CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 671:

  An analyst is reviewing email headers to determine if an email has been sent from a legitimate sender. The organization uses SPF to validate email origination. Which of the following most likely indicates an invalid originator?

  A. Received-SPF: neutral
  B. Received-SPF: none
  C. Received-SPF: softfail
  D. Received-SPF: error
  C. Received-SPF: softfail

  ---

  Explanation/Reference:

  An SPF soft fail is a status result that means that the senders IP address is probably not authorized

• Question 672:

  An organization recently discovered that spreadsheet files containing sensitive financial data were improperly stored on a web server. The management team wants to find out if any of these files were downloaded by public users accessing the server. The results should be written to a text file and should include the date, time, and IP address associated with any spreadsheet downloads. The web server's log file is named webserver.log, and the report file name should be accessreport.txt. Following is a sample of the web server's log file:

  2017-10-12 21:01:12 GET /index.html - 84.102.33.7 - return=200 1622

  Which of the following commands should be run if an analyst only wants to include entries in which a spreadsheet was successfully downloaded?

  A. more webserver.log | grep *.xls > accessreport.txt
  B. more webserver.log > grep "*xls" | egrep -E `success' > accessreport.txt
  C. more webserver.log | grep -E "return=200 | xls" > accessreport.txt
  D. more webserver.log | grep -A *.xls < accessreport.txt
  C. more webserver.log | grep -E "return=200 | xls" > accessreport.txt

• Question 673:

  Which of the following software assessment methods world peak times?

  A. Security regression testing
  B. Stress testing
  C. Static analysis testing
  D. Dynamic analysis testing
  E. User acceptance testing
  B. Stress testing

  ---

  Explanation/Reference:

  Stress testing is a software assessment method that tests how an application performs under peak times or extreme workloads. Stress testing can help to identify any performance issues, bottlenecks, errors or crashes that may occur when an application faces high demand or concurrent users. Stress testing can also help to determine the maximum capacity and scalability of an application . Reference: https://www.techopedia.com/definition/10339/memory-dump

• Question 674:

  An analyst is examining a system that is suspected of being involved in an intrusion. The analyst uses the command `cat/etc/passwd' and receives the following partial output:

  

  Based on the above output, which of the following should the analyst investigate further?

  A. User `daemon' should not have a home directory of /usr/sbin
  B. User `root' should not have a home directory of /root
  C. User `news' should not have a default shell of /bin/bash
  D. User `mail' should not have a default shell of /usr/sbin/nologin
  C. User `news' should not have a default shell of /bin/bash

• Question 675:

  Which of the following describes the difference between intentional and unintentional insider threats'?

  A. Their access levels will be different
  B. The risk factor will be the same
  C. Their behavior will be different
  D. The rate of occurrence will be the same
  C. Their behavior will be different

  ---

  Explanation/Reference:

  The difference between intentional and unintentional insider threats is their behavior. Intentional insider threats are malicious actors who deliberately misuse their access to harm the organization or its assets. Unintentional insider threats are careless or negligent users who accidentally compromise the security of the organization or its assets. Their access levels, risk factors, and rates of occurrence may vary depending on various factors, but their behavior is the main distinction. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 12; https://www.cisa.gov/sites/default/files/publications/Insider_Threat_Mitigation_Guide_508.pdf

• Question 676:

  Which of the following will allow different cloud instances to share various types of data with a minimal amount of complexity?

  A. Reverse engineering
  B. Application log collectors
  C. Workflow orchestration
  D. API integration
  E. Scripting
  D. API integration

• Question 677:

  An analyst is troubleshooting a PC that is experiencing high processor and memory consumption. Investigation reveals the following processes are running on the system:

  lsass.exe csrss.exe wordpad.exe notepad.exe

  Which of the following tools should the analyst utilize to determine the rogue process?

  A. Ping 127.0.0.1.
  B. Use grep to search.
  C. Use Netstat.
  D. Use Nessus.
  C. Use Netstat.

• Question 678:

  Which of the following provides an automated approach to checking a system configuration?

  A. SCAP
  B. CI/CD
  C. OVAL
  D. Scripting
  E. SOAR
  A. SCAP

  ---

  Explanation/Reference:

  SCAP (Security Content Automation Protocol) is a standardized language for expressing and manipulating security data, including system configuration information. It provides a systematic, automated approach to checking a system configuration, making it easier to assess the security of a system and identify vulnerabilities. SCAP enables organizations to automate the process of security configuration management and assessment, reducing the risk of security breaches and ensuring that systems are configured securely. By using SCAP, organizations can improve their overall security posture, as well as comply with various regulations and industry standards.

• Question 679:

  An organization has the following policy statements:

  1.

  AlI emails entering or leaving the organization will be subject to inspection for malware, policy violations, and unauthorized coolant.

  2.

  AM network activity will be logged and monitored.

  3.

  Confidential data will be tagged and tracked

  4.

  Confidential data must never be transmitted in an unencrypted form. Confidential data must never be stored on an unencrypted mobile device.

  Which of the following is the organization enforcing?

  A. Acceptable use policy
  B. Data privacy policy
  C. Encryption policy
  D. Data management, policy
  D. Data management, policy

• Question 680:

  Forming a hypothesis, looking for indicators of compromise, and using the findings to proactively improve detection capabilities are examples of the value of:

  A. vulnerability scanning.
  B. threat hunting.
  C. red learning.
  D. penetration testing.
  B. threat hunting.