CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 821:

  A Chief Information Security Officer (CISO) is concerned the development team, which consists of contractors, has too much access to customer data Developers use personal workstations, giving the company little to no visibility into the

  development activities.

  Which of the following would be BEST to implement to alleviate the CISO's concern?

  A. DLP
  B. Encryption
  C. Test data
  D. NDA
  D. NDA

• Question 822:

  The Chief Executive Officer (CEO) of a large insurance company has reported phishing emails that contain malicious links are targeting the entire organization. Which of the following actions would work BEST to prevent against this type of attack?

  A. Turn on full behavioral analysis to avert an infection.
  B. Implement an EDR mail module that will rewrite and analyze email links.
  C. Reconfigure the EDR solution to perform real-time scanning of all files.
  D. Ensure EDR signatures are updated every day to avert infection.
  E. Modify the EDR solution to use heuristic analysis techniques for malware.
  B. Implement an EDR mail module that will rewrite and analyze email links.

• Question 823:

  A security analyst discovers a vulnerability on an unpatched web server that is used for testing machine learning on Bing Data sets. Exploitation of the vulnerability could cost the organization $1.5 million in lost productivity. The server is located on an isolated network segment that has a 5% chance of being compromised. Which of the following is the value of this risk?

  A. $75.000
  B. $300.000
  C. $1.425 million
  D. $1.5 million
  A. $75.000

• Question 824:

  Which of the following BEST describes what an organizations incident response plan should cover regarding how the organization handles public or private disclosures of an incident?

  A. The disclosure section should focus on how to reduce the likelihood customers will leave due to the incident.
  B. The disclosure section should contain the organization's legal and regulatory requirements regarding disclosures.
  C. The disclosure section should include the names and contact information of key employees who are needed for incident resolution
  D. The disclosure section should contain language explaining how the organization will reduce the likelihood of the incident from happening m the future.
  B. The disclosure section should contain the organization's legal and regulatory requirements regarding disclosures.

• Question 825:

  While reviewing proxy logs, the security analyst noticed a suspicious traffic pattern. Several internal hosts were observed communicating with an external IP address over port 80 constantly. An incident was declared, and an investigation was launched. After interviewing the affected users, the analyst determined the activity started right after deploying a new graphic design suite. Based on this information, which of the following actions would be the appropriate NEXT step in the investigation?

  A. Update all antivirus and anti-malware products, as well as all other host-based security software on the servers the affected users authenticate to.
  B. Perform a network scan and identify rogue devices that may be generating the observed traffic. Remove those devices from the network.
  C. Identify what the destination IP address is and who owns it, and look at running processes on the affected hosts to determine if the activity is malicious or not.
  D. Ask desktop support personnel to reimage all affected workstations and reinstall the graphic design suite. Run a virus scan to identify if any viruses are present.
  C. Identify what the destination IP address is and who owns it, and look at running processes on the affected hosts to determine if the activity is malicious or not.

• Question 826:

  A security analyst has been alerted to several emails that snow evidence an employee is planning malicious activities that involve employee Pll on the network before leaving the organization. The security analysis BEST response would be to coordinate with the legal department and:

  A. the public relations department
  B. senior leadership C. law enforcement
  D. the human resources department
  D. the human resources department

• Question 827:

  The development team recently moved a new application into production for the accounting department. After this occurred, the Chief Information Officer (CIO) was contacted by the head of accounting because the application is missing a key piece of functionality that is needed to complete the corporation's quarterly tax returns. Which of the following types of testing would help prevent this from reoccurring?

  A. Security regression testing
  B. User acceptance testing
  C. Input validation testing
  D. Static code testing
  B. User acceptance testing

• Question 828:

  During an audit several customer order forms were found to contain inconsistencies between the actual price of an item and the amount charged to the customer Further investigation narrowed the cause of the issue to manipulation of the public-facing web form used by customers to order products.

  Which of the following would be the BEST way to locate this issue?

  A. Reduce the session timeout threshold
  B. Deploy MFA for access to the web server
  C. Implement input validation
  D. Run a static code scan.
  D. Run a static code scan.

• Question 829:

  Which of the allowing is a best practice with regard to interacting with the media during an incident?

  A. Allow any senior management level personnel with knowledge of the incident to discuss it.
  B. Designate a single port of contact and at least one backup for contact with the media.
  C. Stipulate that incidents are not to be discussed with the media at any time during the incident.
  D. Release financial information on the impact of damages caused by the incident.
  B. Designate a single port of contact and at least one backup for contact with the media.

• Question 830:

  A security analyst has observed several incidents within an organization that are affecting one specific piece of hardware on the network. Further investigation reveals the equipment vendor previously released a patch.

  Which of the following is the MOST appropriate threat classification for these incidents?

  A. Known threat
  B. Zero day
  C. Unknown threat
  D. Advanced persistent threat
  D. Advanced persistent threat