CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 711:

  A technician receives the following security alert from the firewall's automated system:

  

  After reviewing the alert, which of the following is the BEST analysis?

  A. This alert is a false positive because DNS is a normal network function.
  B. This alert indicates a user was attempting to bypass security measures using dynamic DNS.
  C. This alert was generated by the SIEM because the user attempted too many invalid login attempts.
  D. This alert indicates an endpoint may be infected and is potentially contacting a suspect host.
  D. This alert indicates an endpoint may be infected and is potentially contacting a suspect host.

• Question 712:

  A consumer credit card database was compromised, and multiple representatives are unable to review the appropriate customer information. Which of the following should the cybersecurity analyst do first?

  A. Start the containment effort.
  B. Confirm the incident.
  C. Notify local law enforcement officials.
  D. Inform the senior management team.
  B. Confirm the incident.

• Question 713:

  A security analyst working in the SOC recently discovered Balances m which hosts visited a specific set of domains and IPs and became infected with malware. Which of the following is the MOST appropriate action to take in the situation?

  A. implement an IPS signature for the malware and update the blacklisting for the associated domains and IPs
  B. Implement an IPS signature for the malware and another signature request to Nock all the associated domains and IPs
  C. Implement a change request to the firewall setting to not allow traffic to and from the IPs and domains
  D. Implement an IPS signature for the malware and a change request to the firewall setting to not allow traffic to and from the IPs and domains
  A. implement an IPS signature for the malware and update the blacklisting for the associated domains and IPs

• Question 714:

  When reviewing the system logs, the cybersecurity analyst noticed a suspicious log entry:

  wmic /node: HRDepartment1 computersystem get username

  Which of the following combinations describes what occurred, and what action should be taken in this situation?

  A. A rogue user has queried for users logged in remotely. Disable local access to network shares.
  B. A rogue user has queried for the administrator logged into the system. Attempt to determine who executed the command.
  C. A rogue user has queried for the administrator logged into the system. Disable local access to use cmd prompt.
  D. A rogue user has queried for users logged into in remotely. Attempt to determine who executed the command.
  D. A rogue user has queried for users logged into in remotely. Attempt to determine who executed the command.

• Question 715:

  A security analyst is reviewing the following log entries to identify anomalous activity:

  

  Which of the following attack types is occurring?

  A. Directory traversal
  B. SQL injection
  C. Buffer overflow
  D. Cross-site scripting
  A. Directory traversal

• Question 716:

  A cybersecurity analyst has several SIEM event logs to review for possible APT activity. The analyst was given several items that include lists of indicators for both IP addresses and domains. Which of the following actions is the BEST approach for the analyst to perform?

  A. Use the IP addresses to search through the event logs.
  B. Analyze the trends of the events while manually reviewing to see if any of the indicators match.
  C. Create an advanced query that includes all of the indicators, and review any of the matches.
  D. Scan for vulnerabilities with exploits known to have been used by an APT.
  B. Analyze the trends of the events while manually reviewing to see if any of the indicators match.

• Question 717:

  An analyst needs to provide recommendations based on a recent vulnerability scan:

  

  Which of the following should the analyst recommend addressing to ensure potential vulnerabilities are identified?

  A. SMB use domain SID to enumerate users
  B. SYN scanner
  C. SSL certificate cannot be trusted
  D. Scan not performed with admin privileges
  D. Scan not performed with admin privileges

  ---

  Explanation/Reference:

  Basically unauthorised scan, which means a higher chance of malware

• Question 718:

  A company's application development has been outsourced to a third-party development team. Based on the SLA. The development team must follow industry best practices for secure coding. Which of the following is the BEST way to verify this agreement?

  A. Input validation
  B. Security regression testing
  C. Application fuzzing
  D. User acceptance testing
  E. Stress testing
  C. Application fuzzing

  ---

  Explanation/Reference:

  Fuzzing or fuzz testing is a dynamic application security testing technique for negative testing. Fuzzing aims to detect known, unknown, and zero-day vulnerabilities https://brightsec.com/blog/fuzzing/

• Question 719:

  Employees at a manufacturing plant have been victims of spear phishing, but security solutions prevented further intrusions into the network. Which of the following is the MOST appropriate solution in this scenario?

  A. Continue to monitor security devices
  B. Update antivirus and malware definitions
  C. Provide security awareness training
  D. Migrate email services to a hosted environment
  C. Provide security awareness training

• Question 720:

  HOTSPOT

  A security analyst suspects that a workstation may be beaconing to a command and control server. You must inspect the logs from the company's web proxy server and the firewall to determine the best course of action to take in order to

  neutralize the threat with minimum impact to the organization.

  Instructions:

  If at any time you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the

  Next button to continue.

  Hot Area:

  

  

  ---

  Explanation/Reference: