Pass4itsure share these resources with you. Both VCE and PDF dumps contain the latest CompTIA CS0-002 exam questions, which will ensure your CS0-002 exam 100% passed! You can get CS0-002 VCE dumps and CS0-002 PDF dumps from Pass4itsure. Please get the latest Pass4itsure CS0-002 dumps here: https://www.pass4itsure.com/cs0-002.html (119 QA Dumps).
Download The Real CompTIA CS0-002 PDF Here, Free
[free pdf] CompTIA CS0-002 PDF [Drive] https://drive.google.com/file/d/1CCNdcXiubvCtUwMK04DfZwfE70d4m3_p/view?usp=sharing
CompTIA CS0-002 Practice Test Questions Answers
QUESTION 1
A security analyst is providing a risk assessment for a medical device that will be installed on the corporate network.
During the assessment, the analyst discovers the device has an embedded operating system that will be at the end of
its life in two years. Due to the criticality of the device, the security committee makes a risk-based policy decision to
review and enforce the vendor upgrade before the end of life is reached.
Which of the following risk actions has the security committee taken?
A. Risk exception
B. Risk avoidance
C. Risk tolerance
D. Risk acceptance
Correct Answer: D
QUESTION 2
A Chief Information Security Officer (CISO) wants to upgrade an organization\\’s security posture by improving proactive
activities associated with attacks from internal and external threats.
Which of the following is the MOST proactive tool or technique that feeds incident response capabilities?
A. Development of a hypothesis as part of threat hunting
B. Log correlation, monitoring, and automated reporting through a SIEM platform
C. Continuous compliance monitoring using SCAP dashboards
D. Quarterly vulnerability scanning using credentialed scans
Correct Answer: A
QUESTION 3
A security analyst is reviewing vulnerability scan results and notices new workstations are being flagged as having
outdated antivirus signatures. The analyst observes the following plugin output:
Antivirus is installed on the remote host:
Installation path: C:\Program Files\AVProduct\Win32\
Product Engine: 14.12.101
Engine Version: 3.5.71
Scanner does not currently have information about AVProduct version 3.5.71. It may no longer be supported.
The engine version is out of date. The oldest supported version from the vendor is 4.2.11.
The analyst uses the vendor\\’s website to confirm the oldest supported version is correct.
Which of the following BEST describes the situation?
A. This is a false positive, and the scanning plugin needs to be updated by the vendor.
B. This is a true negative, and the new computers have the correct version of the software.
C. This is a true positive, and the new computers were imaged with an old version of the software.
D. This is a false negative, and the new computers need to be updated by the desktop team.
Correct Answer: D
QUESTION 4
Ransomware is identified on a company\\’s network that affects both Windows and MAC hosts. The command and
control channel for encryption for this variant uses TCP ports from 11000 to 65000. The channel goes to good1.
Iholdbadkeys.com, which resolves to IP address 72.172.16.2.
Which of the following is the MOST effective way to prevent any newly infected systems from actually encrypting the
data on connected network drives while causing the least disruption to normal Internet traffic?
A. Block all outbound traffic to web host good1 iholdbadkeys.com at the border gateway.
B. Block all outbound TCP connections to IP host address 172.172.16.2 at the border gateway.
C. Block all outbound traffic on TCP ports 11000 to 65000 at the border gateway.
D. Block all outbound traffic on TCP ports 11000 to 65000 to IP host address 172.172.16.2 at the border gateway.
Correct Answer: A
QUESTION 5
For machine learning to be applied effectively toward security analysis automation, it requires __________.
A. relevant training data.
B. a threat feed API.
C. a multicore, multiprocessor system.
D. anomalous traffic signatures.
Correct Answer: D
QUESTION 6
An information security analyst observes anomalous behavior on the SCADA devices in a power plant. This behavior
results in the industrial generators overheating and destabilizing the power supply. Which of the following would BEST
identify potential indicators of compromise?
