CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 691:

  A cybersecurity analyst is reading a daily intelligence digest of new vulnerabilities The type of vulnerability that should be disseminated FIRST is one that:

  A. enables remote code execution that is being exploited in the wild.
  B. enables data leakage but is not known to be m the environment
  C. enables lateral movement and was reported as a proof of concept
  D. affected the organization in the past but was probably contained and eradicated
  A. enables remote code execution that is being exploited in the wild.

• Question 692:

  During a routine network scan, a security administrator discovered an unidentified service running on a new embedded and unmanaged HVAC controller, which is used to monitor the company's datacenter:

  

  The enterprise monitoring service requires SNMP and SNMPTRAP connectivity to operate. Which of the following should the security administrator implement to harden the system?

  A. Patch and restart the unknown service.
  B. Segment and firewall the controller's network.
  C. Disable the unidentified service on the controller.
  D. Implement SNMPv3 to secure communication.
  E. Disable TCP/UDP ports 161 through 163.
  A. Patch and restart the unknown service.

• Question 693:

  A security analyst discovers a network intrusion and quickly solves the problem by closing an unused port. Which of the following should be completed?

  A. Vulnerability report
  B. Memorandum of agreement
  C. Reverse-engineering incident report
  D. Lessons learned report
  D. Lessons learned report

• Question 694:

  Due to new regulations, a company has decided to institute an organizational vulnerability management program and assign the function to the security team. Which of the following frameworks would BEST support the program? (Choose two.)

  A. COBIT
  B. NIST
  C. ISO 27000 series
  D. ITIL
  E. COSO
  B. NIST
  D. ITIL

• Question 695:

  Members of the sales team are using email to send sensitive client lists with contact information to their personal accounts The company's AUP and code of conduct prohibits this practice. Which of the following configuration changes would improve security and help prevent this from occurring?

  A. Configure the DLP transport rules to provide deep content analysis.
  B. Put employees' personal email accounts on the mail server on a blocklist.
  C. Set up IPS to scan for outbound emails containing names and contact information.
  D. Use Group Policy to prevent users from copying and pasting information into emails.
  E. Move outbound emails containing names and contact information to a sandbox for further examination.
  A. Configure the DLP transport rules to provide deep content analysis.

  ---

  Explanation/Reference:

  Data loss prevention (DLP) is a set of policies and tools that aim to prevent unauthorized disclosure of sensitive data. DLP transport rules are rules that apply to email messages that are sent or received by an organization's mail server. These rules can provide deep content analysis, which means they can scan the content of email messages and attachments for sensitive data patterns, such as client lists or contact information. If a rule detects a violation of the DLP policy, it can take actions such as blocking, quarantining, or notifying the sender or recipient. This would improve security and help prevent sales team members from sending sensitive client lists to their personal accounts. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 14; https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/data-loss-prevention

• Question 696:

  Which of the following, BEST explains the function of TPM?

  A. To provide hardware-based security features using unique keys
  B. To ensure platform confidentiality by storing security measurements
  C. To improve management of the OS installation.
  D. To implement encryption algorithms for hard drives
  A. To provide hardware-based security features using unique keys

• Question 697:

  While planning segmentation for an ICS environment, a security engineer determines IT resources will need access to devices within the ICS environment without compromising security.

  To provide the MOST secure access model in this scenario, the jumpbox should be __________.

  A. placed in an isolated network segment, authenticated on the IT side, and forwarded into the ICS network.
  B. placed on the ICS network with a static firewall rule that allows IT network resources to authenticate.
  C. bridged between the IT and operational technology networks to allow authenticated access.
  D. placed on the IT side of the network, authenticated, and tunneled into the ICS environment.
  A. placed in an isolated network segment, authenticated on the IT side, and forwarded into the ICS network.

• Question 698:

  During a red team engagement, a penetration tester found a production server. Which of the following portions of the SOW should be referenced to see if the server should be part of the testing engagement?

  A. Authorization
  B. Exploitation
  C. Communication
  D. Scope
  D. Scope

• Question 699:

  A company offers a hardware security appliance to customers that provides remote administration of a device on the customer's network. Customers are not authorized to alter the configuration. The company deployed a software process to manage unauthorized changes to the appliance, log them, and forward them to a central repository for evaluation.

  Which of the following processes is the company using to ensure the appliance is not altered from its original configured state?

  A. CI/CD
  B. Software assurance
  C. Anti-tamper
  D. Change management
  D. Change management

  ---

  Explanation/Reference:

  change management - process through which changes to the configuration of information systems are monitored and controlled. Each individual component should have a separate document or database record that describes its initial state and subsequent changes

• Question 700:

  A zero-day crypto-worm is quickly spreading through the internal network on port 25 and exploiting a software vulnerability found within the email servers.

  Which of the following countermeasures needs to be implemented as soon as possible to mitigate the worm from continuing to spread?

  A. Implement a traffic sinkhole.
  B. Block all known port/services.
  C. Isolate impacted servers.
  D. Patch affected systems.
  C. Isolate impacted servers.