CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 911:

  A security analyst needs to develop a brief that will include the latest incidents and the attack phases of the incidents. The goal is to support threat intelligence and identify whether or not the incidents are linked. Which of the following methods would be MOST appropriate to use?

  A. The Cyber Kill Chain
  B. The MITRE ATTandCK framework
  C. An adversary capability model
  D. The Diamond Model of Intrusion Analysis
  B. The MITRE ATTandCK framework

• Question 912:

  An organization has recently experienced a data breach. A forensic analysis confirmed the attacker found a legacy web server that had not been used in over a year and was not regularly patched. After a discussion with the security team, management decided to initiate a program of network reconnaissance and penetration testing. They want to start the process by scanning the network for active hosts and open ports. Which of the following tools is BEST suited for this job?

  A. Ping
  B. Nmap
  C. Netstat
  D. ifconfig
  E. Wireshark
  F. L0phtCrack
  B. Nmap

• Question 913:

  A cybersecurity analyst is researching operational data to develop a script that will detect the presence of a threat on corporate assets. Which of the following contains the most useful information to produce this script?

  A. API documentation
  B. Protocol analysis captures
  C. MITRE ATTandCK reports
  D. OpenloC files
  C. MITRE ATTandCK reports

  ---

  Explanation/Reference:

  A cybersecurity analyst is researching operational data to develop a script that will detect the presence of a threat on corporate assets. The most useful information to produce this script is MITRE ATTandCK reports. MITRE ATTandCK is a knowledge base of adversary tactics and techniques based on real-world observations. MITRE ATTandCK reports provide detailed information on how different threat actors operate, what tools they use, what indicators they leave behind, and how to detect or mitigate their attacks. The other options are not as useful or relevant for this purpose. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 9; https://attack.mitre.org/

• Question 914:

  A security analyst is reviewing the logs and notices the following entries:

  

  Which of the following most likely occurred?

  A. LDAP injection
  B. Clickjacking
  C. XSS
  D. SQLi
  D. SQLi

• Question 915:

  A security analyst discovers accounts in sensitive SaaS-based systems are not being removed in a timely manner when an employee leaves the organization To BEST resolve the issue, the organization should implement:

  A. federated authentication
  B. role-based access control.
  C. manual account reviews
  D. multifactor authentication.
  A. federated authentication

• Question 916:

  During a risk assessment, a senior manager inquires about what the cost would be if a unique occurrence would impact the availability of a critical service. The service generates $1,000 in revenue for the organization. The impact of the attack would affect 20% of the server's capacity to perform jobs. The organization expects that five out of twenty attacks would succeed during the year. Which of the following is the calculated single loss expectancy?

  A. $200
  B. $800
  C. $5,000
  D. $20,000
  A. $200

• Question 917:

  In comparison to non-industrial IT vendors, ICS equipment vendors generally: A. rely less on proprietary code in their hardware products.

  B. have more mature software development models.
  C. release software updates less frequently.
  D. provide more expensive vulnerability reporting.
  A

• Question 918:

  A security analyst is evaluating two vulnerability management tools for possible use in an organization. The analyst set up each of the tools according to the respective vendor's instructions and generated a report of vulnerabilities that ran

  against the same target server.

  Tool A reported the following:

  

  Tool B reported the following:

  

  Which of the following BEST describes the method used by each tool? (Choose two.)

  A. Tool A is agent based.
  B. Tool A used fuzzing logic to test vulnerabilities.
  C. Tool A is unauthenticated.
  D. Tool B utilized machine learning technology.
  E. Tool B is agent based.
  F. Tool B is unauthenticated.
  A. Tool A is agent based.
  F. Tool B is unauthenticated.

  ---

  Explanation/Reference:

  https://www.examtopics.com/discussions/comptia/view/42244-exam-cs0-002-topic-1-question-29-discussion/

• Question 919:

  A centralized tool for organizing security events and managing their response and resolution is known as:

  A. SIEM
  B. HIPS
  C. Syslog
  D. Wireshark
  A. SIEM

• Question 920:

  An analyst has noticed unusual activities in the SIEM to a .cn domain name. Which of the following should the analyst use to identify the content of the traffic?

  A. Log review
  B. Service discovery
  C. Packet capture
  D. DNS harvesting
  C. Packet capture