CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 251:

  A user receives a potentially malicious email that contains spelling errors and a PDF document. A security analyst reviews the email and decides to download the attachment to a Linux sandbox for review. Which of the following commands would MOST likely indicate if the email is malicious?

  A. sha256sum ~/Desktop/file.pdf
  B. file ~/Desktop/file.pdf
  C. strings ~/Desktop/file.pdf | grep "
  D. cat < ~/Desktop/file.pdf | grep -i .exe
  C. strings ~/Desktop/file.pdf | grep "

  ---

  Explanation/Reference:

  C - - strings ~/Desktop/file.pdf | grep "

  The strings command is used to extract the human-readable strings from a binary file, such as a PDF document. By piping the output of the strings command to the grep command with the -i flag, the security analyst can search for specific keywords or phrases that are commonly used in malicious PDF documents, such as "malware" or "Trojan." This will allow the analyst to quickly identify potential indicators of malicious activity in the PDF document.

• Question 252:

  Which of the following policies would slate an employee should not disable security safeguards, such as host firewalls and antivirus on company systems?

  A. Code of conduct policy
  B. Account management policy
  C. Password policy
  D. Acceptable use policy
  D. Acceptable use policy

• Question 253:

  The SFTP server logs show thousands of failed login attempts from hundreds of IP addresses worldwide. Which of the following controls would BEST protect the service?

  A. Whitelisting authorized IP addresses
  B. Blacklisting unauthorized IP addresses
  C. Enforcing more complex password requirements
  D. Establishing a sinkhole service
  A. Whitelisting authorized IP addresses

• Question 254:

  A computer hardware manufacturer developing a new SoC that will be used by mobile devices. The SoC should not allow users or the process to downgrade from a newer firmware to an older one. Which of the following can the hardware manufacturer implement to prevent firmware downgrades?

  A. Encryption
  B. eFuse
  C. Secure Enclave
  D. Trusted execution
  C. Secure Enclave

• Question 255:

  As part of a merger with another organization, a Chief Information Security Officer (CISO) is working with an assessor to perform a risk assessment focused on data privacy compliance. The CISO is primarily concerned with the potential legal liability and fines associated with data privacy. Based on the CISO's concerns, the assessor will MOST likely focus on:

  A. qualitative probabilities.
  B. quantitative probabilities.
  C. qualitative magnitude.
  D. quantitative magnitude.
  D. quantitative magnitude.

• Question 256:

  HOTSPOT

  Approximately 100 employees at your company have received a phishing email. As a security analyst you have been tasked with handling this situation.

  INSTRUCTIONS

  Review the information provided and determine the following:

  1. How many employees clicked on the link in the phishing email?

  2. On how many workstations was the malware installed?

  3. What is the executable file name or the malware?

  

  

  

  

  

  Hot Area:

  

  

  ---

  Explanation/Reference:How many users clicked the link in the fishing email? 7

  How many workstations were infected? 4

  Select the malware excecutable name. Isass.exe

• Question 257:

  An organization is focused on restructuring its data governance programs and an analyst has been Tasked with surveying sensitive data within the organization. Which of the following is the MOST accurate method for the security analyst to complete this assignment?

  A. Perform an enterprise-wide discovery scan.
  B. Consult with an internal data custodian.
  C. Review enterprise-wide asset Inventory.
  D. Create a survey and distribute it to data owners.
  D. Create a survey and distribute it to data owners.

• Question 258:

  A manufacturing company has joined the information sharing and analysis center for its sector. As a benefit, the company will receive structured IoC data contributed by other members. Which of the following best describes the utility of this data?

  A. Other members will have visibility into instances of positive IoC identification within the manufacturing company's corporate network.
  B. The manufacturing company will have access to relevant malware samples from all other manufacturing sector members.
  C. Other members will automatically adjust their security postures to defend the manufacturing company's processes.
  D. The manufacturing company can ingest the data and use tools to autogenerate security configurations for all of its infrastructure.
  B. The manufacturing company will have access to relevant malware samples from all other manufacturing sector members.

• Question 259:

  A large insurance company wants to outsource its claim-handling operations to an overseas third-party organization Which of the following would BEST help to reduce the chance of highly sensitive data leaking?

  A. Configure a VPN between the third party organization and the internal company network
  B. Set up a VDI that the third party must use to interact with company systems.
  C. Use MFA to protect confidential company information from being leaked.
  D. Implement NAC to ensure connecting systems have malware protection
  E. Create jump boxes that are used by the third-party organization so it does not connect directly.
  D. Implement NAC to ensure connecting systems have malware protection

• Question 260:

  A risk assessment concludes that the perimeter network has the highest potential for compromise by an attacker, and it is labeled as a critical risk environment. Which of the following is a valid compensating control to reduce the volume of valuable information in the perimeter network that an attacker could gain using active reconnaissance techniques?

  A. A control that demonstrates that all systems authenticate using the approved authentication method
  B. A control that demonstrates that access to a system is only allowed by using SSH
  C. A control that demonstrates that firewall rules are peer reviewed for accuracy and approved before deployment
  D. A control that demonstrates that the network security policy is reviewed and updated yearly
  C. A control that demonstrates that firewall rules are peer reviewed for accuracy and approved before deployment

  ---

  Explanation/Reference:

  A valid compensating control to reduce the volume of valuable information in the perimeter network that an attacker could gain using active reconnaissance techniques is a control that demonstrates that firewall rules are peer reviewed for accuracy and approved before deployment. This control can help ensure that the firewall rules are configured correctly and securely, and that they do not allow unnecessary or unauthorized access to the perimeter network. The other options are not compensating controls or do not address the risk of active reconnaissance. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 14; https://www.isaca.org/resources/ isaca-journal/ issues/2016/volume-3/compensating- controls