CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 611:

  Which of the following is a feature of virtualization that can potentially create a single point of failure?

  A. Server consolidation
  B. Load balancing hypervisors
  C. Faster server provisioning
  D. Running multiple OS instances
  A. Server consolidation

• Question 612:

  A security analyst needs to automate the incident response process for malware infections. When the following logs are generated, an alert email should automatically be sent within 30 minutes:

  

  Which of the following is the best way for the analyst to automate alert generation?

  A. Deploy a signature-based IDS
  B. Install a UEBA-capable antivirus
  C. Implement email protection with SPF
  D. Create a custom rule on a SIEM
  D. Create a custom rule on a SIEM

  ---

  Explanation/Reference:

  A security information and event management (SIEM) system is a tool that collects and analyzes log data from various sources and provides alerts and reports on security incidents and events. A security analyst can create a custom rule on a SIEM system to automate the incident response process for malware infections. For example, the analyst can create a rule that triggers an alert email when the SIEM system detects logs that match the criteria of malware infection, such as process name, file name, file hash, etc. The alert email can be sent within 30 minutes or any other desired time frame. The other options are not suitable or sufficient for this purpose. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 15; https://www.sans.org/reading-room/whitepapers/analyst/security-information-event- management-siem-implementation-33969

• Question 613:

  A security analyst discovers the following firewall log entries during an incident:

  

  Which of the following is MOST likely occurring?

  A. Banner grabbing
  B. Port scanning
  C. Beaconing
  D. Data exfiltration
  B. Port scanning

• Question 614:

  A cybersecurity analyst is dissecting an intrusion down to the specific techniques and wants to organize them in a logical manner. Which of the following frameworks would BEST apply in this situation?

  A. Pyramid of Pain
  B. MITRE ATTandCK
  C. Diamond Model of Intrusion Analysts
  D. CVSS v3.0
  B. MITRE ATTandCK

• Question 615:

  In response to an audit finding, a company's Chief information Officer (CIO) instructed the security department to Increase the security posture of the vulnerability management program. Currency, the company's vulnerability management program has the following attributes.

  Which of the following would BEST Increase the security posture of the vulnerably management program?

  A. Expand the ports Being scanned lo Include al ports increase the scan interval to a number the business win accept without causing service interruption. Enable authentication and perform credentialed scans
  B. Expand the ports being scanned to Include all ports. Keep the scan interval at its current level Enable authentication and perform credentialed scans.
  C. Expand the ports being scanned to Include at ports increase the scan interval to a number the business will accept without causing service Interruption. Continue unauthenticated scans.
  D. Continue scanning the well-known ports increase the scan interval to a number the business will accept without causing service Interruption. Enable authentication and perform credentialed scans.
  A. Expand the ports Being scanned lo Include al ports increase the scan interval to a number the business win accept without causing service interruption. Enable authentication and perform credentialed scans

• Question 616:

  A security analyst discovers the company's website is vulnerable to cross-site scripting. Which of the following solutions will BEST remedy the vulnerability?

  A. Prepared statements
  B. Server-side input validation
  C. Client-side input encoding
  D. Disabled JavaScript filtering
  B. Server-side input validation

  ---

  Explanation/Reference:

  The BEST solution to remedy the cross-site scripting vulnerability on the company's website is option B, server-side input validation.

  Server-side input validation involves checking user input on the server side to ensure that it meets expected criteria before it is processed or stored. This can prevent malicious code from being injected into the website and reduce the risk of cross-site scripting attacks.

• Question 617:

  An analyst must review a new cloud-based SIEM solution. Which of the following should the analyst do FIRST prior to discussing the company's needs?

  A. Perform a vulnerability scan against a test instance.
  B. Download the product security white paper.
  C. Check industry news feeds for product reviews.
  D. Ensure a current non-disclosure agreement is on file
  D. Ensure a current non-disclosure agreement is on file

• Question 618:

  A business-critical application is unable to support the requirements in the current password policy because it does not allow the use of special characters. Management does not want to accept the risk of a possible security incident due to weak password standards. Which of the following is an appropriate means to limit the risks related to the application?

  A. A compensating control
  B. Altering the password policy
  C. Creating new account management procedures
  D. Encrypting authentication traffic
  D. Encrypting authentication traffic

• Question 619:

  A cyber incident response team finds a vulnerability on a company website that allowed an attacker to inject malicious code into its web application. There have been numerous unsuspecting users visiting the infected page, and the malicious code executed on the victim's browser has led to stolen cookies, hijacked sessions, malware execution, and bypassed access control. Which of the following exploits is the attacker conducting on the company's website?

  A. Logic bomb
  B. Rootkit
  C. Privilege escalation
  D. Cross-site scripting
  D. Cross-site scripting

• Question 620:

  An analyst is responding 10 an incident involving an attack on a company-owned mobile device that was being used by an employee to collect data from clients in the held. Maiware was loaded on the device via the installation of a third-party software package The analyst has baselined the device.

  Which of the following should the analyst do to BEST mitigate future attacks?

  A. Implement MDM
  B. Update the maiware catalog
  C. Patch the mobile device's OS
  D. Block third-party applications
  A. Implement MDM