A. Use Burp Suite to capture packets to the SCADA device\\’s IP.
B. Use tcpdump to capture packets from the SCADA device IP.
C. Use Wireshark to capture packets between SCADA devices and the management system.
D. Use Nmap to capture packets from the management system to the SCADA devices.
Correct Answer: C
QUESTION 7
A security analyst receives an alert that highly sensitive information has left the company\\’s network Upon investigation,
the analyst discovers an outside IP range has had connections from three servers more than 100 times m the past
month The affected servers are virtual machines Which of the following is the BEST course of action?
A. Shut down the servers as soon as possible, move them to a clean environment, restart, run a vulnerability scanner to
find weaknesses determine the root cause, remediate, and report
B. Report the data exfiltration to management take the affected servers offline, conduct an antivirus scan, remediate all
threats found, and return the servers to service.
C. Disconnect the affected servers from the network, use the virtual machine console to access the systems, determine
which information has left the network, find the security weakness, and remediate
D. Determine if any other servers have been affected, snapshot any servers found, determine the vector that was used
to allow the data exfiltration. fix any vulnerabilities, remediate, report.
Correct Answer: A
QUESTION 8
A security analyst needs to reduce the overall attack surface.
Which of the following infrastructure changes should the analyst recommend?
A. Implement a honeypot.
B. Air gap sensitive systems.
C. Increase the network segmentation.
D. Implement a cloud-based architecture.
Correct Answer: C
Reference: https://www.securitymagazine.com/articles/89283-ways-to-reduce-your-attack-surface
QUESTION 9
A security analyst is reviewing a web application. If an unauthenticated user tries to access a page in the application,
the user is redirected to the login page. After successful authentication, the user is then redirected back to the original
page. Some users have reported receiving phishing emails with a link that takes them to the application login page but
then redirects to a fake login page after successful authentication.
Which of the following will remediate this software vulnerability?
A. Enforce unique session IDs for the application.
B. Deploy a WAF in front of the web application.
C. Check for and enforce the proper domain for the redirect.
D. Use a parameterized query to check the credentials.
E. Implement email filtering with anti-phishing protection.
Correct Answer: A
QUESTION 10
A security analyst reviews the following aggregated output from an Nmap scan and the border firewall ACL:
Which of the following should the analyst reconfigure to BEST reduce organizational risk while maintaining current
functionality?
A. PC1
B. PC2
C. Server1
D. Server2
E. Firewall
Correct Answer: E
QUESTION 11
A security analyst discovers accounts in sensitive SaaS-based systems are not being removed in a timely manner when
an employee leaves the organization To BEST resolve the issue, the organization should implement
A. federated authentication
B. role-based access control.
C. manual account reviews
D. multifactor authentication.
Correct Answer: A
QUESTION 12
SIMULATION
You are a cybersecurity analyst tasked with interpreting scan data from Company A\\’s servers. You must verify the
requirements are being met for all of the servers and recommend changes if you find they are not.
The company\\’s hardening guidelines indicate the following:
1.
TLS 1.2 is the only version of TLS running.
2.
Apache 2.4.18 or greater should be used.
3.
Only default ports should be used.
INSTRUCTIONS
Using the supplied data, record the status of compliance with the company\\’s guidelines for each server.
The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for issues based
ONLY on the hardening guidelines provided.
A.
Correct Answer: See below.
QUESTION 13
Which of the following roles is ultimately responsible for determining the classification levels assigned to specific data
sets?
A. Data custodian
B. Data owner
C. Data processor
D. Senior management
Correct Answer: B
Reference: https://www.pearsonitcertification.com/articles/article.aspx?p=2731933andseqNum=3
Pass4itsure Discount Code 2020
P.S
Exampass shares all the resources: Latest CompTIA CS0-002 practice questions, latest CS0-002 pdf dumps, CS0-002 exam video learning. CompTIA CS0-002 dumps https://www.pass4itsure.com/cs0-002.html has come to help you prepare for the implementation of the CompTIA CS0-002 exam and its comprehensive and thorough CS0-002 exam practice materials, which will help you successfully pass the examination.
