CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 331:

  The help desk notified a security analyst that emails from a new email server are not being sent out. The new email server was recently added to the existing ones. The analyst runs the following command on the new server:

  

  Given the output, which of the following should the security analyst check NEXT?

  A. The DNS name of the new email server
  B. The version of SPF that is being used
  C. The IP address of the new email server
  D. The DMARC policy
  A. The DNS name of the new email server

• Question 332:

  Due to a nse m cyberattackers seeking PHI, a healthcare company that collects highly sensitive data from millions of customers is deploying a solution that will ensure the customers' data is protected by the organization internally and externally.

  Which of the following countermeasures can BEST prevent the loss of customers' sensitive data?

  A. Implement privileged access management
  B. Implement a nsk management process
  C. Implement multifactor authentication
  D. Add more security resources to the environment
  A. Implement privileged access management

• Question 333:

  A routine vulnerability scan detected a known vulnerability in a critical enterprise web application. Which of the following would be the BEST next step?

  A. Submit a change request to have the system patched
  B. Evaluate the risk and criticality to determine it further action is necessary
  C. Notify a manager of the breach and initiate emergency procedures.
  D. Remove the application from production and Inform the users.
  A. Submit a change request to have the system patched

• Question 334:

  Which of the following is MOST dangerous to the client environment during a vulnerability assessment penetration test?

  A. There is a longer period of time to assess the environment.
  B. The testing is outside the contractual scope
  C. There is a shorter period of time to assess the environment
  D. No status reports are included with the assessment.
  B. The testing is outside the contractual scope

• Question 335:

  A company's legal and accounting teams have decided it would be more cost-effective to offload the risks of data storage to a third party. The IT management team has decided to implement a cloud model and has asked the security team for recommendations. Which of the following will allow all data to be kept on the third-party network?

  A. VDI
  B. SaaS
  C. CASB
  D. FaaS
  B. SaaS

  ---

  Explanation/Reference:

  Which of the follawing activities is designed to handle a control failure that leads to a breach? Risk assessment Incident management Root cause analysis Vulnerability management Software as a Service (SaaS) -Provides all the hardware, operating system, software, and applications needed for a complete application service to be delivered

  -Cloud service providers are responsible for the security of the platform and infrastructure -Consumers are responsible for application security, account provisioning, and authorizations

  Cloud Access Security Broker (CASB)

  -

  Enterprise management software designed to mediate access to cloud services by users across all types of devices Single sign-on Malware and rogue device detection Monitor/audit user activity Mitigate data exfiltration

  -

  Cloud Access Service Brokers provide visibility into how clients and another network nodes use cloud services Forward Proxy Reverse Proxy API

• Question 336:

  While reviewing network security events within a company, a security engineer notices a number of machines:

  1.

  Do not have minimum security requirements, such as AV updates

  2.

  Have different configurations that deviate from the corporate standard

  3.

  Are missing several critical security patches

  Which of the following is the BEST solution to ensure machines that are introduced to the company's network meet the above security requirements?

  A. Port security
  B. Network access control
  C. MAC filtering
  D. Access control list
  B. Network access control

• Question 337:

  An analyst is observing unusual network traffic from a workstation. The workstation is communicating with a known malicious site over an encrypted tunnel. A full antivirus scan with an updated antivirus signature file does not show any sign of infection. Which of the following has occurred on the workstation?

  A. Zero-day attack
  B. Known malware attack
  C. Session hijack
  D. Cookie stealing
  A. Zero-day attack

• Question 338:

  A consultant evaluating multiple threat intelligence leads to assess potential risks for a client. Which of the following is the BEST approach for the consultant to consider when modeling the client's attack surface?

  A. Ask for external scans from industry peers, look at the open ports, and compare Information with the client.
  B. Discuss potential tools the client can purchase lo reduce the livelihood of an attack.
  C. Look at attacks against similar industry peers and assess the probability of the same attacks happening.
  D. Meet with the senior management team to determine if funding is available for recommended solutions.
  C. Look at attacks against similar industry peers and assess the probability of the same attacks happening.

• Question 339:

  SIMULATION

  Part2: AppServ3

  You are a cybersecurity analyst tasked with interpreting scan data from Company A's servers. You must verify the requirements are being met for all of the servers and recommend changes if you find they are not. The company's hardening guidelines indicate the following:

  1. TLS 1.2 is the only version of TLS running.

  2. Apache 2.4.18 or greater should be used.

  3. Only default ports should be used.

  INSTRUCTIONS

  Using the supplied data, record the status of compliance with the company's guidelines for each server. The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for issues based ONLY on the hardening guidelines provided.

  Hot Area:

  

  

  ---

  Explanation/Reference:

  AppServ3 - HTTPD Security - Restrict to TLS 1.2 ((Disable TLS 1.0 and TLS 1.1. if offered in test)

• Question 340:

  While a threat intelligence analyst was researching an indicator of compromise on a search engine, the web proxy generated an alert regarding the same indicator. The threat intelligence analyst states that related sites were not visited but were searched for in a search engine. Which of the following MOST likely happened in this situation?

  A. The analyst is not using the standard approved browser.
  B. The analyst accidently clicked a link related to the indicator.
  C. The analyst has prefetch enabled on the browser in use.
  D. The alert in unrelated to the analyst's search.
  C. The analyst has prefetch enabled on the browser in use.