CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 791:

  The Chief Executive Officer (CEO) instructed the new Chief Information Security Officer (CISO) to provide a list of enhancement to the company's cybersecurity operation. As a result, the CISO has identified the need to align security operations with industry best practices. Which of the following industry references is appropriate to accomplish this?

  A. OSSIM
  B. NIST
  C. PCI
  D. OWASP
  B. NIST

  ---

  Explanation/Reference:

  Reference: https://www.nist.gov/sites/default/files/documents/itl/Cybersecurity_Green-Paper_FinalVersion.pdf

• Question 792:

  The business has been informed of a suspected breach of customer data. The internal audit team, in conjunction with the legal department, has begun working with the cybersecurity team to validate the report. To which of the following response processes should the business adhere during the investigation?

  A. The security analysts should not respond to internal audit requests during an active investigation
  B. The security analysts should report the suspected breach to regulators when an incident occurs
  C. The security analysts should interview system operators and report their findings to the internal auditors
  D. The security analysts should limit communication to trusted parties conducting the investigation
  D. The security analysts should limit communication to trusted parties conducting the investigation

• Question 793:

  A security analyst receives a CVE bulletin, which lists several products that are used in the enterprise. The analyst immediately deploys a critical security patch. Which of the following BEST describes the reason for the analyst's immediate action?

  A. Nation-state hackers are targeting the region.
  B. A new vulnerability was discovered by a vendor.
  C. A known exploit was discovered.
  D. A new zero-day threat needs to be addressed.
  E. There is an insider threat.
  C. A known exploit was discovered.

• Question 794:

  A cybersecurity analyst was hired to resolve a security issue within a company after it was reported that many employee account passwords had been compromised. Upon investigating the incident, the cybersecurity analyst found that a brute

  force attack was launched against the company.

  Which of the following remediation actions should the cybersecurity analyst recommend to senior management to address these security issues?

  A. Prohibit password reuse using a GPO.
  B. Deploy multifactor authentication.
  C. Require security awareness training.
  D. Implement DLP solution.
  B. Deploy multifactor authentication.

• Question 795:

  A security analyst needs to identify possible threats to a complex system a client is developing. Which of the following methodologies would BEST address this task?

  A. Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privileges (STRIDE)
  B. Software Assurance Maturity Model (SAMM)
  C. Open Web Application Security Project (OWASP)
  D. Open Source Security Information Management (OSSIM)
  C. Open Web Application Security Project (OWASP)

• Question 796:

  SIMULATION

  Part1-AppServ1

  You are a cybersecurity analyst tasked with interpreting scan data from Company A's servers. You must verify the requirements are being met for all of the servers and recommend changes if you find they are not. The company's hardening guidelines indicate the following:

  1. TLS 1.2 is the only version of TLS running.

  2. Apache 2.4.18 or greater should be used.

  3. Only default ports should be used.

  INSTRUCTIONS

  Using the supplied data, record the status of compliance with the company's guidelines for each server.

  The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for issues based ONLY on the hardening guidelines provided.

  

  Hot Area:

  

  

  ---

  Explanation/Reference:

  AppServ1 is using TLS.1.2 and Apache 2.4.18 or greater (check 2 boxes)

• Question 797:

  A security analyst is researching an incident and uncovers several details that may link to other incidents. The security analyst wants to determine if other incidents are related to the current incident

  Which of the following threat research methodologies would be MOST appropriate for the analyst to use?

  A. Reputation data
  B. CVSS score
  C. Risk assessment
  D. Behavioral analysis
  D. Behavioral analysis

• Question 798:

  A SIEM solution alerts a security analyst of a high number of login attempts against the company's webmail portal. The analyst determines the login attempts used credentials from a past data breach. Which of the following is the BEST mitigation to prevent unauthorized access?

  A. Single sign-on
  B. Mandatory access control
  C. Multifactor authentication
  D. Federation
  E. Privileged access management
  C. Multifactor authentication

• Question 799:

  A company decides to move three of its business applications to different outsourced cloud providers. After moving the applications, the users report the applications time out too quickly and too much time is spent logging back into the different web-based applications throughout the day. Which of the following should a security architect recommend to improve the end-user experience without lowering the security posture?

  A. Configure directory services with a federation provider to manage accounts.
  B. Create a group policy to extend the default system lockout period.
  C. Configure a web browser to cache the user credentials.
  D. Configure user accounts for self-service account management.
  B. Create a group policy to extend the default system lockout period.

• Question 800:

  During a recent breach, an attacker was able to use tcpdump on a compromised Linux server to capture the password of a network administrator that logged into a switch using telnet.

  Which of the following compensating controls could be implemented to address this going forward?

  A. Whitelist tcpdump of Linux servers.
  B. Change the network administrator password to a more complex one.
  C. Implement separation of duties.
  D. Require SSH on network devices.
  D. Require SSH on network devices.