CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 761:

  Which of the following BEST describes why vulnerabilities found in ICS and SCADA can be difficult to remediate?

  A. ICS/SCADA systems are not supported by the CVE publications.
  B. ICS/SCADA systems rarely have full security functionality.
  C. ICS/SCADA systems do not allow remote connections.
  D. ICS/SCADA systems use encrypted traffic to communicate between devices.
  A. ICS/SCADA systems are not supported by the CVE publications.

• Question 762:

  In reviewing service desk requests, management has requested that the security analyst investigate the requests submitted by the new human resources manager. The requests consist of "unlocking" files that belonged to the previous human manager. The security analyst has uncovered a tool that is used to display five-level passwords. This tool is being used by several members of the service desk to unlock files. The content of these particular files is highly sensitive information pertaining to personnel. Which of the following BEST describes this scenario?

  A. Unauthorized data exfiltration
  B. Unauthorized data masking
  C. Unauthorized access
  D. Unauthorized software
  E. Unauthorized controls
  C. Unauthorized access

• Question 763:

  Legacy medical equipment, which contains sensitive data, cannot be patched. Which of the following is the BEST solution to improve the equipment's security posture?

  A. Move the legacy systems behind a WAF.
  B. Implement an air gap for the legacy systems.
  C. Place the legacy systems in the DMZ.
  D. Implement a VPN between the legacy systems and the local network.
  B. Implement an air gap for the legacy systems.

  ---

  Explanation/Reference:

  The best solution to improve the security posture of legacy medical equipment that contains sensitive data is to implement an air gap (Option B). An air gap is a security measure which involves physically separating a computer or network from other systems, networks, or the internet. This can provide an additional layer of security, as it would prevent the legacy equipment from being compromised by malicious actors. Additionally, it would allow the equipment to continue to function without needing to be patched, as it would be isolated from other systems and networks.

• Question 764:

  During a review of vulnerability scan results an analyst determines the results may be flawed because a control-baseline system which is used to evaluate a scanning tools effectiveness was reported as not vulnerable Consequently, the analyst verifies the scope of the scan included the control-baseline host which was available on the network during the scan. The use of a control- baseline endpoint in this scenario assists the analyst in confirming.

  A. verification of mitigation
  B. false positives
  C. false negatives
  D. the criticality index
  E. hardening validation.
  B. false positives

• Question 765:

  A small marketing firm uses many SaaS applications that hold sensitive information. The firm has discovered terminated employees are retaining access to systems for many weeks after their end date. Which of the following would BEST resolve the issue of lingering access?

  A. Perform weekly manual reviews on system access to uncover any issues.
  B. Set up a privileged access management tool that can fully manage privileged account access.
  C. Implement MFA on cloud-based systems.
  D. Configure federated authentication with SSO on cloud provider systems.
  B. Set up a privileged access management tool that can fully manage privileged account access.

• Question 766:

  Security awareness and compliance programs are most effective at reducing the likelihood and impact of attacks from:

  A. advanced persistent threats.
  B. corporate spies.
  C. hacktivists.
  D. insider threats.
  D. insider threats.

  ---

  Explanation/Reference:

  What types of controls address risks from unintentional insider threats?

  Training and awareness programs reduce the chance that insiders will generate risks from ignorance.

  Procedural controls help to mitigate risks from carelessness and inattention. The presence of elevated risk

  from inadvertent threat can be assessed by monitoring training adoption and effectiveness metrics.

• Question 767:

  An analyst is reviewing a list of vulnerabilities, which were reported from a recent vulnerability scan of a Linux server.

  Which of the following is MOST likely to be a false positive?

  A. OpenSSH/OpenSSL Package Random Number Generator Weakness
  B. Apache HTTP Server Byte Range DoS
  C. GDI+ Remote Code Execution Vulnerability (MS08-052)
  D. HTTP TRACE / TRACK Methods Allowed (002-1208)
  E. SSL Certificate Expiry
  C. GDI+ Remote Code Execution Vulnerability (MS08-052)

• Question 768:

  A security team identified some specific known tactics and techniques to help mitigate repeated credential access threats, such as account manipulation and brute forcing. Which of the following frameworks or models did the security team MOST likely use to identify the tactics and techniques?

  A. MITRE ATTandCK
  B. ITIL
  C. Kill chain
  D. Diamond Model of Intrusion Analysis
  A. MITRE ATTandCK

  ---

  Explanation/Reference:

  Reference: https://attack.mitre.org/techniques/T1110/

• Question 769:

  A company recently experienced financial fraud, which included shared passwords being compromised and improper levels of access being granted. The company has asked a security analyst to help improve its controls. Which of the following will MOST likely help the security analyst develop better controls?

  A. An evidence summarization
  B. An incident response plan
  C. A lessons-learned report
  D. An indicator of compromise
  C. A lessons-learned report

• Question 770:

  Organizational policies require vulnerability remediation on severity 7 or greater within one week. Anything with a severity less than 7 must be remediated within 30 days. The organization also requires security teams to investigate the details of a vulnerability before performing any remediation. If the investigation determines the finding is a false positive, no remediation is performed and the vulnerability scanner configuration is updates to omit the false positive from future scans:

  The organization has three Apache web servers:

  

  The results of a recent vulnerability scan are shown below:

  

  The team performs some investigation and finds a statement from Apache:

  

  Which of the following actions should the security team perform?

  A. Ignore the false positive on 192.168.1.22
  B. Remediate 192.168.1.20 within 30 days
  C. Remediate 192.168.1.22 within 30 days
  D. Investigate the false negative on 192.168.1.20
  C. Remediate 192.168.1.22 within 30 days