CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 491:

  While investigating an incident in a company's SIEM console, a security analyst found hundreds of failed SSH login attempts, which all occurred in rapid succession. The failed attempts were followed by a successful login on the root user. Company policy allows systems administrators to manage their systems only from the company's internal network using their assigned corporate logins.

  Which of the following are the BEST actions the analyst can take to stop any further compromise? (Choose two.)

  A. Add a rule on the affected system to block access to port TCP/22.
  B. Reset the passwords for all accounts on the affected system.
  C. Add a rule on the perimeter firewall to block the source IP address.
  D. Configure /etc/sshd_config to deny root logins and restart the SSHD service.
  E. Configure /etc/passwd to deny root logins and restart the SSHD service.
  F. Add a rule on the network IPS to block SSH user sessions.
  B. Reset the passwords for all accounts on the affected system.
  D. Configure /etc/sshd_config to deny root logins and restart the SSHD service.

• Question 492:

  Which of the following utilities could be used to resolve an IP address to a domain name, assuming the address has a PTR record?

  A. ifconfig
  B. ping
  C. arp
  D. nbtstat
  B. ping

• Question 493:

  A security analyst is reviewing a suspected phishing campaign that has targeted an organisation. The organization has enabled a few email security technologies in the last year: however, the analyst believes the security features are not working. The analyst runs the following command:

  > dig domain._domainkey.comptia.orq TXT

  Which of the following email protection technologies is the analyst MOST likely validating?

  A. SPF
  B. DNSSEC
  C. DMARC
  D. DKIM
  D. DKIM

• Question 494:

  The new Chief Technology Officer (CTO) is seeking recommendations for network monitoring services for the local intranet. The CTO would like the capability to monitor all traffic to and from the gateway, as well as the capability to block certain content. Which of the following recommendations would meet the needs of the organization?

  A. Recommend setup of IP filtering on both the internal and external interfaces of the gateway router.
  B. Recommend installation of an IDS on the internal interface and a firewall on the external interface of the gateway router.
  C. Recommend installation of a firewall on the internal interface and a NIDS on the external interface of the gateway router.
  D. Recommend installation of an IPS on both the internal and external interfaces of the gateway router.
  C. Recommend installation of a firewall on the internal interface and a NIDS on the external interface of the gateway router.

• Question 495:

  A security analyst is researching ways to improve the security of a company's email system to mitigate emails that are impersonating company executives. Which of the following would be BEST for the analyst to configure to achieve this objective?

  A. A TXT record on the name server for SPF
  B. DNSSEC keys to secure replication
  C. Domain Keys identified Man
  D. A sandbox to check incoming mad
  C. Domain Keys identified Man

• Question 496:

  The director of software development is concerned with recent web application security incidents, including the successful breach of a back-end database server. The director would like to work with the security team to implement a standardized way to design, build, and test web applications and the services that support them. Which of the following meets the criteria?

  A. OWASP
  B. SANS
  C. PHP
  D. Ajax
  A. OWASP

  ---

  Explanation/Reference:

  Reference: https://www.synopsys.com/software-integrity/resources/knowledge-database/owasp-top-10.html

• Question 497:

  A company wants to outsource a key human-resources application service to remote employees as a SaaS-based cloud solution. The company's GREATEST concern should be the SaaS provider's:

  A. SLA for system uptime.
  B. DLP procedures.
  C. logging and monitoring capabilities.
  D. data protection capabilities.
  D. data protection capabilities.

• Question 498:

  A security engineer is reviewing security products that identify malicious actions by users as part of a company's insider threat program. Which of the following is the MOST appropriate product category for this purpose?

  A. SCAP
  B. SOAR
  C. UEBA
  D. WAF
  C. UEBA

  ---

  Explanation/Reference:

  UEBA stands for User and Entity Behavior Analytics and was previously known as user behavior analytics (UBA).

• Question 499:

  A cybersecurity analyst has received a report that multiple systems are experiencing slowness as a result of a DDoS attack. Which of the following would be the BEST action for the cybersecurity analyst to perform?

  A. Continue monitoring critical systems.
  B. Shut down all server interfaces.
  C. Inform management of the incident.
  D. Inform users regarding the affected systems.
  C. Inform management of the incident.

• Question 500:

  A system administrator has reviewed the following output: Which of the following can a system administrator infer from the above output?

  

  A. The company email server is running a non-standard port.
  B. The company email server has been compromised.
  C. The company is running a vulnerable SSH server.
  D. The company web server has been compromised.
  A. The company email server is running a non-standard port.