CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 601:

  A vulnerability scan came back with critical findings for a Microsoft SharePoint server:

  

  Which of the following actions should be taken?

  A. Remove Microsoft Office from the server.
  B. Document the finding as an exception.
  C. Install a newer version of Microsoft Office on the server.
  D. Patch Microsoft Office on the server.
  D. Patch Microsoft Office on the server.

• Question 602:

  An organization developed a comprehensive modern response policy Executive management approved the policy and its associated procedures. Which of the following activities would be MOST beneficial to evaluate personnel's familiarity with incident response procedures?

  A. A simulated breach scenario evolving the incident response team
  B. Completion of annual information security awareness training by ail employees
  C. Tabtetop activities involving business continuity team members
  D. Completion of lessons-learned documentation by the computer security incident response team
  E. External and internal penetration testing by a third party
  A. A simulated breach scenario evolving the incident response team

• Question 603:

  A cybersecurity analyst is dissecting an intrusion down to the specific techniques and wants to organize them in a logical manner. Which of the following frameworks would BEST apply in this situation?

  A. Pyramid of Pain
  B. MITRE ATTandCK
  C. Diamond Model of Intrusion Analysis
  D. CVSS v3.0
  B. MITRE ATTandCK

• Question 604:

  A cybersecurity analyst is responding to an incident. The company's leadership team wants to attribute the incident to an attack group. Which of the following models would BEST apply to the situation?

  A. Intelligence cycle
  B. Diamond Model of Intrusion Analysis
  C. Kill chain
  D. MITRE ATTandCK
  B. Diamond Model of Intrusion Analysis

• Question 605:

  An organization wants to remediate vulnerabilities associated with its web servers. An initial vulnerability scan has been performed, and analysts are reviewing the results. Before starting any remediation, the analysts want to remove false positives to avoid spending time on issues that are not actual vulnerabilities. Which of the following would be an indicator of a likely false positive?

  A. Reports show the scanner compliance plug-in is out-of-date.
  B. Any items labeled `low' are considered informational only.
  C. The scan result version is different from the automated asset inventory.
  D. `HTTPS' entries indicate the web page is encrypted securely.
  B. Any items labeled `low' are considered informational only.

• Question 606:

  A malicious user is reviewing the following output:

  root:~#ping 192.168.1.137 64 bytes from 192.168.2.1 icmp_seq=1 ttl=63 time=1.58 ms 64 bytes from 192.168.2.1 icmp_seq=2 ttl=63 time=1.45 ms root: ~#

  Based on the above output, which of the following is the device between the malicious user and the target?

  A. Proxy
  B. Access point
  C. Switch
  D. Hub
  A. Proxy

• Question 607:

  A security analyst is investigating a system compromise. The analyst verities the system was up to date on OS patches at the time of the compromise. Which of the following describes the type of vulnerability that was MOST likely expiated?

  A. Insider threat
  B. Buffer overflow
  C. Advanced persistent threat
  D. Zero day
  D. Zero day

• Question 608:

  A security analyst inspects the header of an email that is presumed to be malicious and sees the following:

  

  Which of the following is inconsistent with the rest of the header and should be treated as suspicious?

  A. The subject line
  B. The sender's email address
  C. The destination email server
  D. The use of a TLS cipher
  B. The sender's email address

• Question 609:

  An employee was found to have performed fraudulent activities. The employee was dismissed, and the employee's laptop was sent to the IT service desk to undergo a data sanitization procedure. However, the security analyst responsible for the investigation wants to avoid data sanitization. Which of the following can the security analyst use to justify the request?

  A. Data retention
  B. Evidence retention
  C. GDPR
  D. Data correlation procedure
  B. Evidence retention

• Question 610:

  During a physical penetration test at a client site, a local law enforcement officer stumbled upon the test questioned the legitimacy of the team. Which of the following information should be shown to the officer?

  A. Letter of engagement
  B. Scope of work
  C. Timing information
  D. Team reporting
  A. Letter of engagement