CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 421:

  At which of the following phases of the SDLC shoukJ security FIRST be involved?

  A. Design
  B. Maintenance
  C. Implementation
  D. Analysis
  E. Planning
  F. Testing
  F. Testing

• Question 422:

  While conoXicting a cloud assessment, a security analyst performs a Prowler scan, which generates the following within the report:

  

  Based on the Prowler report, which of the following is the BEST recommendation?

  A. Delete Cloud Dev access key 1
  B. Delete BusinessUsr access key 1.
  C. Delete access key 1.
  D. Delete access key 2.
  B. Delete BusinessUsr access key 1.

• Question 423:

  When of the following techniques can be implemented to safeguard the confidentiality of sensitive information while allowing limited access to authorized individuals?

  A. Deidentification
  B. Hashing
  C. Masking
  D. Salting
  C. Masking

  ---

  Explanation/Reference:

  https://www.techtarget.com/searchsecurity/definition/data-masking

• Question 424:

  Which of the following BEST describes the primary role ol a risk assessment as it relates to compliance with risk-based frameworks?

  A. It demonstrates the organization's mitigation of risks associated with internal threats.
  B. It serves as the basis for control selection.
  C. It prescribes technical control requirements.
  D. It is an input to the business impact assessment.
  A. It demonstrates the organization's mitigation of risks associated with internal threats.

• Question 425:

  An analyst is responding to an incident within a cloud infrastructure Based on the logs and traffic analysis, the analyst thinks a container has been compromised.

  Which of the following should Ihe analyst do FIRST?

  A. Perform threat hunting in other areas of the cloud infrastructure
  B. Contact law enforcement to report the incident
  C. Perform a root cause analysis on the container and the service logs
  D. Isolate the container from production using a predefined policy template
  D. Isolate the container from production using a predefined policy template

• Question 426:

  An incident response report indicates a virus was introduced through a remote host that was connected to corporate resources. A cybersecurity analyst has been asked for a recommendation to solve this issue. Which of the following should be applied?

  A. MAC
  B. TAP
  C. NAC
  D. ACL
  C. NAC

• Question 427:

  A security analyst discovered a specific series of IP addresses that are targeting an organization. None of the attacks have been successful. Which of the following should the security analyst perform NEXT?

  A. Begin blocking all IP addresses within that subnet.
  B. Determine the attack vector and total attack surface.
  C. Begin a kill chain analysis to determine the impact.
  D. Conduct threat research on the IP addresses
  D. Conduct threat research on the IP addresses

• Question 428:

  The management team has asked a senior security engineer to explore DLP security solutions for the company's growing use of cloud-based storage. Which of the following is an appropriate solution to control the sensitive data that is being stored in the cloud?

  A. NAC
  B. IPS
  C. CASB
  D. WAF
  C. CASB

  ---

  Explanation/Reference:

  A cloud access security broker (CASB) is a security solution that monitors and controls the use of cloud-based services and applications. A CASB can provide data loss prevention (DLP) capabilities for sensitive data that is being stored in the cloud, such as encryption, masking, tokenization, or redaction. A CASB can also enforce policies and compliance requirements for cloud usage, such as authentication, authorization, auditing, and reporting. The other options are not appropriate solutions for controlling sensitive data in the cloud. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 14; https://docs.microsoft.com/en-us/cloud-app-security/what- is-cloudapp- security

• Question 429:

  A new zero-day vulnerability was discovered within a basic screen capture app, which is used throughout the environment. Two days after discovering the vulnerability, the manufacturer of the software has not announced a remediation or if there will be a fix for this newly discovered vulnerability. The vulnerable application is not uniquely critical, but it is used occasionally by the management and executive management teams. The vulnerability allows remote code execution to gain privileged access to the system. Which of the following is the BEST course of actions to mitigate this threat?

  A. Work with the manufacturer to determine the time frame for the fix.
  B. Block the vulnerable application traffic at the firewall and disable the application services on each computer.
  C. Remove the application and replace it with a similar non-vulnerable application.
  D. Communicate with the end users that the application should not be used until the manufacturer has resolved the vulnerability.
  D. Communicate with the end users that the application should not be used until the manufacturer has resolved the vulnerability.

• Question 430:

  A company frequently expenences issues with credential stuffing attacks.

  Which of the following is the BEST control to help prevent these attacks from being successful?

  A. SIEM
  B. IDS
  C. MFA
  D. TLS
  C. MFA