CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 481:

  A security analyst is investigating an incident that appears to have started with SOL injection against a publicly available web application. Which of the following is the FIRST step the analyst should take to prevent future attacks?

  A. Modify the IDS rules to have a signature for SQL injection.
  B. Take the server offline to prevent continued SQL injection attacks.
  C. Create a WAF rule In block mode for SQL injection
  D. Ask the developers to implement parameterized SQL queries.
  A. Modify the IDS rules to have a signature for SQL injection.

• Question 482:

  A security analyst is investigating a reported phishing attempt that was received by many users throughout the company. The text of one of the emails shown below:

  Return-Path: [email protected]

  Received: from [122.167.40.119]

  Message-ID:

  Date: 23 May 2020 11:40:36 -0400 From: [email protected] X-Accept-Language: en-us, en MIME-Version: 1.0 To: Paul Vieira Subject: Account Lockout Content-Type: HTML;

  Office 365 User,

  It looks like your account has been locked out. Please click this link and follow the prompts to restore access.

  Regards,

  Security Team

  Due to the size of the company and the high storage requirements, the company does not log DNS requests or perform packet captures of network traffic, but it does log network flow data. Which of the following commands will the analyst most likely execute NEXT?

  A. telnet off1ce365.com 25
  B. tracert 122.167.40.119
  C. curl http://accountfix-office356.com/login.php
  D. nslookup accountfix-office356.com
  D. nslookup accountfix-office356.com

• Question 483:

  Which of the following is the software development process by which function, usability, and scenarios are tested against a known set of base requirements?

  A. Security regression testing
  B. Code review
  C. User acceptance testing
  D. Stress testing
  C. User acceptance testing

  ---

  Explanation/Reference:

  "User acceptance testing (UAT) is the last phase of the software testing process. During UAT, actual software users test the software to make sure it can handle required tasks in real-world scenarios, according to specifications."

  https://www.plutora.com/blog/uat-user-acceptance-testing

• Question 484:

  A security analyst performs a weekly vulnerability scan on a network that has 240 devices and receives a report with 2.450 pages. Which of the following would most likely decrease the number of false positives?

  A. Manual validation
  B. Penetration testing
  C. A known-environment assessment
  D. Credentialed scanning
  D. Credentialed scanning

  ---

  Explanation/Reference:

  Credentialed scanning is a method of vulnerability scanning that uses valid user credentials to access the target systems and perform a more thorough and accurate assessment of their security posture. Credentialed scanning can help to reduce the number of false positives by allowing the scanner to access more information and resources on the systems, such as configuration files, registry keys, installed software, patches, and permissions . Reference: https://www.tenable.com/blog/credentialed-vulnerability-scanning-what-why- and-how

• Question 485:

  A security analyst is reviewing WAF alerts and sees the following request:

  Request="GET /public/report.html?iewt=9064 AND 1=1 UNION ALL SELECT 1,NULL,table_name FROM information_schema.tables WHERE 2>1--/**/; HTTP/1.1 Host=mysite.com Which of the following BEST describes the attack?

  A. SQL injection
  B. LDAP injection
  C. Command iniection
  D. Denial of service
  A. SQL injection

  ---

  Explanation/Reference:

  This request is likely an attempt to perform an SQL injection attack.

  SQL injection attacks involve injecting malicious code into an application's SQL database in order to execute unauthorized commands or access sensitive data. The request shown in the example appears to be attempting to perform an SQL injection attack by appending malicious code to the end of a legitimate SQL query. The code "UNION ALL SELECT 1, NULL, table_name FROM information_schema.tables WHERE 2>1--" is attempting to retrieve the names of tables in the database, and the "--" at the end is used to comment out the rest of the query and prevent it from being executed.

  Overall, this request appears to be an attempt to perform an SQL injection attack on the application.

• Question 486:

  A security analyst is reviewing the logs from an internal chat server. The chat.log file is too large to review manually, so the analyst wants to create a shorter log file that only includes lines associated with a user demonstrating anomalous activity. Below is a snippet of the log: Which of the following commands would work BEST to achieve the desired result?

  

  A. grep -v chatter14 chat.log
  B. grep -i pythonfun chat.log
  C. grep -i javashark chat.log
  D. grep -v javashark chat.log
  E. grep -v pythonfun chat.log
  F. grep -i chatter14 chat.log
  D. grep -v javashark chat.log

• Question 487:

  A security analyst needs to provide the development learn with secure connectivity from the corporate network to a three-tier cloud environment. The developers require access to servers in all three tiers in order to perform various configuration tasks. Which of the following technologies should the analyst implement to provide secure transport?

  A. CASB
  B. VPC
  C. Federation
  D. VPN
  D. VPN

  ---

  Explanation/Reference:

  What is the difference between VPN and VPC? Just as a virtual private network (VPN) provides secure data transfer over the public Internet, a VPC provides secure data transfer between a private enterprise and a public cloud provider.

• Question 488:

  A security analyst notices the following proxy log entries:

  

  Which of the following is the user attempting to do based on the log entries?

  A. Use a DoS attack on external hosts.
  B. Exfiltrate data.
  C. Scan the network.
  D. Relay email.
  D. Relay email.

  ---

  Explanation/Reference:

  Based on the provided log entries, the user is attempting to relay email. This can be inferred from the log entries that show attempts to establish connections to external IP addresses on port 25, which is the default port for SMTP (Simple Mail Transfer Protocol) used for email transmission.

• Question 489:

  Which of the following principles describes how a security analyst should communicate during an incident?

  A. The communication should be limited to trusted parties only.
  B. The communication should be limited to security staff only.
  C. The communication should come from law enforcement.
  D. The communication should be limited to management only.
  A. The communication should be limited to trusted parties only.

• Question 490:

  Review the following results:

  

  Which of the following has occurred?

  A. This is normal network traffic.
  B. 123.120.110.212 is infected with a Trojan.
  C. 172.29.0.109 is infected with a worm.
  D. 172.29.0.109 is infected with a Trojan.
  A. This is normal network traffic.