy engine, allowing you to configure DLP policies in a CASB and apply them to cloud services."

  https://www.mcafee.com/blogs/enterprise/cloud-security/how-a-casb-integrates-with-an-on- premises-dlp- solution/

• Question 238:

  An alert is issued from the SIEM that indicates a large number of failed logins for the same account name on one of the application servers starting at 10:20 a.m. No other significant failed login activity is detected. Using Splunk to search for activity pertaining to that account name, a security analyst finds the account has been authenticating successfully for some time and started to fail this morning. The account is attempting to authenticate from an internal server that is running a database to an application server. No other security activity is detected on the network. The analyst discovers the account owner is a developer who no longer works for the company. Which of the following is the MOST likely reason for the failed login attempts for that account?

  A. The account that is failing to authenticate has not been maintained, and the company password change policy time frame has been reached for that account
  B. The host-based firewall is blocking port 389 LDAP communication, preventing the login credentials from being received by the application server
  C. The license for the application has expired, and the failed logins will continue to occur until a new license key is installed on the application
  D. A successful malware attack has provided someone access to the network, and failed login attempts are an indication of an attempt to privilege access to the application
  A. The account that is failing to authenticate has not been maintained, and the company password change policy time frame has been reached for that account

• Question 239:

  Which of the following BEST describes how logging and monitonng work when entering into a public cloud relationship with a service provider?

  A. Logging and monitonng are not needed in a public cloud environment
  B. Logging and monitonng are done by the data owners
  C. Logging and monitonng duties are specified in the SLA and contract
  D. Logging and monitonng are done by the service provider
  C. Logging and monitonng duties are specified in the SLA and contract

• Question 240:

  A security analyst is generating a list of recommendations for the company's insecure API.

  Which of the following is the BEST parameter mitigation...?

  A. Implement parameterized queries.
  B. Use effective authentication and authorization methods.
  C. Validate all incoming data.
  D. Use TLs for all data exchanges.
  D. Use TLs for all data exchanges.