CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 351:

  The primary difference in concern between remediating identified vulnerabilities found in general-purpose IT network servers and that of SCADA systems is that:

  A. change and configuration management processes do not address SCADA systems.
  B. doing so has a greater chance of causing operational impact in SCADA systems.
  C. SCADA systems cannot be rebooted to have changes to take effect.
  D. patch installation on SCADA systems cannot be verified.
  B. doing so has a greater chance of causing operational impact in SCADA systems.

• Question 352:

  Which of the flowing is the best reason why organizations need operational security controls?

  A. To supplement areas that other controls cannot address
  B. To limit physical access to areas that contain sensitive data
  C. To assess compliance automatically against a secure baseline
  D. To prevent disclosure by potential insider threats
  A. To supplement areas that other controls cannot address

• Question 353:

  After running the cat file01.bin | hexdump -C command, a security analyst reviews the following output snippet:

  

  Which of the following digital-forensics techniques is the analyst using?

  A. Reviewing the file hash
  B. Debugging the binary file
  C. Implementing file carving
  D. Verifying the file type
  E. Utilizing reverse engineering
  D. Verifying the file type

• Question 354:

  Which of the following actions should occur to address any open issues while closing an incident involving various departments within the network?

  A. Incident response plan
  B. Lessons learned report
  C. Reverse engineering process
  D. Chain of custody documentation
  B. Lessons learned report

• Question 355:

  Given the output below:

  #nmap 7.70 scan initiated Tues, Feb 8 12:34:56 2022 as: nmap -v -Pn -p 80,8000,443 -- script http-* -oA server.out 192.168.220.42

  Which of the following is being performed?

  A. Cross-site scripting
  B. Local file inclusion attack
  C. Log4] check
  D. Web server enumeration
  D. Web server enumeration

  ---

  Explanation/Reference:

  Web server enumeration is the process of identifying information about a web server, such as its software version, operating system, configuration, services, and vulnerabilities. This can be done using tools like Nmap, which can scan ports and run scripts to gather information. In this question, the Nmap command is using the -p option to scan ports 80, 8000, and 443, which are commonly used for web services. It is also using the --script option to run scripts that start with http-*, which are related to web server enumeration. The output file name server.out also suggests that the purpose of the scan is to enumerate web servers. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0- 002), page 8; https://partners.comptia.org/docs/default- source/resources/comptia-cysa-cs0-002-exam-objectives

• Question 356:

  A security analyst at an organization is reviewing vulnerability reports from a newly deployed vulnerability management platform. The organization is not receiving information about devices that rarely connect to the network. Which of the following will the analyst most likely do to obtain vulnerability information about these devices?

  A. Add administrator credentials to mobile devices.
  B. Utilize cloud-based agents.
  C. Deploy a VPC in front of a NAC.
  D. Implement MDM.
  B. Utilize cloud-based agents.

  ---

  Explanation/Reference:

  MDM to management company owned devices.

• Question 357:

  A systems administrator is trying to secure a critical system. The administrator has placed the system behind a firewall, enabled strong authentication, and required all administrators of this system to attend mandatory training.

  Which of the following BEST describes the control being implemented?

  A. Audit remediation
  B. Defense in depth
  C. Access control
  D. Multifactor authentication
  B. Defense in depth

• Question 358:

  A security audit revealed that port 389 has been used instead of 636 when connecting to LDAP for the authentication of users. The remediation recommended by the audit was to switch the port to 636 wherever technically possible. Which of the following is the BEST response?

  A. Correct the audit. This finding is a well-known false positive; the services that typically run on 389 and 636 are identical.
  B. Change all devices and servers that support it to 636, as encrypted services run by default on 636.
  C. Change all devices and servers that support it to 636, as 389 is a reserved port that requires root access and can expose the server to privilege escalation attacks.
  D. Correct the audit. This finding is accurate, but the correct remediation is to update encryption keys on each of the servers to match port 636.
  B. Change all devices and servers that support it to 636, as encrypted services run by default on 636.

• Question 359:

  An information security analyst discovered a virtual machine server was compromised by an attacker. Which of the following should be the FIRST step to confirm and respond to the incident?

  A. Pause the virtual machine,
  B. Shut down the virtual machine.
  C. Take a snapshot of the virtual machine.
  D. Remove the NIC from the virtual machine.
  A. Pause the virtual machine,

  ---

  Explanation/Reference:

  Enumeration is the process of discovering and listing information. Network enumeration is the process of discovering pieces of information that might be helpful in a network attack or compromise. There are several techniques used to perform enumeration and several tools that make the process easier for both testers and attackers. Let's take a look at these techniques and tools.

• Question 360:

  A security analyst is making recommendations for securing access to the new forensic workstation and workspace. Which of the following security measures should the analyst recommend to protect access to forensic data?

  A. Multifactor authentication Polarized lens protection Physical workspace isolation
  B. Secure ID token Security reviews of the system at least yearly Polarized lens protection
  C. Bright lightning in all access areas Security reviews of the system at least yearly Multifactor authentication
  D. Two-factor authentication into the building Separation of duties Warning signs placed in clear view
  A. Multifactor authentication Polarized lens protection Physical workspace isolation