CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 311:

  An organization has a policy prohibiting remote administration of servers where web services are running. One of the Nmap scans is shown here:

  

  Given the organization's policy, which of the following services should be disabled on this server?

  A. rpcbind
  B. netbios-ssn
  C. mysql
  D. ssh
  E. telnet
  D. ssh

• Question 312:

  A security analyst has received information from a third-party intelligence-sharing resource that indicates employee accounts were breached. Which of the following is the NEXT step the analyst should take to address the issue?

  A. Audit access permissions for all employees to ensure least privilege.
  B. Force a password reset for the impacted employees and revoke any tokens.
  C. Configure SSO to prevent passwords from going outside the local network.
  D. Set up privileged access management to ensure auditing is enabled.
  B. Force a password reset for the impacted employees and revoke any tokens.

• Question 313:

  A cybersecurity analyst is reviewing the following outputs:

  

  Which of the following can the analyst infer from the above output?

  A. The remote host is redirecting port 80 to port 8080.
  B. The remote host is running a service on port 8080.
  C. The remote host's firewall is dropping packets for port 80.
  D. The remote host is running a web server on port 80.
  B. The remote host is running a service on port 8080.

• Question 314:

  The security team decides to meet informally to discuss and test the response plan for potential security breaches and emergency situations. Which of the following types of training will the security team perform?

  A. Tabletop exercise
  B. Red-team attack
  C. System assessment implementation
  D. Blue-team training
  E. White-team engagement
  A. Tabletop exercise

  ---

  Explanation/Reference:

  A tabletop exercise is a type of training used to assess an organization's preparedness in responding to emergencies and security breaches. It involves discussing various scenarios and simulating how the organization would react in each situation. https://www.comptia.org/content/tabletop-exercises.

• Question 315:

  An organization's internal department frequently uses a cloud provider to store large amounts of sensitive data. A threat actor has deployed a virtual machine to at the use of the cloud hosted hypervisor, the threat actor has escalated the access rights. Which of the following actions would be BEST to remediate the vulnerability?

  A. Sandbox the virtual machine.
  B. Implement an MFA solution.
  C. Update lo the secure hypervisor version.
  D. Implement dedicated hardware for each customer.
  C. Update lo the secure hypervisor version.

• Question 316:

  A security analyst reviews SIEM logs and discovers the following error event:

  ERROR Event ID 4 The Kerberos client received a KRB AP ERR MODIFIED error from the server DBASVRR4S. The target name used was GC/PDC1DC.Domain57/Administrator. This indicates that the target server failed to decrypt the ticket provided by the client. Check if there are identically named server accounts in these two domains, or use the fully qualified name to identify the server.

  Which of the following environments does the analyst need to examine to continue troubleshooting the event?

  A. Proxy server
  B. SQL server
  C. Windows domain controller
  D. WAF appliance
  E. DNS server
  E. DNS server

  ---

  Explanation/Reference:

  Reference: https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-client-krb-ap-err-modified-error

• Question 317:

  An analyst is preparing for a technical security compliance check on all Apache servers. Which of the following will be the BEST to use?

  A. CIS benchmark
  B. Nagios
  C. OWASP
  D. Untidy
  E. Cain and Abel
  A. CIS benchmark

• Question 318:

  As a proactive threat-hunting technique, hunters must develop situational cases based on likely attack scenarios derived from the available threat intelligence information. After forming the basis of the scenario, which of the following may the threat hunter construct to establish a framework for threat assessment?

  A. Critical asset list
  B. Threat vector
  C. Attack profile
  D. Hypothesis
  D. Hypothesis

• Question 319:

  A cybersecurity analyst has identified a new mission-essential function that utilizes a public cloud-based system. The analyst needs to classify the information processed by the system with respect to CIA. Which of the following should provide the CIA classification for the information?

  A. The cloud provider
  B. The data owner
  C. The cybersecurity analyst
  D. The system administrator
  B. The data owner

• Question 320:

  A nuclear facility manager determined the need to monitor utilization of water within the facility. A startup company just announced a state-of-the-art solution to address the need for integrating the business and ICS network. The solution requires a very small agent to be installed on the ICS equipment. Which of the following is the MOST important security control for the manager to invest in to protect the facility?

  A. Run a penetration test on the installed agent.
  B. Require that the solution provider make the agent source code available for analysis.
  C. Require through guides for administrator and users.
  D. Install the agent for a week on a test system and monitor the activities.
  D. Install the agent for a week on a test system and monitor the activities.