CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 411:

  An analyst is investigating an anomalous event reported by the SOC After reviewing the system logs the analyst identifies an unexpected addition of a user with root-level privileges on the endpoint. Which of the following data sources will BEST help the analyst to determine whether this event constitutes an incident?

  A. Patching logs
  B. Threat feed
  C. Backup logs
  D. Change requests
  E. Data classification matrix
  D. Change requests

• Question 412:

  A Chief Information Secunty Officer has asked for a list of hosts that have critical and high- seventy findings as referenced in the CVE database. Which of the following tools would produce the assessment output needed to satisfy this request?

  A. Nessus
  B. Nikto
  C. Fuzzer
  D. Wireshark
  E. Prowler
  A. Nessus

  ---

  Explanation/Reference:

  Nessus is a vulnerability scanning and assessment tool that can be used to scan systems for potential vulnerabilities and weaknesses. It provides detailed reports on any critical and high-severity findings as referenced in the CVE database, making it the ideal tool for fulfilling the Chief Information Security Officer's request. Nikto, fuzzer, wireshark, and prowler are all security tools, but they are not applicable for the scenario described in the question. Here is a link to an article from CompTIA's website about Nessus for your reference: https://www.comptia.org/content/nessus-vulnerability-scanning- and-assessment-tool.

• Question 413:

  Which of the following software assessment methods would be BEST for gathering data related to an application's availability during peak times?

  A. Security regression testing
  B. Stress testing
  C. Static analysis testing
  D. Dynamic analysis testing
  E. User acceptance testing
  B. Stress testing

• Question 414:

  A product security analyst has been assigned to evaluate and validate a new products security capabilities Part ot the evaluation involves reviewing design changes at specific intervals tor security deficiencies recommending changes and checking for changes at the next checkpoint.

  Which of the following BEST defines the activity being conducted?

  A. User acceptance testing
  B. Stress testing
  C. Code review
  D. Security regression testing
  C. Code review

  ---

  Explanation/Reference:

  Once the SDLC reached the development phase, code starts to be generated. That means that the ability to control the version of the software or component that your team is working on, combined with check-in/check-out functionality and

  revision histories, is a necessary and powerful tool when developing software.

  The question refers to a "new" product so I believe that is key. However, it also makes it seem that it is about the development of a product that could be in production.

  Regression testing focuses on testing to ensure that changes that have been made do not create new issues, and ensure that no new vulnerabilities, misconfigurations, or other issues have been introduced.

• Question 415:

  A cybersecurity analyst is conducting a security test to ensure that information regarding the web server is protected from disclosure. The cybersecurity analyst requested an HTML file from the web server, and the response came back as follows:

  

  Which of the following actions should be taken to remediate this security issue?

  A. Set "Allowlatescanning" to 1 in the URLScan.ini configuration file.
  B. Set "Removeserverheader" to 1 in the URLScan.ini configuration file.
  C. Set "Enablelogging" to 0 in the URLScan.ini configuration file.
  D. Set "Perprocesslogging" to 1 in the URLScan.ini configuration file.
  B. Set "Removeserverheader" to 1 in the URLScan.ini configuration file.

  ---

  Explanation/Reference:

  Reference: http://www.acunetix.com/blog/articles/configure-web-server-disclose-identity/

• Question 416:

  An executive assistant wants to onboard a new cloud-based product to help with business analytics and dashboarding. Which of the following would be the BEST integration option for this service?

  A. Manually log in to the service and upload data files on a regular basis
  B. Have the internal development team script connectivity and file transfers to the new service
  C. Create a dedicated SFTP site and schedule transfers to ensure file transport security
  D. Utilize the cloud product's API for supported and ongoing integrations
  D. Utilize the cloud product's API for supported and ongoing integrations

• Question 417:

  A security analyst s monitoring a company's network traffic and finds ping requests going to accounting and human resources servers from a SQL server. Upon investigation, the analyst discovers a technician responded to potential network connectivity issues. Which of the following is the best way for the security analyst to respond?

  A. Report this activity as a false positive, as the activity is legitimate.
  B. Isolate the system and begin a forensic investigation to determine what was compromised.
  C. Recommend network segmentation to the management team as a way to secure the various environments.
  D. Implement host-bases firewalls on all systems to prevent ping sweeps in the future.
  A. Report this activity as a false positive, as the activity is legitimate.

• Question 418:

  A security is reviewing a vulnerability scan report and notes the following finding:

  

  As part of the detection and analysis procedures, which of the following should the analyst do NEXT?

  A. Patch or reimage the device to complete the recovery
  B. Restart the antiviruses running processes
  C. Isolate the host from the network to prevent exposure
  D. Confirm the workstation's signatures against the most current signatures.
  D. Confirm the workstation's signatures against the most current signatures.

• Question 419:

  A security analyst has discovered suspicious traffic and determined a host is connecting to a known malicious website. The MOST appropriate action for the analyst to take would be lo implement a change request to:

  A. update the antivirus software
  B. configure the firewall to block traffic to the domain
  C. add the domain to the blacklist
  D. create an IPS signature for the domain
  B. configure the firewall to block traffic to the domain

• Question 420:

  Which ol the following provides an automated approach 10 checking a system configuration?

  A. SCAP
  B. CI/CD
  C. OVAL
  D. Scripting
  E. SOAR
  A. SCAP