CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 61:

  The Chief Information Security Officer (CISO) asks a security analyst to write a new SIEM search rule to determine if any credit card numbers are being written to log files. The CISO and security analyst suspect the following log snippet contains real customer card data:

  

  Which of the following expressions would find potential credit card numbers in a format that matches the log snippet?

  A. ^[0-9](16)$
  B. (0-9) x 16
  C. "1234-5678"
  D. "04*"
  A. ^[0-9](16)$

• Question 62:

  A security analyst responds to a series of events surrounding sporadic bandwidth consumption from an endpoint device. The security analyst then identifies the following additional details:

  1.

  Bursts of network utilization occur approximately every seven days.

  2.

  The content being transferred appears to be encrypted or obfuscated.

  3.

  A separate but persistent outbound TCP connection from the host to infrastructure in a third-party cloud is in place.

  4.

  The HDD utilization on the device grows by 10GB to 12GB over the course of every seven days.

  5.

  Single file sizes are 10GB.

  Which of the following describes the most likely cause of the issue?

  A. Memory consumption
  B. Non-standard port usage
  C. Data exfiltration
  D. System update
  E. Botnet participant
  C. Data exfiltration

  ---

  Explanation/Reference:

  data exfiltration is the unauthorized transfer of data from an organization's network to an external destination, usually for malicious purposes such as espionage, sabotage, or theft. The details given in the question suggest that data exfiltration is occurring from an endpoint device. The bursts of network utilization every seven days indicate periodic data transfers. The content being transferred appears to be encrypted or obfuscated to avoid detection or analysis. The persistent outbound TCP connection from the host to infrastructure in a third-party cloud indicates a possible command and control channel for an attacker. The HDD utilization on the device grows by 10GB to 12GB over the course of every seven days, and single file sizes are 10GB, indicating that large amounts of data are being collected and compressed before being exfiltrated.

• Question 63:

  A security analyst is assisting with a computer crime investigation and has been asked to secure a PC and deliver it to the forensic lab. Which of the following items would be MOST helpful to secure the PC? (Choose three.)

  A. Tamper-proof seals
  B. Faraday cage
  C. Chain of custody form
  D. Drive eraser
  E. Write blockers
  F. Network tap
  G. Multimeter
  A. Tamper-proof seals
  B. Faraday cage
  C. Chain of custody form

• Question 64:

  A business recently installed a kiosk that is running on a hardened operating system as a restricted user. The kiosk user application is the only application that is allowed to run. A security analyst gets a report that pricing data is being modified on the server, and management wants to know how this is happening. After reviewing the logs, the analyst discovers the root account from the kiosk is accessing the files. After validating the permissions on the server, the analyst confirms the permissions from the kiosk do not allow to write to the server data.

  Which of the following is the MOST likely reason for the pricing data modifications on the server?

  A. Data on the server is not encrypted, allowing users to change the pricing data.
  B. The kiosk user account has execute permissions on the server data files.
  C. Customers are logging off the kiosk and guessing the root account password.
  D. Customers are escaping the application shell and gaining root-level access.
  D. Customers are escaping the application shell and gaining root-level access.

• Question 65:

  The Chief Information Officer (CIO) of a large cloud software vendor reports that many employees are falling victim to phishing emails because they appear to come from other employees. Which of the following would BEST prevent this issue?

  A. Include digital signatures on messages originating within the company.
  B. Require users to authenticate to the SMTP server.
  C. Implement DKIM to perform authentication that will prevent this issue.
  D. Set up an email analysis solution that looks for known malicious links within the email.
  C. Implement DKIM to perform authentication that will prevent this issue.

  ---

  Explanation/Reference:

  Reference: https://www.sparkpost.com/resources/email-explained/dkim-domainkeys-identified-mail/

• Question 66:

  A software development company in the manufacturing sector has just completed the alpha version of its flagship application. The application has been under development for the past three years. The SOC has seen intrusion attempts made by indicators associated with a particular APT. The company has a hot site location for COOP. Which of the following threats would most likely incur the BIGGEST economic impact for the company?

  A. DDoS
  B. ICS destruction
  C. IP theft
  D. IPS evasion
  A. DDoS

• Question 67:

  A remote code-execution vulnerability was discovered in the RDP for the servers running a key-hosted application. While there is no automated check for this vulnerability from the vulnerability assessment vendor, the in-house technicians were able to evaluate manually whether this vulnerability was present through the use of custom scripts. This evaluation determined that all the hosts are vulnerable. A technician then tested the patch for this vulnerability and found that it can cause stability issues in the key-hosted application. The application is accessed through RDP to a jump host that does not run the application directly. To mitigate this vulnerability, the security operations team needs to provide remediation steps that will mitigate the vulnerability temporarily until the compatibility issues with the patch are resolved.

  Which of the following will BEST allow systems to continue to operate and mitigate the vulnerability in the short term?

  A. Implement IPSec rules on the application servers through a GPO that limits RDP access from only the jump host. Patch the jump host. Since it does not run the application natively, it will not affect the software's operation and functionality. Do not patch the application servers until the compatibility issue is resolved.
  B. Implement IPSec rules on the jump host server through a GPO that limits RDP access from only the other application servers. Do not patch the jump host. Since it does not run the application natively, it is at less risk of being compromised. Patch the application servers to secure them.
  C. Implement IPSec rules on the application servers through a GPO that limits RDP access to only other application servers. Do not patch the jump host. Since it does not run the application natively, it is at less risk of being compromised. Patch the application servers to secure them.
  D. Implement firewall rules on the application servers through a GPO that limits RDP access to only other application servers. Manually check the jump host to see if it has been compromised. Patch the application servers to secure them.
  A. Implement IPSec rules on the application servers through a GPO that limits RDP access from only the jump host. Patch the jump host. Since it does not run the application natively, it will not affect the software's operation and functionality. Do not patch the application servers until the compatibility issue is resolved.

• Question 68:

  A company invested ten percent of its entire annual budget in security technologies. The Chief Information Officer (CIO) is convinced that, without this investment, the company will risk being the next victim of the same cyber attack its competitor experienced three months ago. However, despite this investment, users are sharing their usernames and passwords with their coworkers to get their jobs done. Which of the following will eliminate the risk introduced by this practice?

  A. Invest in and implement a solution to ensure non-repudiation
  B. Force a daily password change
  C. Send an email asking users not to share their credentials
  D. Run a report on all users sharing their credentials and alert their managers of further actions
  C. Send an email asking users not to share their credentials

• Question 69:

  A company has decided to process credit card transactions directly. Which of the following would meet the requirements for scanning this type of data?

  A. Quarterly
  B. Yearly
  C. Bi-annually
  D. Monthly
  A. Quarterly

• Question 70:

  A security analyst is creating baseline system images to remediate vulnerabilities found in different operating systems. Each image needs to be scanned before it is deployed. The security analyst must ensure the configurations match industry standard benchmarks and the process can be repeated frequently. Which of the following vulnerability options would BEST create the process requirements?

  A. Utilizing an operating system SCAP plugin
  B. Utilizing an authorized credential scan
  C. Utilizing a non-credential scan
  D. Utilizing a known malware plugin
  A. Utilizing an operating system SCAP plugin