CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 261:

  A SIEM analyst receives an alert containing the following URL:

  http:/companywebsite.com/displayPicture?filenamE=../../../../etc/passwd

  Which of the following BEST describes the attack?

  A. Password spraying
  B. Buffer overflow
  C. insecure object access
  D. Directory traversal
  D. Directory traversal

• Question 262:

  Which of the following BEST explains the function of a managerial control?

  A. To help design and implement the security planning, program development, and maintenance of the security life cycle
  B. To guide the development of training, education, security awareness programs, and system maintenance
  C. To create data classification, risk assessments, security control reviews, and contingency planning
  D. To ensure tactical design, selection of technology to protect data, logical access reviews, and the implementation of audit trails
  C. To create data classification, risk assessments, security control reviews, and contingency planning

  ---

  Explanation/Reference:

  Managerial controls are procedural mechanisms that focus on the mechanics of the risk management process. Examples of administrative controls include periodic risk assessments, security planning exercises, and the incorporation of security into the organization's change management, service acquisition, and project management practices

• Question 263:

  A company's data is still being exfiltered to business competitors after the implementation of a DLP solution. Which of the following is the most likely reason why the data is still being compromised?

  A. Printed reports from the database contain sensitive information
  B. DRM must be implemented with the DLP solution
  C. Users are not labeling the appropriate data sets
  D. DLP solutions are only effective when they are implemented with disk encryption
  B. DRM must be implemented with the DLP solution

  ---

  Explanation/Reference:

  Reference: https://www.vaultize.com/blog/-enterprise-drm-and-dlp-are-amazing-together.html

• Question 264:

  Which of the following is the MOST secure method to perform dynamic analysis of malware that can sense when it is in a virtual environment?

  A. Place the malware on an isolated virtual server disconnected from the network.
  B. Place the malware in a virtual server that is running Windows and is connected to the network.
  C. Place the malware on a virtual server connected to a VLAN.
  D. Place the malware on a virtual server running SIFT and begin analysis.
  A. Place the malware on an isolated virtual server disconnected from the network.

• Question 265:

  An analyst reviews a recent report of vulnerabilities on a company's financial application server. Which of the following should the analyst rate as being of the HIGHEST importance to the company's environment?

  A. Banner grabbing
  B. Remote code execution
  C. SQL injection
  D. Use of old encryption algorithms
  E. Susceptibility to XSS
  B. Remote code execution

• Question 266:

  The Chief Information Security Officer (CISO) asked for a topology discovery to be conducted and verified against the asset inventory. The discovery is failing and not providing reliable or complete data. The syslog shows the following information:

  

  Which of the following describes the reason why the discovery is failing?

  A. The scanning tool lacks valid LDAP credentials.
  B. The scan is returning LDAP error code 52255a.
  C. The server running LDAP has antivirus deployed.
  D. The connection to the LDAP server is timing out.
  E. The LDAP server is configured on the wrong port.
  A. The scanning tool lacks valid LDAP credentials.

• Question 267:

  An organization's Cruel Information Security Officer is concerned the proper control are not in place to identify a malicious insider.

  Which of the following techniques would be BEST to identify employees who attempt to steal data or do harm to the organization?

  A. Place a text file named Passwords txt on the local file server and create a SIEM alert when the file is accessed
  B. Segment the network so workstations are segregated from servers and implement detailed logging on the jumpbox
  C. Perform a review of all users with privileged access and monitor web activity logs from the organization's pfoxy
  D. Analyze logs to determine if a user is consuming large amounts of bandwidth at odd hours ol the day
  D. Analyze logs to determine if a user is consuming large amounts of bandwidth at odd hours ol the day

• Question 268:

  During an investigation, a computer is being seized. Which of the following is the FIRST step the analyst should take?

  A. Power off the computer and remove it from the network.
  B. Unplug the network cable and take screenshots of the desktop.
  C. Perform a physical hard disk image.
  D. Initiate chain-of-custody documentation.
  A. Power off the computer and remove it from the network.

• Question 269:

  Which of the following concepts refers to the software assurance method of ensuring a program can handle the required bandwidth?

  A. Stress test
  B. Input validation
  C. Load balancing
  D. Dynamic analysis
  A. Stress test

• Question 270:

  An organization recently discovered a malware sample on an internal server. IoCs showed the malware sample was running on port 27573. The incident response team successfully removed the malware from the server, but the organization is now concerned about other instances of the malware being installed on another server. The following network traffic was captured after the known malware was assumed to be eradicated:

  32.123456 192.168.1.134 -> 192.168.1.101 TCP 58 25101 > 27573 [SYN] seq=0 Win=4096 Len=0 32.235433 192.168.1.101 -> 192.168.1.134 TCP 58 27573 > 25101 [SYN, ACK 1 seq=0 Win=4096 Len=0 32.301211 192.168.1.134 -> 192.168.1.102 TCP 58 27103 > 27573 [SYN] seq=0 Win=4096 Len=0 32.419921 192.168.1.134 -> 192.168.1.103 TCP 58 54975 > 27573 [SYN] seq=0 Win=4096 Len=0 32.501843 192.168.1.134 -> 192.168.1.104 TCP 58 60397 > 27573 [SYN] seq=0 Win=4096 Len=0 Which of the following can the organization conclude?

  A. The malware was installed on servers 192.168.1.102, 192.168.1.103, and 192.168.1.104.
  B. Only the server at 192.168.1.103 has an indication of a possible compromise.
  C. Only the server at 192.168.1.104 has an indication of a possible compromise.
  D. Both servers 192.168.1.101 and 192.168.1.134 indicate a possible compromise.
  E. The server at 192.168.1.134 is exfiltrating data in 25KB files to servers throughout the organization.
  D. Both servers 192.168.1.101 and 192.168.1.134 indicate a possible compromise.