CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 381:

  An application contains the following log entries in a file named "authlog.log":

  

  A security analyst has been asked to parse the log file and print out all valid usernames. Which of the following achieves this task?

  A. grep -e "successfully" authlog.log | awk `{print $2}' | sed s/\'//g
  B. cat authlog.log | grep "2016-01-01" | echo "valid username found: $2"
  C. echo authlog.log > sed `s/User//' | print "username exists: $User"
  D. cat "authlog.log" | grep "User" | cut -F' ` | echo "username exists: $1"
  D. cat "authlog.log" | grep "User" | cut -F' ` | echo "username exists: $1"

• Question 382:

  Management would like to make changes to the company's infrastructure following a recent incident in which a malicious insider was able to pivot to another workstation that had access to the server environment. Which of the following controls would work BEST to prevent this type of event from reoccurring?

  A. EDR
  B. DLP
  C. NAC
  D. IPS
  B. DLP

• Question 383:

  A hacker issued a command and received the following response:

  

  Which of the following describes what the hacker is attempting?

  A. Penetrating the system
  B. Performing a zombie scan
  C. OS fingerprinting
  D. Topology discovery
  A. Penetrating the system

• Question 384:

  An organization wants to move non-essential services into a cloud computing environment. Management has a cost focus and would like to achieve a recovery time objective of 12 hours. Which of the following cloud recovery strategies would work BEST to attain the desired outcome?

  A. Duplicate all services in another instance and load balance between the instances.
  B. Establish a hot site with active replication to another region within the same cloud provider.
  C. Set up a warm disaster recovery site with the same cloud provider in a different region
  D. Configure the systems with a cold site at another cloud provider that can be used for failover.
  C. Set up a warm disaster recovery site with the same cloud provider in a different region

• Question 385:

  Given the following access log:

  

  Which of the following accurately describes what this log displays?

  A. A vulnerability in jQuery
  B. Application integration with an externally hosted database
  C. A vulnerability scan performed from the Internet
  D. A vulnerability in Javascript
  C. A vulnerability scan performed from the Internet

• Question 386:

  A security analyst needs to provide a copy of a hard drive for forensic analysis. Which of the following would allow the analyst to perform the task?

  A. dcfldd if=/dev/one of=/mnt/usb/evidence.bin hash=md5, sha1 hashlog=/mnt/usb/evidence.bin.hashlog
  B. dd if=/dev/sda of=/mnt/usb/evidence.bin bs=4096; sha5l2sum /mnt/usb/evidence.bin > /mnt/usb/evidence.bin.hash
  C. tar -zcf /mnt/usb/evidence.tar.gz / -except /mnt; sha256sum /mnt/usb/evidence.tar.gz > /mnt/usb/evidence.tar.gz.hash
  D. find / -type f -exec cp {} /mnt/usb/evidence/ \; sha1sum /mnt/usb/evidence/* > /mnt/usb/evidence/evidence.hash
  B. dd if=/dev/sda of=/mnt/usb/evidence.bin bs=4096; sha5l2sum /mnt/usb/evidence.bin > /mnt/usb/evidence.bin.hash

• Question 387:

  During an incident investigation, a security analyst acquired a malicious file that was used as a backdoor but was not detected by the antivirus application. After performing a reverse-engineering procedure, the analyst found that part of the code was obfuscated to avoid signature detection. Which of the following types of instructions should the analyst use to understand how the malware was obfuscated and to help deobfuscate it?

  A. MOV
  B. ADD
  C. XOR
  D. SUB
  E. MOVL
  C. XOR

• Question 388:

  An organization implemented an extensive firewall access-control blocklist to prevent internal network ranges from communicating with a list of IP addresses of known command-and-control domains A security analyst wants to reduce the load on the firewall. Which of the following can the analyst implement to achieve similar protection and reduce the load on the firewall?

  A. A DLP system
  B. DNS sinkholing
  C. IP address allow list
  D. An inline IDS
  B. DNS sinkholing

  ---

  Explanation/Reference:

  DNS sinkholing is a mechanism that can prevent internal network ranges from communicating with a list of IP addresses of known command-and-control domains by returning a false or controlled IP address for those domains. This can reduce the load on the firewall by intercepting the DNS requests before they reach the firewall and diverting them to a sinkhole server. The other options are not relevant or effective for this purpose. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0- 002), page 9; https://www.enisa.europa.eu/topics/incident-response/glossary/dns-sinkhole

• Question 389:

  A Chief Information Security Officer (CISO) wants to standardize the company's security program so it can be objectively assessed as part of an upcoming audit requested by management.

  Which of the following would holistically assist in this effort?

  A. ITIL
  B. NIST
  C. Scrum
  D. AUP
  E. Nessus
  B. NIST

• Question 390:

  During a tabletop exercise, it is determined that a security analyst is required to ensure patching and scan reports are available during an incident, as well as documentation of all critical systems. To which of the following stakeholders should the analyst provide the reports?

  A. Management
  B. Affected vendors
  C. Security operations
  D. Legal
  A. Management