CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 701:

  Given the following output from a Linux machine:

  file2cable eth0 -f file.pcap

  Which of the following BEST describes what a security analyst is trying to accomplish?

  A. The analyst is attempting to measure bandwidth utilization on interface eth0.
  B. The analyst is attempting to capture traffic on interface eth0.
  C. The analyst is attempting to replay captured data from a PCAP file.
  D. The analyst is attempting to capture traffic for a PCAP file.
  E. The analyst is attempting to use a protocol analyzer to monitor network traffic.
  E. The analyst is attempting to use a protocol analyzer to monitor network traffic.

• Question 702:

  A security analyst is scanning the network to determine if a critical security patch was applied to all systems in an enterprise. The organization has a very low tolerance for risk when it comes to resource availability. Which of the following is the BEST approach for configuring and scheduling the scan?

  A. Make sure the scan is credentialed, covers all hosts in the patch management system, and is scheduled during business hours so it can be terminated if it affects business operations.
  B. Make sure the scan is uncredentialed, covers all hosts in the patch management system, and is scheduled during off-business hours so it has the least impact on operations.
  C. Make sure the scan is credentialed, has the latest software and signature versions, covers all hosts in the patch management system, and is scheduled during off-business hours so it has the least impact on operations.
  D. Make sure the scan is credentialed, uses a limited plugin set, scans all host IP addresses in the enterprise, and is scheduled during off-business hours so it has the least impact on operations.
  D. Make sure the scan is credentialed, uses a limited plugin set, scans all host IP addresses in the enterprise, and is scheduled during off-business hours so it has the least impact on operations.

• Question 703:

  An organization has a policy that requires servers to be dedicated to one function and unneeded services to be disabled. Given the following output from an Nmap scan of a web server:

  

  Which of the following ports should be closed?

  A. 22
  B. 80
  C. 443
  D. 1433
  D. 1433

  ---

  Explanation/Reference:

  "servers to be dedicated to one function..." http/s and SQL are two functions. I will select D, but agree with folks that the question is horribly written, and the person who wrote it was most likely drunk.

• Question 704:

  A cybersecurity analyst is hired to review the security measures implemented within the domain controllers of a company. Upon review, the cybersecurity analyst notices a brute force attack can be launched against domain controllers that run on a Windows platform. The first remediation step implemented by the cybersecurity analyst is to make the account passwords more complex. Which of the following is the NEXT remediation step the cybersecurity analyst needs to implement?

  A. Disable the ability to store a LAN manager hash.
  B. Deploy a vulnerability scanner tool.
  C. Install a different antivirus software.
  D. Perform more frequent port scanning.
  E. Move administrator accounts to a new security group.
  E. Move administrator accounts to a new security group.

• Question 705:

  A technician receives a report that a user's workstation is experiencing no network connectivity. The technician investigates and notices the patch cable running the back of the user's VoIP phone is routed directly under the rolling chair and

  has been smashed flat over time.

  Which of the following is the most likely cause of this issue?

  A. Cross-talk
  B. Electromagnetic interference
  C. Excessive collisions
  D. Split pairs
  C. Excessive collisions

• Question 706:

  A security analyst is reviewing the following server statistics:

  

  Which of the following is MOST likely occurring?

  A. Race condition
  B. Privilege escalation
  C. Resource exhaustion
  D. VM escape
  C. Resource exhaustion

• Question 707:

  While reviewing firewall logs, a security analyst at a military contractor notices a sharp rise in activity from a foreign domain known to have well-funded groups that specifically target the company's RandD department. Historical data reveals other corporate assets were previously targeted. This evidence MOST likely describes:

  A. an APT.
  B. DNS harvesting.
  C. a zero-day exploit.
  D. corporate espionage.
  A. an APT.

• Question 708:

  A company was recently awarded several large government contracts and wants to determine its current risk from one specific APT. Which of the following threat modeling methodologies would be the MOST appropriate to use during this analysis?

  A. Attack vectors
  B. Adversary capability
  C. Diamond Model of Intrusion Analysis
  D. Kill chain
  E. Total attack surface
  B. Adversary capability

  ---

  Explanation/Reference:

  Reference: https://www.secureworks.com/blog/advanced-persistent-threats-apt-b

• Question 709:

  When investigating a compromised system, a security analyst finds the following script in the /tmp directory:

  

  Which of the following attacks is this script attempting, and how can it be mitigated?

  A. This is a password-hijacking attack, and it can be mitigated by using strong encryption protocols.
  B. This is a password-spraying attack, and it can be mitigated by using multifactor authentication.
  C. This is a password-dictionary attack, and it can be mitigated by forcing password changes every 30 days.
  D. This is a credential-stuffing attack, and it can be mitigated by using multistep authentication.
  B. This is a password-spraying attack, and it can be mitigated by using multifactor authentication.

  ---

  Explanation/Reference:

  https://owasp.org/www-community/attacks/Password_Spraying_Attack

  A credential stuffing attack would be using the full credentials and most likely being used across many common platforms. A credential stuffing attack depends on the reuse of passwords. With so many people reusing their passwords for multiple accounts, just one set of credentials is enough to expose most or all of their accounts.

• Question 710:

  A security analyst notices PII has been copied from the customer database to an anonymous FTP server in the DMZ. Firewall logs indicate the customer database has not been accessed from anonymous FTP server. Which of the following departments should make a decision about pursuing further investigation? (Choose two.)

  A. Human resources
  B. Public relations
  C. Legal
  D. Executive management
  E. IT management
  D. Executive management