CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 441:

  An information security analyst observes anomalous behavior on the SCADA devices in a power plant. This behavior results in the industrial generators overheating and destabilizing the power supply. Which of the following would BEST identify potential indicators of compromise?

  A. Use Burp Suite to capture packets to the SCADA device's IP.
  B. Use tcpdump to capture packets from the SCADA device IP.
  C. Use Wireshark to capture packets between SCADA devices and the management system.
  D. Use Nmap to capture packets from the management system to the SCADA devices.
  C. Use Wireshark to capture packets between SCADA devices and the management system.

• Question 442:

  An analyst is participating in the solution analysis process for a cloud-hosted SIEM platform to centralize log monitoring and alerting capabilities in the SOC.

  Which of the following is the BEST approach for supply chain assessment when selecting a vendor?

  A. Gather information from providers, including datacenter specifications and copies of audit reports.
  B. Identify SLA requirements for monitoring and logging.
  C. Consult with senior management for recommendations.
  D. Perform a proof of concept to identify possible solutions.
  A. Gather information from providers, including datacenter specifications and copies of audit reports.

• Question 443:

  Creating a lessons learned report following an incident will help an analyst to communicate which of the following information? (Select TWO)

  A. Root cause analysis of the incident and the impact it had on the organization
  B. Outline of the detailed reverse engineering steps for management to review
  C. Performance data from the impacted servers and endpoints to report to management
  D. Enhancements to the policies and practices that will improve business responses
  E. List of IP addresses, applications, and assets
  A. Root cause analysis of the incident and the impact it had on the organization
  D. Enhancements to the policies and practices that will improve business responses

• Question 444:

  An analyst is conducting a log review and identifies the following snippet in one of the logs:

  

  Which of the following MOST likely caused this activity?

  A. SQL injection
  B. Privilege escalation
  C. Forgotten password
  D. Brute force
  D. Brute force

• Question 445:

  During which of the following NIST risk management framework steps would an information system security engineer identify inherited security controls and tailor those controls to the system?

  A. Categorize
  B. Select
  C. Implement
  D. Assess
  B. Select

• Question 446:

  A security analyst reviews SIEM logs and detects a well-known malicious executable running in a Windows machine. The up-to-date antivirus cannot detect the malicious executable. Which of the following is the MOST likely cause of this issue?

  A. The malware is fileless and exists only in physical memory
  B. The malware detects and prevents its own execution in a virtual environment
  C. The antivirus does not have the malware's signature
  D. The malware is being executed with administrative privileges
  A. The malware is fileless and exists only in physical memory

• Question 447:

  Which of the following are components of the intelligence cycle? (Select TWO.)

  A. Collection
  B. Normalization
  C. Response
  D. Analysis
  E. Correction
  F. Dissension
  B. Normalization
  E. Correction

• Question 448:

  A security analyst is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS

  Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise'?

  A. Run an anti-malware scan on the system to detect and eradicate the current threat
  B. Start a network capture on the system to look into the DNS requests to validate command and control traffic.
  C. Shut down the system to prevent further degradation of the company network
  D. Reimage the machine to remove the threat completely and get back to a normal running state.
  E. Isolate the system on the network to ensure it cannot access other systems while evaluation is underway.
  B. Start a network capture on the system to look into the DNS requests to validate command and control traffic.

• Question 449:

  A security analyst wants to capture large amounts of network data that will be analyzed at a later time. The packet capture does not need to be in a format that is readable by humans, since it will be put into a binary file called "packetCapture". The capture must be as efficient as possible, and the analyst wants to minimize the likelihood that packets will be missed. Which of the following commands will BEST accomplish the analyst's objectives?

  A. tcpdump -w packetCapture
  B. tcpdump -a packetCapture
  C. tcpdump -n packetCapture
  D. nmap -v > packetCapture
  E. nmap -oA > packetCapture
  A. tcpdump -w packetCapture

  ---

  Explanation/Reference:

  The -w flag allows tcpdump to save the captured packets in a file. The file will be in a binary format that can be processed by other tools, but not easily readable by humans.

  The other options are incorrect because:

  -a is not a valid flag for tcpdump.

  -n is a flag that tells tcpdump to not convert IP addresses and port numbers to names, but it does not affect the output format of the packets. nmap is a tool used for network discovery and security auditing, but it is not the best choice for

  capturing packets. The -v and -oA flags are also not relevant for packet capture.

  Reference: https://www.tcpdump.org/manpages/tcpdump.1.html

• Question 450:

  A network appliance manufacturer is building a new generation of devices and would like to include chipset security improvements. Management wants the security team to implement a method to prevent security weaknesses that could be reintroduced by downgrading the firmware version on the chipset. Which of the following would meet this objective?

  A. UEFI
  B. A hardware security module
  C. eFUSE
  D. Certificate signed updates
  C. eFUSE