CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 831:

  As part of the senior leadership team's ongoing nsk management activities the Chief Information Security Officer has tasked a security analyst with coordinating the right training and testing methodology to respond to new business initiatives or significant changes to existing ones The management team wants to examine a new business process that would use existing infrastructure to process and store sensitive data.

  Which of the following would be appropnate for the security analyst to coordinate?

  A. A black-box penetration testing engagement
  B. A tabletop exercise
  C. Threat modeling
  D. A business impact analysis
  D. A business impact analysis

• Question 832:

  A reverse engineer was analyzing malware found on a retailer's network and found code extracting track data in memory. Which of the following threats did the engineer MOST likely uncover?

  A. POS malware
  B. Rootkit
  C. Key logger
  D. Ransomware
  A. POS malware

• Question 833:

  While observing several host machines, a security analyst notices a program is overwriting data to a buffer. Which of the following controls will best mitigate this issue?

  A. Data execution prevention
  B. Output encoding
  C. Prepared statements
  D. Parameterized queries
  A. Data execution prevention

• Question 834:

  A security analyst has a sample of malicious software and needs to know what the sample does? The analyst runs the sample in a carefully controlled and monitored virtual machine to observe the software behavior. Which of the following malware analysis approaches is this?

  A. White box testing
  B. Fuzzing
  C. Sandboxing
  D. Static code analysis
  C. Sandboxing

• Question 835:

  A developer is working on a program to convert user-generated input in a web form before it is displayed by the browser. This technique is referred to as:

  A. output encoding.
  B. data protection.
  C. query parameterization.
  D. input validation.
  A. output encoding.

• Question 836:

  A company's Chief Information Security Officer (CISO) published an Internet usage policy that prohibits employees from accessing unauthorized websites. The IT department whitelisted websites used for business needs. The CISO wants the security analyst to recommend a solution that would improve security and support employee morale. Which of the following security recommendations would allow employees to browse non-business-related websites?

  A. Implement a virtual machine alternative.
  B. Develop a new secured browser.
  C. Configure a personal business VLAN.
  D. Install kiosks throughout the building.
  C. Configure a personal business VLAN.

• Question 837:

  A cybersecurity analyst is conducting packet analysis on the following:

  

  Which of the following is occurring in the given packet capture?

  A. ARP spoofing
  B. Broadcast storm
  C. Smurf attack
  D. Network enumeration
  E. Zero-day exploit
  A. ARP spoofing

• Question 838:

  An analyst is working with a network engineer to resolve a vulnerability that was found in a piece of legacy hardware, which is critical to the operation of the organization's production line. The legacy hardware does not have third-party support, and the OEM manufacturer of the controller is no longer in operation. The analyst documents the activities and verifies these actions prevent remote exploitation of the vulnerability. Which of the following would be the MOST appropriate to remediate the controller?

  A. Segment the network to constrain access to administrative interfaces.
  B. Replace the equipment that has third-party support.
  C. Remove the legacy hardware from the network.
  D. Install an IDS on the network between the switch and the legacy equipment.
  A. Segment the network to constrain access to administrative interfaces.

• Question 839:

  A security analyst observes a large amount of scanning activity coming from an IP address outside the organization's environment. Which of the following should the analyst do to block this activity?

  A. Create an IPS rule to block the subnet.
  B. Sinkhole the IP address.
  C. Create a firewall rule to block the IP address.
  D. Close all unnecessary open ports.
  C. Create a firewall rule to block the IP address.

• Question 840:

  Which of the following commands would a security analyst use to make a copy of an image for forensics use?

  A. dd
  B. wget
  C. touch
  D. rm
  A. dd