CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 321:

  A security analyst scanned an internal company subnet and discovered a host with the following Nmap output.

  

  Based on the output of this Nmap scan, which of the following should the analyst investigate FIRST?

  A. Port 22
  B. Port 135
  C. Port 445
  D. Port 3389
  A. Port 22

• Question 322:

  A development team has asked users to conduct testing to ensure an application meets the needs of the business. Which of the following types of testing docs This describe?

  A. Acceptance testing
  B. Stress testing
  C. Regression testing
  D. Penetration testing
  A. Acceptance testing

• Question 323:

  A security architect is reviewing the options for performing input validation on incoming web form submissions. Which of the following should the architect as the MOST secure and manageable option?

  A. Client-side whitelisting
  B. Server-side whitelisting
  C. Server-side blacklisting
  D. Client-side blacklisting
  B. Server-side whitelisting

• Question 324:

  A cybersecurity analyst is supporting an incident response effort via threat intelligence. Which of the following is the analyst MOST likely executing?

  A. Requirements analysis and collection planning
  B. Containment and eradication
  C. Recovery and post-incident review
  D. Indicator enrichment and research pivoting
  D. Indicator enrichment and research pivoting

• Question 325:

  Which of the following are considered PH by themselves? (Select TWO).

  A. Government ID
  B. Job title
  C. Employment start date
  D. Birth certificate
  E. Employer address
  F. Mother's maiden name
  A. Government ID
  D. Birth certificate

• Question 326:

  The management team assigned the following values to an inadvertent breach of privacy regulations during the original risk assessment:

  1.

  Probability = 25%

  2.

  Magnitude = $1,015 per record

  3.

  Total records = 10,000

  Two breaches occurred during the fiscal year. The first compromised 35 records, and the second compromised 65 records. Which of the following is the value of the records that were compromised?

  A. $10,150
  B. $25,375
  C. $101,500
  D. $2,537,500
  A. $10,150

  ---

  Explanation/Reference:

  A total of 100 records were compromised at a cost of $1015 per record (100 ?1015 = 10,150).

• Question 327:

  An information security analyst is working with a data owner to identify the appropriate controls to preserve the confidentiality of data within an enterprise environment One of the primary concerns is exfiltration of data by malicious insiders

  Which of the following controls is the MOST appropriate to mitigate risks?

  A. Data deduplication
  B. OS fingerprinting
  C. Digital watermarking
  D. Data loss prevention
  D. Data loss prevention

• Question 328:

  A security analyst is investigating a malware infection that occurred on a Windows system. The system was not connected to a network and had no wireless capability Company policy prohibits using portable media or mobile storage The security analyst is trying to determine which user caused the malware to get onto the system

  Which of the following registry keys would MOST likely have this information?

  A. HKEY_USERS\\Software\Microsoft\Windows\CurrentVersion\Run
  B. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  C. HKEY_USERS\\Software\Microsoft\Windows\explorer\MountPoints2
  D. HKEY_USERS\\Software\Microsoft\Internet Explorer\Typed URLs
  E. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\iusb3hub
  C. HKEY_USERS\\Software\Microsoft\Windows\explorer\MountPoints2

  ---

  Explanation/Reference:

  The article states that Windows stores USB history-related info using five registry keys, and each one offers a different set of information about the connected device.

  One of those keys is the following:

  HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2: This key will hold information that states which user was logged into Windows when a specific USB device was connected.

  This is a good place to start to figure out which user caused the malware to get onto the system.

• Question 329:

  An organization that uses SPF has been notified emails sent via its authorized third-party partner are getting rejected. A security analyst reviews the DNS entry and sees the following: v=spf1 ip4:180.10.6.5 ip4:180.10.6.10 include:robustmail.com `"all The organization's primary mail server IP is 180.10.6.6, and the secondary mail server IP is 180.10.6.5. The organization's third-party mail provider is "Robust Mail" with the domain name robustmail.com. Which of the following is the MOST

  likely reason for the rejected emails?

  A. SPF version 1 does not support third-party providers.
  B. The primary and secondary email server IP addresses are out of sequence.
  C. An incorrect IP version is being used.
  D. The wrong domain name is in the SPF record.
  D. The wrong domain name is in the SPF record.

• Question 330:

  A company's domain has been spooled in numerous phishing campaigns. An analyst needs to determine the company is a victim of domain spoofing, despite having a DMARC record that should tell mailbox providers to ignore any email that fails DMARC upon review of the record, the analyst finds the following:

  v=DMARC1; p=none; fo=0; rua=mailto:[email protected]; ruf=mailto:[email protected]; adkim=r; rf=afrf; ri=86400;

  Which of the following BEST explains the reason why the company's requirements are not being processed correctly by mailbox providers?

  A. The DMARC record's DKIM alignment tag Is incorrectly configured.
  B. The DMARC record's policy tag is incorrectly configured.
  C. The DMARC record does not have an SPF alignment tag.
  D. The DMARC record's version tag is set to DMARC1 instead of the current version, which is DMARC3.
  B. The DMARC record's policy tag is incorrectly configured.

  ---

  Explanation/Reference:

  To add more clarity here (I worked specifically in email security).

  It is not required to have an SPF alignment tag (ASPF tag).

  https://easydmarc.com/blog/what-are-dmarc-tags-dmarc-tags-explained/

  Even if you did have it, DMARC policy is in monitor only mode (p=none), so it wouldn't matter. The policy is never going to be enforced until you move it to p=quarantine at the minimum (very few orgs actually hit a p=reject stage, it's incredibly

  difficult).