CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 851:

  A small organization has proprietary software that is used internally. The system has not been well maintained and cannot be updated with the rest of the environment. Which of the following is the BEST solution?

  A. Virtualize the system and decommission the physical machine.
  B. Remove it from the network and require air gapping.
  C. Implement privileged access management for identity access.
  D. Implement MFA on the specific system.
  B. Remove it from the network and require air gapping.

• Question 852:

  An organization wants to harden its web servers. As part of this goal, leadership has directed that vulnerability scans be performed, and the security team should remediate the servers according to industry best practices. The team has already chosen a vulnerability scanner and performed the necessary scans, and now the team needs to prioritize the fixes. Which of the following would help to prioritize the vulnerabilities for remediation in accordance with industry best practices?

  A. CVSS
  B. SLA
  C. ITIL
  D. OpenVAS
  E. Qualys
  A. CVSS

• Question 853:

  The security operations team is conducting a mock forensics investigation. Which of the following should be the FIRST action taken after seizing a compromised workstation?

  A. Activate the escalation checklist
  B. Implement the incident response plan
  C. Analyze the forensic image
  D. Perform evidence acquisition
  D. Perform evidence acquisition

  ---

  Explanation/Reference:

  Reference: https://staff.washington.edu/dittrich/misc/forensics/

• Question 854:

  After an incident involving a phishing email, a security analyst reviews the following email access log:

  

  Based on this information, which of the following accounts was MOST likely compromised?

  A. CARLB
  B. CINDYP
  C. GILLIANO
  D. ANDREAD
  E. LAURAB
  D. ANDREAD

• Question 855:

  A security analyst has noticed an alert from the SIEM. A workstation is repeatedly trying to connect to port 445 of a file server on the production network. All of the attempts are made with invalid credentials. Which of the following describes what is occurring?

  A. Malware has infected the workstation and is beaconing out to the specific IP address of the file server.
  B. The file server is attempting to transfer malware to the workstation via SMB.
  C. An attacker has gained control of the workstation and is attempting to pivot to the file server by creating an SMB session.
  D. An attacker has gained control of the workstation and is port scanning the network.
  C. An attacker has gained control of the workstation and is attempting to pivot to the file server by creating an SMB session.

• Question 856:

  An organization supports a large number of remote users. Which of the following is the BEST option to protect the data on the remote users' laptops?

  A. Require the use of VPNs.
  B. Require employees to sign an NDA.
  C. Implement a DLP solution.
  D. Use whole disk encryption.
  D. Use whole disk encryption.

• Question 857:

  A security analyst is conducting traffic analysis following a potential web server breach. The analyst wants to investigate client-side server errors.

  

  Which of the following lines of this query output should be investigated further?

  A. 1
  B. 2
  C. 3
  D. 4
  C. 3

• Question 858:

  The development team currently consists of three developers who each specialize in a specific programming language:

  Developer 1 ?C++/C# Developer 2 ?Python Developer 3 ?Assembly

  Which of the following SDLC best practices would be challenging to implement with the current available staff?

  A. Fuzzing
  B. Peer review
  C. Regression testing
  D. Stress testing
  B. Peer review

• Question 859:

  A cybersecurity analyst is currently investigating a server outage. The analyst has discovered the following value was entered for the username: 0xbfff601a. Which of the following attacks may be occurring?

  A. Buffer overflow attack
  B. Man-in-the-middle attack
  C. Smurf attack
  D. Format string attack
  E. Denial of service attack
  D. Format string attack

• Question 860:

  Which of the following is the BEST option to protect a web application against CSRF attacks?

  A. Update the web application to the latest version.
  B. Set a server-side rate limit for CSRF token generation.
  C. Avoid the transmission of CSRF tokens using cookies.
  D. Configure the web application to only use HTTPS and TLS 1.3.
  C. Avoid the transmission of CSRF tokens using cookies.

  ---

  Explanation/Reference:

  CSRF tokens are random values that are generated by the server and included in requests that perform state-changing actions. They are used to prevent CSRF attacks by verifying that the request originates from a legitimate source.

  However, if the CSRF tokens are transmitted using cookies, they are vulnerable to being stolen or forged by an attacker who can exploit other vulnerabilities, such as cross-site scripting (XSS) or cookie injection. Therefore, a better option is to

  avoid the transmission of CSRF tokens using cookies and use other methods, such as hidden form fields or custom HTTP headers. References:

  CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 11; https://owasp.org/www-community/attacks/csrf