CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 651:

  A cybersecurity analyst traced the source of an attack to compromised user credentials. Log analysis revealed that the attacker successfully authenticated from an unauthorized foreign country. Management asked the security analyst to research and implement a solution to help mitigate attacks based on compromised passwords. Which of the following should the analyst implement?

  A. Self-service password reset
  B. Single sign-on
  C. Context-based authentication
  D. Password complexity
  C. Context-based authentication

• Question 652:

  A cybersecurity analyst is currently auditing a new Active Directory server for compliance. The analyst uses Nessus to do the initial scan, and Nessus reports the following:

  

  Which of the following critical vulnerabilities has the analyst discovered?

  A. Known backdoor
  B. Zero-day
  C. Path disclosure
  D. User enumeration
  A. Known backdoor

• Question 653:

  The Chief Information Security Officer (CISO) has asked the security analyst to examine abnormally high processor utilization on a key server. The output below is from the company's research and development (RandD) server.

  

  Which of the following actions should the security analyst take FIRST?

  A. Initiate an investigation
  B. Isolate the RandD server
  C. Reimage the server
  D. Determine availability
  B. Isolate the RandD server

• Question 654:

  A cyber-incident response analyst is investigating a suspected cryptocurrency miner on a company's server. Which of the following is the FIRST step the analyst should take?

  A. Create a full disk image of the server's hard drive to look for the file containing the malware.
  B. Run a manual antivirus scan on the machine to look for known malicious software.
  C. Take a memory snapshot of the machine to capture volatile information stored in memory.
  D. Start packet capturing to look for traffic that could be indicative of command and control from the miner.
  D. Start packet capturing to look for traffic that could be indicative of command and control from the miner.

• Question 655:

  An analyst received an alert regarding an application spawning a suspicious command shell process. Upon further investigation, the analyst observes the following registry change occurring immediately after the suspicious event:

  

  Which of the following was the suspicious event able to accomplish?

  A. Impair defenses.
  B. Establish persistence.
  C. Bypass file access controls.
  D. Implement beaconing.
  A. Impair defenses.

• Question 656:

  Data spillage occurred when an employee accidentally emailed a sensitive file to an external recipient. Which of the following controls would have MOST likely prevented this incident?

  A. SSO
  B. DLP
  C. WAF
  D. VDI
  B. DLP

  ---

  Explanation/Reference:

  Reference: https://greenlightcorp.com/blog/cyber-security-solutions-data-spillage-and-how-to-create-an- after-incident-to-do-list/

• Question 657:

  As part of a review of modern response plans, which of the following is MOST important for an organization lo understand when establishing the breach notification period?

  A. Organizational policies
  B. Vendor requirements and contracts
  C. Service-level agreements
  D. Legal requirements
  D. Legal requirements

• Question 658:

  A threat intelligence analyst who works for a technology firm received this report from a vendor.

  "There has been an intellectual property theft campaign executed against organizations in the technology industry. Indicators for this activity are unique to each intrusion. The information that appears to be targeted is RandD data. The data exfiltration appears to occur over months via uniform TTPs. Please execute a defensive operation regarding this attack vector."

  Which of the following combinations suggests how the threat should MOST likely be classified and the type of analysis that would be MOST helpful in protecting against this activity?

  A. Polymorphic malware and secure code analysis
  B. Insider threat and indicator analysis
  C. APT and behavioral analysis
  D. Ransomware and encryption
  C. APT and behavioral analysis

• Question 659:

  A security analyst is investigating a compromised Linux server. The analyst issues the ps command and receives the following output.

  

  Which of the following commands should the administrator run NEXT to further analyze the compromised system?

  A. strace /proc/1301
  B. rpm -V openash-server
  C. /bin/la -1 /proc/1301/exe
  D. kill -9 1301
  C. /bin/la -1 /proc/1301/exe

• Question 660:

  Following a recent security breach, a company decides to investigate account usage to ensure privileged accounts are only being utilized during typical business hours. During the investigation, a security analyst determines an account was consistently utilized in the middle of the night.

  Which of the following actions should the analyst take NEXT?

  A. Disable the privileged account.
  B. Initiate the incident response plan.
  C. Report the discrepancy to human resources.
  D. Review the activity with the user.
  D. Review the activity with the user.