CompTIA CS0-002 Online Practice Questions and Exam Preparation

CompTIA CS0-002 Online Questions & Answers

• Question 971:

  An organization is conducting penetration testing to identify possible network vulnerabilities. The penetration tester has received the following output from the latest scan:

  

  The penetration tester knows the organization does not use Timbuktu servers and wants to have Nmap interrogate the ports on the target in more detail. Which of the following commands should the penetration tester use NEXT?

  A. nmap V 192.168.1.13 1417
  B. nmap S 192.168.1.13 1417
  C. sudo nmap S 192.168.1.13
  D. nmap 192.168.1.13
  A. nmap V 192.168.1.13 1417

• Question 972:

  A system administrator who was using an account with elevated privileges deleted a large amount of log files generated by a virtual hypervisor in order to free up disk space. These log files are needed by the security team to analyze the health of the virtual machines. Which of the following compensating controls would help prevent this from reoccurring? (Select two.)

  A. Succession planning
  B. Separation of duties
  C. Mandatory vacation
  D. Personnel training
  E. Job rotation
  B. Separation of duties
  D. Personnel training

• Question 973:

  Following a recent security breach, a post-mortem was done to analyze the driving factors behind the breach. The cybersecurity analysis discussed potential impacts, mitigations, and remediations based on current events and emerging threat vectors tailored to specific stakeholders. Which of the following is this considered to be?

  A. Threat intelligence
  B. Threat information
  C. Threat data
  D. Advanced persistent threats
  A. Threat intelligence

• Question 974:

  Which of the following BEST articulates the benefit of leveraging SCAP in an organization's cybersecurity analysis toolset?

  A. It automatically performs remedial configuration changes to enterprise security services
  B. It enables standard checklist and vulnerability analysis expressions for automation
  C. It establishes a continuous integration environment for software development operations
  D. It provides validation of suspected system vulnerabilities through workflow orchestration
  B. It enables standard checklist and vulnerability analysis expressions for automation

• Question 975:

  During an investigation, an analyst discovers a server is vulnerable to an attack against an application that processes XML input. Which of the following controls must be in place to prevent such an attack?

  A. Filter all inputs, applying the allow list concept for each parameter from XML content.
  B. Enable an XML external entity and escape each parameter that is received through the XML file.
  C. Implement parameterized queries for each XML parser.
  D. Disable document type definitions completely using the proper method for each parser.
  D. Disable document type definitions completely using the proper method for each parser.

• Question 976:

  A security analyst is supporting an embedded software team. Which of the following is the BEST recommendation to ensure proper error handling at runtime?

  A. Perform static code analysis.
  B. Require application fuzzing.
  C. Enforce input validation
  D. Perform a code review
  C. Enforce input validation

• Question 977:

  Which of the following should a database administrator implement to BEST protect data from an untrusted server administrator?

  A. Data deidentification
  B. Data encryption
  C. Data masking
  D. Data minimization
  B. Data encryption

• Question 978:

  Industry partners from critical infrastructure organizations were victims of attacks on their SCADA devices. The attacker was able to gain access to the SCADA by logging in to an account with weak credentials. Which of the following identity and access management solutions would help to mitigate this risk?

  A. Multifactor authentication
  B. Manual access reviews
  C. Endpoint detection and response
  D. Role-based access control
  D. Role-based access control

  ---

  Explanation/Reference:

  RBAC helps organizations manage access to critical infrastructure networks by assigning access based on roles. This allows organizations to control who can access specific resources and helps eliminate weak credentials that attackers

  could exploit. Manual reviews and endpoint detection and response can also help to mitigate risk, but role based access control is the best solution for this scenario.

• Question 979:

  A security analyst is reviewing malware files without running them. Which of the following analysis types is the security analyst using?

  A. Dynamic
  B. Sandbox
  C. Static
  D. Heuristic
  C. Static

  ---

  Explanation/Reference:

  Static analysis, also called static code analysis, is a method of computer program debugging that is done by examining the code without executing the program. The process provides an understanding of the code structure and can help ensure that the code adheres to industry standards.

• Question 980:

  A company wants to configure the environment to allow passive network monitonng. To avoid disrupting the sensitive network, which of the following must be supported by the scanner's NIC to assist with the company's request?

  A. Port bridging
  B. Tunnel all mode
  C. Full-duplex mode
  D. Port mirroring
  E. Promiscuous mode
  D. Port mirroring