Pass Your CompTIA Exam with CS0-002 Exam Dumps (Updated 328 Questions) [Q106-Q120]

4/5 - (2 votes)

Pass Your CompTIA Exam with CS0-002 Exam Dumps (Updated 328 Questions)

CS0-002 Exam Dumps – CompTIA Practice Test Questions

What is the Exam fee for CompTIA CS0-002 Exam

The cost of CompTIA CS0-002 Exam is $359

What can you expect after completing CompTIA CS0-002 exam?

The certified professionals can take up the job roles of a Security Analyst, a Security Engineer, an Incident Handler, a Threat Hunter, a Compliance Analyst, an Application Security Analyst, and a Threat Intelligence Analyst. The salary outlook for these positions is an average of $94,500 per annum. An experience level and specific job title will determine the actual remuneration that an individual can earn.

NO.106 Which of the following types of policies is used to regulate data storage on the network?

Password

Acceptable use

Account management

Retention

Explanation/Reference: http://www.css.edu/administration/information-technologies/computing-policies/computer-and- network-policies.html

NO.107 While reviewing proxy logs, the security analyst noticed a suspicious traffic pattern. Several internal hosts were observed communicating with an external IP address over port 80 constantly.
An incident was declared, and an investigation was launched. After interviewing the affected users, the analyst determined the activity started right after deploying a new graphic design suite.
Based on this information, which of the following actions would be the appropriate NEXT step in the investigation?

Update all antivirus and anti-malware products, as well as all other host-based security software on the servers the affected users authenticate to.

Perform a network scan and identify rogue devices that may be generating the observed traffic.
Remove those devices from the network.

Identify what the destination IP address is and who owns it, and look at running processes on the affected hosts to determine if the activity is malicious or not.

Ask desktop support personnel to reimage all affected workstations and reinstall the graphic design suite. Run a virus scan to identify if any viruses are present.

NO.108 During an investigation, a security analyst determines suspicious activity occurred during the night shift over the weekend. Further investigation reveals the activity was initiated from an internal IP going to an external website.
Which of the following would be the MOST appropriate recommendation to prevent the activity from happening in the future?

An IPS signature modification for the specific IP addresses

An IDS signature modification for the specific IP addresses

A firewall rule that will block port 80 traffic

A firewall rule that will block traffic from the specific IP addresses

Explanation/Reference:

NO.109 During an incident, a cybersecurity analyst found several entries in the web server logs that are related to an IP with a bad reputation. Which of the following would cause the analyst to further review the incident?

BadReputationIp – – [2019-04-12 10:43Z] “GET /etc/passwd” 403 1023

BadReputationIp – – [2019-04-12 10:43Z] “GET /index.html?src=../.ssh/id_rsa” 401 17044

BadReputationIp – – [2019-04-12 10:43Z] “GET /a.php?src=/etc/passwd” 403 11056

BadReputationIp – – [2019-04-12 10:43Z] “GET /a.php?src=../../.ssh/id_rsa” 200 15036

BadReputationIp – – [2019-04-12 10:43Z] “GET /favicon.ico?src=../usr/share/ icons” 200 19064

NO.110 A company’s Chief Information Security Officer (CISO) is concerned about the integrity of some highly confidential files. Any changes to these files must be tied back to a specific authorized user’s activity session.
Which of the following is the BEST technique to address the CISO’s concerns?

Configure DLP to reject all changes to the files without pre-authorization. Monitor the files for unauthorized changes.

Regularly use SHA-256 to hash the directory containing the sensitive information. Monitor the files for unauthorized changes.

Place a legal hold on the files. Require authorized users to abide by a strict time context access policy.
Monitor the files for unauthorized changes.

Use Wireshark to scan all traffic to and from the directory. Monitor the files for unauthorized changes.

NO.111 An employee was conducting research on the Internet when a message from cyber criminals appeared on the screen, stating the hard drive was just encrypted by a ransomware variant. An analyst observes the following:
* Antivirus signatures were updated recently
* The desktop background was changed
* Web proxy logs show browsing to various information security sites and ad network traffic
* There is a high volume of hard disk activity on the file server
* SMTP server shown the employee recently received several emails from blocked senders
* The company recently switched web hosting providers
* There are several IPS alerts for external port scans
Which of the following describes how the employee got this type of ransomware?

The employee fell victim to a CSRF attack

The employee was using another user’s credentials

The employee opened an email attachment

The employee updated antivirus signatures

NO.112 A security analyst suspects a malware infection was caused by a user who downloaded malware after clicking
http://<malwaresource>/a.php in a phishing email.
To prevent other computers from being infected by the same malware variation, the analyst should create a rule on the.

email server that automatically deletes attached executables.

IDS to match the malware sample.

proxy to block all connections to <malwaresource>.

firewall to block connection attempts to dynamic DNS hosts.

NO.113 During an investigation, a computer is being seized. Which of the following is the FIRST step the analyst should take?

Power off the computer and remove it from the network.

Unplug the network cable and take screenshots of the desktop.

Perform a physical hard disk image.

Initiate chain-of-custody documentation.

NO.114 A security analyst, who is working for a company that utilizes Linux servers, receives the following results from a vulnerability scan:

Which of the following is MOST likely a false positive?

ICMP timestamp request remote date disclosure

Windows SMB service enumeration via srvsvc

Anonymous FTP enabled

Unsupported web server detection

NO.115 After analyzing and correlating activity from multiple sensors, the security analyst has determined a group from a high-risk country is responsible for a sophisticated breach of the company network and continuous administration of targeted attacks for the past three months. Until now, the attacks went unnoticed. This is an example of:

privilege escalation.

advanced persistent threat.

malicious insider threat.

spear phishing.

NO.116 An organization wants to harden its web servers. As part of this goal, leadership has directed that vulnerability scans be performed, and the security team should remediate the servers according to industry best practices. The team has already chosen a vulnerability scanner and performed the necessary scans, and now the team needs to prioritize the fixes. Which of the following would help to prioritize the vulnerabilities for remediation in accordance with industry best practices?

CVSS

SLA

ITIL

OpenVAS

Qualys

NO.117 During an investigation, an incident responder intends to recover multiple pieces of digital medi
Before removing the media, the responder should initiate:

malware scans.

secure communications.

chain of custody forms.

decryption tools.

NO.118 A computer has been infected with a virus and is sending out a beacon to command and control server through an unknown service. Which of the following should a security technician implement to drop the traffic going to the command and control server and still be able to identify the infected host through firewall logs?

Sinkhole

Block ports and services

Patches

Endpoint security

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-DNS-Sinkhole/ta- p/58891

NO.119 The development team recently moved a new application into production for the accounting department. After this occurred, the Chief Information Officer (CIO) was contacted by the head of accounting because the application is missing a key piece of functionality that is needed to complete the corporation’s quarterly tax returns. Which of the following types of testing would help prevent this from reoccurring?

Security regression testing

User acceptance testing

Input validation testing

Static code testing

NO.120 An organization suspects it has had a breach, and it is trying to determine the potential impact. The organization knows the following:
* The source of the breach is linked to an IP located in a foreign country.
* The breach is isolated to the research and development servers.
* The hash values of the data before and after the breach are unchanged.
* The affected servers were regularly patched, and a recent scan showed no vulnerabilities.
Which of the following conclusions can be drawn with respect to the threat and impact? (Choose two.)

The confidentiality of the data is unaffected.

The threat is an APT.

The source IP of the threat has been spoofed.

The integrity of the data is unaffected.

The threat is an insider.

Loading …