CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 731:

  As part of a review of incident response plans, which of the following is MOST important for an organization to understand when establishing the breach notification period?

  A. Organizational policies
  B. Vendor requirements and contracts
  C. Service-level agreements
  D. Legal requirements
  D. Legal requirements

• Question 732:

  Which of the following is an advantage of SOAR over SIEM?

  A. SOAR is much less expensive.
  B. SOAR reduces the amount of human intervention required.
  C. SOAR can aggregate data from many sources.
  D. SOAR uses more robust encryption protocols.
  B. SOAR reduces the amount of human intervention required.

• Question 733:

  A security technician is testing a solution that will prevent outside entities from spoofing the company's email domain, which is comptia.org. The testing is successful, and the security technician is prepared to fully implement the solution. Which of the following actions should the technician take to accomplish this task?

  A. Add TXT @ "v=spf1 mx include:_spf.comptia.org -all" to the DNS record.
  B. Add TXT @ "v=spf1 mx include:_spf.comptia.org -all" to the email server.
  C. Add TXT @ "v=spf1 mx include:_spf.comptia.org +all" to the domain controller.
  D. Add TXT @ "v=spf1 mx include:_spf.comptia.org +all" to the web server.
  A. Add TXT @ "v=spf1 mx include:_spf.comptia.org -all" to the DNS record.

  ---

  Explanation/Reference:

  Reference: https://blog.finjan.com/email-spoofing/

• Question 734:

  A security analyst implemented a solution that would analyze the attacks that the organization's firewalls failed to prevent. The analyst used the existing systems to enact the solution and executed the following command:

  S sudo nc -1 -v -c maildemon . py 25 caplog, txt

  Which of the following solutions did the analyst implement?

  A. Log collector
  B. Crontab mail script
  C. Snikhole
  D. Honeypot
  A. Log collector

• Question 735:

  A security analyst reviews the latest reports from the company's vulnerability scanner and discovers the following: Which of the following changes should the analyst recommend FIRST?

  

  A. Configuring SSL ciphers to use different encryption blocks
  B. Programming changes to encode output
  C. Updating the 'mod_status' module
  D. Disabling HTTP connection debugging commands
  C. Updating the 'mod_status' module

• Question 736:

  A security is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS. Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise?

  A. Run an anti-malware scan on the system to detect and eradicate the current threat
  B. Start a network capture on the system to look into the DNS requests to validate command and control traffic
  C. Shut down the system to prevent further degradation of the company network
  D. Reimage the machine to remove the threat completely and get back to a normal running state
  E. Isolate the system on the network to ensure it cannot access other systems while evaluation is underway
  E. Isolate the system on the network to ensure it cannot access other systems while evaluation is underway

• Question 737:

  A code review reveals a web application is using time-based cookies for session management. This is a security concern because time-based cookies are easy to:

  A. parameterize.
  B. decode.
  C. guess.
  D. decrypt.
  B. decode.

• Question 738:

  A technician recently fixed a computer with several viruses and spyware programs on it and notices the Internet settings were set to redirect all traffic through an unknown proxy. This type of attack is known as which of the following?

  A. Phishing
  B. Social engineering
  C. Man-in-the-middle
  D. Shoulder surfing
  C. Man-in-the-middle

• Question 739:

  An incident response team detected malicious software that could have gained access to credit card data. The incident response team was able to mitigate significant damage and implement corrective actions. By having incident response mechanisms in place. Which of the following should be notified for lessons learned?

  A. The human resources department
  B. Customers
  C. Company leadership
  D. The legal team
  C. Company leadership

• Question 740:

  An organization is experiencing issues with emails that are being sent to external recipients. Incoming emails to the organization are working fine. A security analyst receives the following screenshot of an email error from the help desk:

  Mail delivery failed: Returning message to sender A message could not be delivered to one or more of its recipients SMTP Error from remote mail server after RCPT To: [email protected]

  The analyst then checks the email server and sees many of the following messages in the logs:

  Error 550 - Message rejected

  Which of the following is MOST likely the issue?

  A. SPF is failing.
  B. The DMARC queue is full.
  C. The DKIM private key has expired.
  D. Port 25 is not open.
  A. SPF is failing.

  ---

  Explanation/Reference:

  SPF (Sender Policy Framework) is a security measure that is used to prevent email spoofing. It works by comparing the sender's IP address to a list of authorized IP addresses that are published in the sender's DNS records. If the IP address does not match the authorized list, the receiving mail server will reject the message with an error 550.