CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 371:

  During the forensic analysis of a compromised machine, a security analyst discovers some binaries that are exhibiting abnormal behaviors. After extracting the strings, the analyst finds unexpected content

  Which of the following is the NEXT step the analyst should take?

  A. Only allow whitelisted binaries to execute.
  B. Run an antivirus against the binaries to check for malware.
  C. Use file integrity monitoring to validate the digital signature.
  D. Validate the binaries' hashes from a trusted source.
  D. Validate the binaries' hashes from a trusted source.

• Question 372:

  An organization has a practice of running some administrative services on non-standard ports as a way of frustrating any attempts at reconnaissance. The output of the latest scan on host 192.168.1.13 is shown below: Which of the following statements is true?

  

  A. Running SSH on the Telnet port will now be sent across an unencrypted port.
  B. Despite the results of the scan, the service running on port 23 is actually Telnet and not SSH, and creates an additional vulnerability
  C. Running SSH on port 23 provides little additional security from running it on the standard port.
  D. Remote SSH connections will automatically default to the standard SSH port.
  E. The use of OpenSSH on its default secure port will supersede any other remote connection attempts.
  C. Running SSH on port 23 provides little additional security from running it on the standard port.

• Question 373:

  A small business does not have enough staff in the accounting department to segregate duties. The controller writes the checks for the business and reconciles them against the ledger. To ensure there is no fraud occurring, the business conducts quarterly reviews in which a different officer in the business compares all the cleared checks against the ledger. Which of the following BEST describes this type of control?

  A. Deterrent
  B. Preventive
  C. Compensating
  D. Detective
  C. Compensating

  ---

  Explanation/Reference:

  A compensating control, also called an alternative control, is a mechanism that is put in place to satisfy the requirement for a security measure that is deemed too difficult or impractical to implement at the present time. "Compensating controls are additional security measures that you take to address a vulnerability without remediating the underlying issue."

• Question 374:

  A Chief Information Security Officer is concerned that contract developers may be able to steal the code used to design the company's latest application since they are able to pull code from a cloud-based repository directly to laptops that are not owned by the company. Which of the following solutions would best protect the company code from being stolen?

  A. MDM
  B. SCA
  C. CASB
  D. VDI
  D. VDI

  ---

  Explanation/Reference:

  VDI provides a secure environment for accessing company resources, such as code repositories, from remote locations. With VDI, the code repository would be accessed through a virtual desktop hosted on the company's servers, rather than on the developer's laptop. This means that the company's IT department can control the virtual desktop and ensure that it is secure, including installing security software, monitoring activity, and limiting access to the code repository.

• Question 375:

  A security analyst is assisting in the redesign of a network to make it more secure. The solution should be low cost, and access to the secure segments should be easily monitored, secured, and controlled. Which of the following should be implemented?

  A. System isolation
  B. Honeyport
  C. Jump box
  D. Mandatory access control
  C. Jump box

• Question 376:

  An investigation showed a worm was introduced from an engineer's laptop. It was determined the company does not provide engineers with company-owned laptops, which would be subject to company policy and technical controls.

  Which of the following would be the MOST secure control implement?

  A. Deploy HIDS on all engineer-provided laptops, and put a new router in the management network.
  B. Implement role-based group policies on the management network for client access.
  C. Utilize a jump box that is only allowed to connect to clients from the management network.
  D. Deploy a company-wide approved engineering workstation for management access.
  D. Deploy a company-wide approved engineering workstation for management access.

• Question 377:

  A security learn implemented a SCM as part for its security-monitoring program there is a requirement to integrate a number of sources Into the SIEM to provide better context relative to the events being processed. Which of the following BST describes the result the security learn hopes to accomplish by adding these sources?

  A. Data enrichment
  B. Continuous integration
  C. Machine learning
  D. Workflow orchestration
  A. Data enrichment

• Question 378:

  An alert has been distributed throughout the information security community regarding a critical Apache vulnerability. Which of the following courses of action would ONLY identify the known vulnerability?

  A. Perform an unauthenticated vulnerability scan on all servers in the environment.
  B. Perform a scan for the specific vulnerability on all web servers.
  C. Perform a web vulnerability scan on all servers in the environment.
  D. Perform an authenticated scan on all web servers in the environment.
  B. Perform a scan for the specific vulnerability on all web servers.

• Question 379:

  A developer wrote a script to make names and other Pll data unidentifiable before loading a database export into the testing system Which of the following describes the type of control that is being used?

  A. Data encoding
  B. Data masking
  C. Data loss prevention
  D. Data classification
  B. Data masking

• Question 380:

  A user's computer has been running slowly when the user tries to access web pages. A security analyst runs the command netstat -aon from the command line and receives the following output: Which of the following lines indicates the computer may be compromised?

  

  A. Line 1
  B. Line 2
  C. Line 3
  D. Line 4
  E. Line 5
  F. Line 6
  C. Line 3

  ---

  Explanation/Reference:

  Lines 1/2 are likely apps/services passing data, pretty common to see stuff like this.

  Lines 4/5 are likely just outbound HTTPS traffic.

  Line 6 is SMB to private IP. Likely grabbing a file from the file server on another segment of the network.

  Line 3 however appears to be an inbound SSL connection. The only inbound connection. Maybe this is a webserver, but we'd see many more connections to the same port. Based on the facts we have, this stands out to more considerably

  more than the others.