CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 531:

  When investigating a report of a system compromise, a security analyst views the following /var/log/secure log file: Which of the following can the analyst conclude from viewing the log file?

  

  A. The comptia user knows the sudo password.
  B. The comptia user executed the sudo su command.
  C. The comptia user knows the root password.
  D. The comptia user added himself or herself to the /etc/sudoers file.
  C. The comptia user knows the root password.

  ---

  Explanation/Reference:

  the user is not in the sudoers file. you use your own password for that. the user used the su command to switch user accounts. when no user is specified, the su command defaults to the root account. the user is now logged into the root account. you need to know the root password to log into the root account.

• Question 532:

  A help desk technician inadvertently sent the credentials of the company's CRM n clear text to an employee's personal email account. The technician then reset the employee's account using the appropriate process and the employee's corporate email, and notified the security team of the incident According to the incident response procedure, which of the following should the security team do NEXT?

  A. Contact the CRM vendor.
  B. Prepare an incident summary report.
  C. Perform postmortem data correlation.
  D. Update the incident response plan.
  B. Prepare an incident summary report.

• Question 533:

  While reviewing a vulnerability assessment, an analyst notices the following issue is identified in the report:

  

  To address this finding, which of the following would be most appropriate for the analyst to recommend to the network engineer?

  A. Reconfigure the device to support only connections leveraging TLSv1.2.
  B. Obtain a new self-signed certificate and select AES as the hashing algorithm.
  C. Replace the existing certificate with a certificate that uses only MDS for signing.
  D. Use only signed certificates with cryptographically secure certificate sources.
  D. Use only signed certificates with cryptographically secure certificate sources.

• Question 534:

  A company is aiming to test a new incident response plan. The management team has made it clear that the initial test should have no impact on the environment. The company has limited resources to support testing. Which of the following exercises would be the best approach?

  A. Tabletop scenarios
  B. Capture the flag
  C. Red team vs. blue team
  D. Unknown-environment penetration test
  A. Tabletop scenarios

  ---

  Explanation/Reference:

  A tabletop scenario is an informal, discussion-based session in which a team discusses their roles and responses during an emergency, walking through one or more example scenarios. A tabletop scenario is the best approach for a company that wants to test a new incident response plan without impacting the environment or using many resources. A tabletop scenario can help the company identify strengths and weaknesses in their plan, clarify roles and responsibilities, and improve communication and coordination among team members. The other options are more intensive and disruptive exercises that involve simulating a real incident or attack. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 16; https://www.linkedin.com/pulse/tabletop-exercises-explained-matt-lemon-phd

• Question 535:

  A security engineer has been asked to reduce the attack surface on an organization's production environment. To limit access, direct VPN access to all systems must be terminated, and users must utilize multifactor authentication to access a constrained VPN connection and then pivot to other production systems form a bastion host. The MOST appropriate way to implement the stated requirement is through the use of a:

  A. sinkhole.
  B. multitenant platform.
  C. single-tenant platform.
  D. jump box
  D. jump box

• Question 536:

  During a forensic investigation, a security analyst reviews some Session Initiation Protocol packets that came from a suspicious IP address. Law enforcement requires access to a VoIP call that originated from the suspicious IP address. Which of the following should the analyst use to accomplish this task?

  A. Wireshark
  B. iptables
  C. Tcpdump
  D. Netflow
  A. Wireshark

• Question 537:

  A security analyst is trying to determine if a host is active on a network. The analyst first attempts the following:

  

  The analyst runs the following command next:

  

  Which of the following would explain the difference in results?

  A. ICMP is being blocked by a firewall.
  B. The routing tables for ping and hping3 were different.
  C. The original ping command needed root permission to execute.
  D. hping3 is returning a false positive.
  A. ICMP is being blocked by a firewall.

• Question 538:

  A cybersecurity analyst is reviewing the current BYOD security posture. The users must be able to synchronize their calendars, email, and contacts to a smartphone or other personal device. The recommendation must provide the most flexibility to users. Which of the following recommendations would meet both the mobile data protection efforts and the business requirements described in this scenario?

  A. Develop a minimum security baseline while restricting the type of data that can be accessed.
  B. Implement a single computer configured with USB access and monitored by sensors.
  C. Deploy a kiosk for synchronizing while using an access list of approved users.
  D. Implement a wireless network configured for mobile device access and monitored by sensors.
  D. Implement a wireless network configured for mobile device access and monitored by sensors.

• Question 539:

  A company recently experienced a break-in whereby a number of hardware assets were stolen through unauthorized access at the back of the building. Which of the following would BEST prevent this type of theft from occurring in the future?

  A. Motion detection
  B. Perimeter fencing
  C. Monitored security cameras
  D. Badged entry
  A. Motion detection

• Question 540:

  A user received an invalid password response when trying to change the password. Which of the following policies could explain why the password is invalid?

  A. Access control policy
  B. Account management policy
  C. Password policy
  D. Data ownership policy
  C. Password policy