CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 951:

  A hybrid control is one that:

  A. is implemented differently on individual systems
  B. is implemented at the enterprise and system levels
  C. has operational and technical components
  D. authenticates using passwords and hardware tokens
  B. is implemented at the enterprise and system levels

• Question 952:

  Given a packet capture of the following scan:

  

  Which of the following should MOST likely be inferred on the scan's output?

  A. 192.168.1.115 is hosting a web server.
  B. 192.168.1.55 is hosting a web server.
  C. 192.168.1.55 is a Linux server.
  D. 192.168.1.55 is a file server.
  D. 192.168.1.55 is a file server.

• Question 953:

  A company's legal department is concerned that its incident response plan does not cover the countless ways security incidents can occur. They have asked a security analyst to help tailor the response plan to provide broad coverage for many situations. Which of the following is the BEST way to achieve this goal?

  A. Focus on incidents that have a high chance of reputation harm.
  B. Focus on common attack vectors first.
  C. Focus on incidents that affect critical systems.
  D. Focus on incidents that may require law enforcement support.
  B. Focus on common attack vectors first.

  ---

  Explanation/Reference:

  Reference: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf (11)

• Question 954:

  An information security analyst is reviewing backup data sets as part of a project focused on eliminating archival data sets. Which of the following should be considered FIRST prior to disposing of the electronic data?

  A. Sanitization policy
  B. Data sovereignty
  C. Encryption policy
  D. Retention standards
  D. Retention standards

• Question 955:

  A security team wants to make SaaS solutions accessible from only the corporate campus. Which of the following would BEST accomplish this goal?

  A. Geofencing
  B. IP restrictions
  C. Reverse proxy
  D. Single sign-on
  A. Geofencing

  ---

  Explanation/Reference:

  Reference: https://bluedot.io/library/what-is-geofencing/

• Question 956:

  After a remote command execution incident occurred on a web server, a security analyst found the following piece of code in an XML file:

  

  Which of the following it the BEST solution to mitigate this type of attack?

  A. Implement a better level of user input filters and content sanitization.
  B. Property configure XML handlers so they do not process sent parameters coming from user inputs.
  C. Use parameterized Queries to avoid user inputs horn being processed by the server.
  D. Escape user inputs using character encoding conjoined with whitelisting
  B. Property configure XML handlers so they do not process sent parameters coming from user inputs.

• Question 957:

  A SIEM analyst noticed a spike in activities from the guest wireless network to several electronic health record (EHR) systems. After further analysis, the analyst discovered that a large volume of data has been uploaded to a cloud provider in the last six months. Which of the following actions should the analyst do FIRST?

  A. Contact the Office of Civil Rights (OCR) to report the breach
  B. Notify the Chief Privacy Officer (CPO)
  C. Activate the incident response plan
  D. Put an ACL on the gateway router
  D. Put an ACL on the gateway router

• Question 958:

  Which of the following BEST describes the offensive participants in a tabletop exercise?

  A. Red team
  B. Blue team
  C. System administrators
  D. Security analysts
  E. Operations team
  A. Red team

• Question 959:

  During an investigation, an incident responder intends to recover multiple pieces of digital media. Before removing the media, the responder should initiate:

  A. malware scans.
  B. secure communications.
  C. chain of custody forms.
  D. decryption tools.
  C. chain of custody forms.

• Question 960:

  A general contractor has a list of contract documents containing critical business data that are stored at a public cloud provider. The organization's security analyst recently reviewed some of the storage containers and discovered most of the containers are not encrypted. Which of the following configurations will provide the MOST security to resolve the vulnerability?

  A. Upgrading TLS 1.2 connections to TLS 1.3
  B. Implementing AES-256 encryption on the containers
  C. Enabling SHA-256 hashing on the containers
  D. Implementing the Triple Data Encryption Algorithm at the file level
  B. Implementing AES-256 encryption on the containers