CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 301:

  Because some clients have reported unauthorized activity on their accounts, a security analyst is reviewing network packet captures from the company's API server. A portion of a capture file is shown below:

  POST /services/v1_0/Public/Members.svc/soap

  s:Envelope> 192.168.1.22 - - api.somesite.com 200 0 1006 1001 0 192.168.1.22

  POST /services/v1_0/Public/Members.svc/soap <Password123

  a:Password>

  +i:nil="true"/ >[email protected]

  s:Body> 192.168.5.66 - - api.somesite.com 200 0 11558 1712 2024 192.168.4.89

  POST /services/v1_0/Public/Members.svc/soap 516.7.446.605

  a:IPAddress> 192.168.1.22

  - - api.somesite.com 200 0 1003 1011 307 192.168.1.22

  POST /services/v1_0/Public/Members.svc/soap

  kmL4krg2CwwWBan5BReGv5Djb7syxXTNKcWFuSjd

  a:ApiToken>0161222

  4''1=113026046

  a:Authentication> 192.168.5.66 - - api.somesite.com 200 0 1378 1209 48 192.168.4.89

  Which of the following MOST likely explains how the clients' accounts were compromised?

  A. The clients' authentication tokens were impersonated and replayed.
  B. The clients' usernames and passwords were transmitted in cleartext.
  C. An XSS scripting attack was carried out on the server.
  D. A SQL injection attack was carried out on the server.
  B. The clients' usernames and passwords were transmitted in cleartext.

• Question 302:

  Which of the following solutions is the BEST method to prevent unauthorized use of an API?

  A. HTTPS
  B. Geofencing
  C. Rate liming
  D. Authentication
  D. Authentication

• Question 303:

  A development team uses open-source software and follows an Agile methodology with two-week sprints. Last month, the security team filed a bug for an insecure version of a common library. The DevOps team updated the library on the server, and then the security team rescanned the server to verify it was no longer vulnerable. This month, the security team found the same vulnerability on the server. Which of the following should be done to correct the cause of the vulnerability?

  A. Deploy a WAF in front of the application.
  B. Implement a software repository management tool.
  C. Install a HIPS on the server.
  D. Instruct the developers to use input validation in the code.
  B. Implement a software repository management tool.

• Question 304:

  A host is spamming the network unintentionally. Which of the following control types should be used to address this situation?

  A. Managerial
  B. Technical
  C. Operational
  D. Corrective
  B. Technical

• Question 305:

  A company has implemented WPA2, a 20-character minimum for the WiFi passphrase, and a new WiFi passphrase every 30 days, and has disabled SSID broadcast on all wireless access points. Which of the following is the company trying to mitigate?

  A. Downgrade attacks
  B. Rainbow tables
  C. SSL pinning
  D. Forced deauthentication
  A. Downgrade attacks

• Question 306:

  The help desk provided a security analyst with a screenshot of a user's desktop:

  

  For which of the following is aircrack-ng being used?

  A. Wireless access point discovery
  B. Rainbow attack
  C. Brute-force attack
  D. PCAP data collection
  C. Brute-force attack

• Question 307:

  An employee at an insurance company is processing claims that include patient addresses, clinic visits, diagnosis information, and prescription. While forwarding documentation to the supervisor, the employee accidentally sends the data to a personal email address outside of the company due to a typo. Which of the following types of data has been compromised?

  A. PCI
  B. Proprietary information
  C. Intellectual property
  D. PHI
  D. PHI

• Question 308:

  After detecting possible malicious external scanning, an internal vulnerability scan was performed, and a critical server was found with an outdated version of JBoss. A legacy application that is running depends on that version of JBoss. Which of the following actions should be taken FIRST to prevent server compromise and business disruption at the same time?

  A. Make a backup of the server and update the JBoss server that is running on it.
  B. Contact the vendor for the legacy application and request an updated version.
  C. Create a proper DMZ for outdated components and segregate the JBoss server.
  D. Apply visualization over the server, using the new platform to provide the JBoss service for the legacy application as an external service.
  C. Create a proper DMZ for outdated components and segregate the JBoss server.

  ---

  Explanation/Reference:

  What is that application for? "The DMZ is a special network zone designed to house systems that receive connections from the outside world, such as web and email servers. Sound firewall designs place these systems on an isolated network where, if they become compromised, they pose little threat to the internal network because connections between the DMZ and the internal network must still pass through the firewall and are subject to its security policy"

• Question 309:

  A recent audit included a vulnerability scan that found critical patches released 60 days prior were not applied to servers in the environment. The infrastructure team was able to isolate the issue and determined it was due to a service being disabled on the server running the automated patch management application. Which of the following would be the MOST efficient way to avoid similar audit findings in the future?

  A. Implement a manual patch management application package to regain greater control over the process.
  B. Create a patch management policy that requires all servers to be patched within 30 days of patch release.
  C. Implement service monitoring to validate that tools are functioning properly.
  D. Set services on the patch management server to automatically run on start-up.
  D. Set services on the patch management server to automatically run on start-up.

• Question 310:

  An organization wants to remediate vulnerabilities associated with its web servers. An initial vulnerability scan has been performed, and analysts are reviewing the results. Before starting any remediation, the analysts want to remove false positives to avoid spending time on issues that are not actual vulnerabilities. Which of the following would be an indicator of a likely false positive?

  A. Reports indicate that findings are informational.
  B. Any items labeled `low' are considered informational only.
  C. The scan result version is different from the automated asset inventory.
  D. `HTTPS' entries indicate the web page is encrypted securely.
  B. Any items labeled `low' are considered informational only.