CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 291:

  An HR employee began having issues with a device becoming unresponsive after attempting to open an email attachment. When informed, the security analyst became suspicious of the situation, even though there was not any unusual behavior on the IDS or any alerts from the antivirus software. Which of the following BEST describes the type of threat in this situation?

  A. Packet of death
  B. Zero-day malware
  C. PII exfiltration
  D. Known virus
  B. Zero-day malware

• Question 292:

  A security analyst is reviewing packet captures from a system that was compromised. The system was already isolated from the network, but it did have network access for a few hours after being compromised. When viewing the capture in a packet analyzer, the analyst sees the following:

  

  Which of the following can the analyst conclude?

  A. Malware is attempting to beacon to 128.50.100.3.
  B. The system is running a DoS attack against ajgidwle.com.
  C. The system is scanning ajgidwle.com for PII.
  D. Data is being exfiltrated over DNS.
  D. Data is being exfiltrated over DNS.

• Question 293:

  SIMULATION

  Part2: AppServ2

  You are a cybersecurity analyst tasked with interpreting scan data from Company A's servers. You must verify the requirements are being met for all of the servers and recommend changes if you find they are not. The company's hardening guidelines indicate the following:

  1. TLS 1.2 is the only version of TLS running.

  2. Apache 2.4.18 or greater should be used.

  3. Only default ports should be used.

  INSTRUCTIONS

  Using the supplied data, record the status of compliance with the company's guidelines for each server. The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for issues based ONLY on the hardening guidelines provided.

  Hot Area:

  

  

  ---

  Explanation/Reference:

  AppServ2 - HTTPD Security - Restrict to TLS 1.2 and upgrade Apache version (Disable TLS 1.0 and TLS 1.1. if offered in test)

• Question 294:

  Which of the following is the use of tools to simulate the ability for an attacker to gain access to a specified network?

  A. Reverse engineering
  B. Fuzzing
  C. Penetration testing
  D. Network mapping
  C. Penetration testing

• Question 295:

  Which of the following is the BEST way to gather patch information on a specific server?

  A. Event Viewer
  B. Custom script
  C. SCAP software
  D. CI/CD
  C. SCAP software

  ---

  Explanation/Reference:

  Reference: https://www.open-scap.org/features/standards

• Question 296:

  A logistics company's vulnerability scan identifies the following vulnerabilities on Internet-facing devices in the DMZ: SQL injection on an infrequently used web server that provides files to vendors SSL/TLS not used for a website that contains promotional information The scan also shows the following vulnerabilities on internal resources: Microsoft Office Remote Code Execution on test server for a human resources system TLS downgrade vulnerability on a server in a development network

  In order of risk, which of the following should be patched FIRST?

  A. Microsoft Office Remote Code Execution
  B. SQL injection
  C. SSL/TLS not used
  D. TLS downgrade
  A. Microsoft Office Remote Code Execution

• Question 297:

  Which of the following can detect vulnerable third-party libraries before code deployment?

  A. Impact analysis
  B. Dynamic analysis
  C. Static analysis
  D. Protocol analysis
  C. Static analysis

• Question 298:

  A security analyst needs to develop a brief that will include the latest incidents and the attack phases of the incidents. The goal is to support threat intelligence and identify whether or not the incidents are linked. Which of the following methods would be MOST appropriate to use?

  A. An adversary capability model
  B. The MITRE ATTandCK framework
  C. The Cyber Kill Chain
  D. The Diamond Model of Intrusion Analysis
  C. The Cyber Kill Chain

• Question 299:

  During a review of vulnerability scan results, an analyst determines the results may be flawed because a control-baseline system, which is used to evaluate a scanning tool's effectiveness, was reported as not vulnerable. Consequently, the analyst verifies the scope of the scan included the control-baseline host, which was available on the network during the scan. The use of a control-baseline endpoint in this scenario assists the analyst in confirming:

  A. verification of mitigation.
  B. false positives.
  C. false negatives.
  D. the criticality index.
  E. hardening validation.
  C. false negatives.

  ---

  Explanation/Reference:

  https://www.examtopics.com/discussions/comptia/view/53829-exam-cs0-002-topic-1-question-145-discussion/

• Question 300:

  During an investigation, a security analyst determines suspicious activity occurred during the night shift over the weekend. Further investigation reveals the activity was initiated from an internal IP going to an external website.

  Which of the following would be the MOST appropriate recommendation to prevent the activity from happening in the future?

  A. An IPS signature modification for the specific IP addresses
  B. An IDS signature modification for the specific IP addresses
  C. A firewall rule that will block port 80 traffic
  D. Implement a web proxy to restrict malicious web content
  A. An IPS signature modification for the specific IP addresses