CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 751:

  A security analyst needs to perform a search for connections with a suspicious IP on the network traffic. The company collects full packet captures at the Internet gateway and retains them for one week. Which of the following will enable the analyst to obtain the BEST results?

  A. tcpdump -n -r internet.pcap host
  B. strings internet.pcap | grep
  C. grep -a internet.pcap
  D. npcapd internet.pcap | grep
  A. tcpdump -n -r internet.pcap host

• Question 752:

  The Chief Information Officer (CIO) of a large healthcare institution is concerned about all machines having direct access to sensitive patient information. Which of the following should the security analyst implement to BEST mitigate the risk of sensitive data exposure?

  A. A cloud access service broker system
  B. NAC to ensure minimum standards are met
  C. MFA on all workstations
  D. Network segmentation
  D. Network segmentation

• Question 753:

  A software patch has been released to remove vulnerabilities from company's software. A security analyst has been tasked with testing the software to ensure the vulnerabilities have been remediated and the application is still functioning properly. Which of the following tests should be performed NEXT?

  A. Fuzzing
  B. User acceptance testing
  C. Regression testing
  D. Penetration testing
  C. Regression testing

  ---

  Explanation/Reference:

  Reference: https://en.wikipedia.org/wiki/Regression_testing

• Question 754:

  A security analyst discovers suspicious host activity while performing monitoring activities. The analyst pulls a packet capture for the activity and sees the following: Which of the following describes what has occurred?

  

  

  A. The host attempted to download an application from utoftor.com.
  B. The host downloaded an application from utoftor.com.
  C. The host attempted to make a secure connection to utoftor.com.
  D. The host rejected the connection from utoftor.com.
  B. The host downloaded an application from utoftor.com.

  ---

  Explanation/Reference:

  The server responded with an HTTP 200 OK status code, which means that the request was successful, and the server was able to process it. Connection close is only to close the connection after the transaction finishes

• Question 755:

  A security analyst at a technology solutions firm has uncovered the same vulnerabilities on a vulnerability scan for a long period of time. The vulnerabilities are on systems that are dedicated to the firm's largest client. Which of the following is MOST likely inhibiting the remediation efforts?

  A. The parties have an MOU between them that could prevent shutting down the systems
  B. There is a potential disruption of the vendor-client relationship
  C. Patches for the vulnerabilities have not been fully tested by the software vendor
  D. There is an SLA with the client that allows very little downtime
  D. There is an SLA with the client that allows very little downtime

• Question 756:

  A security analyst is conducting a vulnerability assessment of older SCADA devices on the corporate network. Which of the following compensating controls is likely to prevent the scans from providing value?

  A. Access control list network segmentation that prevents access to the SCADA devices inside the network.
  B. Detailed and tested firewall rules that effectively prevent outside access of the SCADA devices.
  C. Implementation of a VLAN that allows all devices on the network to see all SCADA devices on the network.
  D. SCADA systems configured with `SCADA SUPPORT'=ENABLE
  B. Detailed and tested firewall rules that effectively prevent outside access of the SCADA devices.

• Question 757:

  A security analyst needs to determine the best method for securing access to a top-secret datacenter Along with an access card and PIN code, which of the following additional authentication methods would be BEST to enhance the datacenter's security?

  A. Physical key
  B. Retinal scan
  C. Passphrase
  D. Fingerprint
  B. Retinal scan

• Question 758:

  While preparing for a third-party audit, the vice president of risk management and the vice president of information technology have stipulated that the vendor may not use offensive software during the audit. This is an example of:

  A. organizational control.
  B. service-level agreement.
  C. rules of engagement.
  D. risk appetite
  C. rules of engagement.

• Question 759:

  An analyst needs to provide a recommendation that will allow a custom-developed application to have full access to the system's processors and peripherals but still be contained securely from other applications that will be developed. Which of the following is the BEST technology for the analyst to recommend?

  A. Software-based drive encryption
  B. Trusted execution environment
  C. Unified Extensible Firmware Interface
  D. Hardware security module
  B. Trusted execution environment

• Question 760:

  A company experienced a security compromise due to the inappropriate disposal of one of its hardware appliances. Sensitive information stored on the hardware appliance was not removed prior to disposal.

  Which of the following is the BEST manner in which to dispose of the hardware appliance?

  A. Ensure the hardware appliance has the ability to encrypt the data before disposing of it.
  B. Dispose of all hardware appliances securely, thoroughly, and in compliance with company policies.
  C. Return the hardware appliance to the vendor, as the vendor is responsible for disposal.
  D. Establish guidelines for the handling of sensitive information.
  B. Dispose of all hardware appliances securely, thoroughly, and in compliance with company policies.