CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 361:

  Which of the following BEST describes how logging and monitoring work when entering into a public cloud relationship with a service provider?

  A. Logging and monitoring are not needed in a public cloud environment
  B. Logging and monitoring are done by the data owners
  C. Logging and monitoring duties are specified in the SLA and contract
  D. Logging and monitoring are done by the service provider
  C. Logging and monitoring duties are specified in the SLA and contract

• Question 362:

  The Chief Information Officer (CIO) for a large manufacturing organization has noticed a significant number of unknown devices with possible malware infections are on the organization's corporate network. Which of the following would work BEST to prevent the issue?

  A. Reconfigure the NAC solution to prevent access based on a full device profile and ensure antivirus is installed.
  B. Segment the network to isolate all systems that contain highly sensitive information, such as intellectual property.
  C. Implement certificate validation on the VPN to ensure only employees with the certificate can access the company network.
  D. Update the antivirus configuration to enable behavioral and real-time analysis on all systems within the network.
  A. Reconfigure the NAC solution to prevent access based on a full device profile and ensure antivirus is installed.

• Question 363:

  An analyst is reviewing the following output:

  

  Vulnerability found: Improper neutralization of script-related HTML tag Which of the following was most likely used to discover this?

  A. Reverse engineering using a debugger
  B. A static analysis vulnerability scan
  C. A passive vulnerability scan
  D. A database vulnerability scan
  D. A database vulnerability scan

• Question 364:

  A security analyst is creating ACLs on a perimeter firewall that will deny inbound packets that are from internal addresses, reversed external addresses, and multicast addresses. Which of the following is the analyst attempting to prevent?

  A. Broadcast storms
  B. Spoofing attacks
  C. DDoS attacks
  D. Man-in-the-middle attacks
  B. Spoofing attacks

• Question 365:

  Management is concerned with administrator access from outside the network to a key server in the company. Specifically, firewall rules allow access to the server from anywhere in the company. Which of the following would be an effective solution?

  A. Honeypot
  B. Jump box
  C. Server hardening
  D. Anti-malware
  B. Jump box

• Question 366:

  An executive tasked a security analyst to aggregate past logs, traffic, and alerts on a particular attack vector. The analyst was then tasked with analyzing the data and making predictions on future complications regarding this attack vector. Which of the following types of analysis is the security analyst MOST likely conducting?

  A. Trend analysis
  B. Behavior analysis
  C. Availability analysis
  D. Business analysis
  A. Trend analysis

• Question 367:

  An analyst determines a security incident has occurred

  Which of the following is the most appropnate NEXT step in an incident response plan?

  A. Consult the malware analysis process
  B. Consult the disaster recovery plan
  C. Consult the data classification process
  D. Consult the communications plan
  D. Consult the communications plan

• Question 368:

  After a recent security breach, it was discovered that a developer had promoted code that had been written to the production environment as a hotfix to resolve a user navigation issue that was causing issues for several customers. The code had inadvertently granted administrative privileges to all users, allowing inappropriate access to sensitive data and reports. Which of the following could have prevented this code from being released into the production environment?

  A. Cross training
  B. Succession planning
  C. Automated reporting
  D. Separation of duties
  D. Separation of duties

• Question 369:

  A cybersecurity analyst is contributing to a team hunt on an organization's endpoints. Which of the following should the analyst do FIRST?

  A. Write detection logic.
  B. Establish a hypothesis.
  C. Profile the threat actors and activities.
  D. Perform a process analysis.
  C. Profile the threat actors and activities.

  ---

  Explanation/Reference:

  Reference: https://www.cybereason.com/blog/blog-the-eight-steps-to-threat-hunting

• Question 370:

  Which of the following attacks can be prevented by using output encoding?

  A. Server-side request forgery
  B. Cross-site scripting
  C. SQL injection
  D. Command injection
  E. Cross-site request forgery
  F. Directory traversal
  B. Cross-site scripting