Free CompTIA CySA+ CS0-002 Ultimate Study Guide (Updated 530 Questions)
Get to the Top with CS0-002 Practice Exam Questions
NEW QUESTION 65
An analyst is performing penetration testing and vulnerability assessment activities against a new vehicle automation platform.
Which of the following is MOST likely an attack vector that is being utilized as part of the testing and assessment?
- A. GPS
- B. CAN bus
- C. RTOS
- D. FaaS
- E. SoC
Answer: C
NEW QUESTION 66
An organization has been conducting penetration testing to identify possible network vulnerabilities. One of the security policies states that web servers and database servers must not be co-located on the same server unless one of them runs on a non-standard. The penetration tester has received the following outputs from the latest set of scans:
Which of the following servers is out of compliance?
- A. opsServer
- B. adminServer
- C. finServer
- D. orgServer
Answer: D
NEW QUESTION 67
Datacenter access is controlled with proximity badges that record all entries and exits from the datacenter.
The access records are used to identify which staff members accessed the data center in the event of equipment theft.
Which of the following MUST be prevented in order for this policy to be effective?
- A. Password reuse
- B. Tailgating
- C. Phishing
- D. Social engineering
Answer: B
NEW QUESTION 68
A company requests a security assessment of its network. Permission is given, but no details are provided. It is discovered that the company has a web presence, and the company's IP address is 70.182.11.4. Which of the following Nmap commands would reveal common open ports and their versions?
- A. nmap -vO
- B. nmap -sv
- C. nmap - oV
Answer: B
NEW QUESTION 69
A company's Chief Information Security Officer (CISO) is concerned about the integrity of some highly confidential files. Any changes to these files must be tied back to a specific authorized user's activity session. Which of the following is the BEST technique to address the CISO's concerns?
- A. Configure DLP to reject all changes to the files without pre-authorization. Monitor the files for unauthorized changes.
- B. Place a legal hold on the files. Require authorized users to abide by a strict time context access policy.
Monitor the files for unauthorized changes. - C. Regularly use SHA-256 to hash the directory containing the sensitive information. Monitor the files for unauthorized changes.
- D. Use Wireshark to scan all traffic to and from the directory. Monitor the files for unauthorized changes.
Answer: A,B
NEW QUESTION 70
An organization is conducting penetration testing to identify possible network vulnerabilities. The penetration tester has received the following output from the latest scan:
The penetration tester knows the organization does not use Timbuktu servers and wants to have Nmap interrogate the ports on the target in more detail. Which of the following commands should the penetration tester use NEXT?
- A. nmap -sV 192.168.1.13 -p1417
- B. sudo nmap -sS 192.168.1.13
- C. nmap 192.168.1.13 -v
- D. nmap -sS 192.168.1.13 -p1417
Answer: A
NEW QUESTION 71
Which of the following roles is ultimately responsible for determining the classification levels assigned to specific data sets?
- A. Senior management
- B. Data processor
- C. Data owner
- D. Data custodian
Answer: C
NEW QUESTION 72
A vulnerability scanner has identified an out-of-support database software version running on a server. The software update will take six to nine months to complete. The management team has agreed to a one-year extended support contract with the software vendor. Which of the following BEST describes the risk treatment in this scenario?
- A. The extended support mitigates any risk associated with the software.
- B. The company is transferring the risk for the vulnerability to the software vendor.
- C. The extended support contract changes this vulnerability finding to a false positive.
- D. The company is accepting the inherent risk of the vulnerability.
Answer: D
Explanation:
Risk Acceptance
A risk response that involves determining that a risk is within the organization's risk appetite and no countermeasures other than ongoing monitoring will be needed
* Mitigation
* Control
* Avoidance
* Changing plans
* Transference
* Insurance
* Acceptance
* Low risk
NEW QUESTION 73
A Chief Information Security Officer (CISO) needs to ensure that a laptop image remains unchanged and can be verified before authorizing the deployment of the image to 4000 laptops.
Which of the following tools would be appropriate to use in this case?
- A. DLP
- B. FIM
- C. SHA1sum
- D. MSBA
Answer: C
NEW QUESTION 74
A security analyst is reviewing IDS logs and notices the following entry:
Which of the following attacks is occurring?
- A. Cross-site scripting
- B. Header manipulation
- C. XML injection
- D. SQL injection
Answer: D
NEW QUESTION 75
While conducting research on malicious domains, a threat intelligence analyst received a blue screen of death. The analyst rebooted and received a message stating that the computer had been locked and could only be opened by following the instructions on the screen. Which of the following combinations describes the MOST likely threat and the PRIMARY mitigation for the threat?
- A. Account takeover and data backups
- B. Ransomware and full disk encryption
- C. Ransomware and data backups
- D. Ransomware and update antivirus
Answer: C
NEW QUESTION 76
A security analyst received a SIEM alert regarding high levels of memory consumption for a critical system. After several attempts to remediate the issue, the system went down. A root cause analysis revealed a bad actor forced the application to not reclaim memory. This caused the system to be depleted of resources.
Which of the following BEST describes this attack?
- A. Denial of service
- B. Array attack
- C. Injection attack
- D. Memory corruption
Answer: D
Explanation:
Reference:
https://economictimes.indiatimes.com/definition/memory-corruption
NEW QUESTION 77
NOTE: Question IP must be 192.168.192.123
During a network reconnaissance engagement, a penetration tester was given perimeter firewall ACLs to accelerate the scanning process. The penetration tester has decided to concentrate on trying to brute force log in to destination IP address 192.168.192.132 via secure shell.
Given a source IP address of 10.10.10.30, which of the following ACLs will permit this access?
- A.
- B.
- C.
- D.
Answer: A
NEW QUESTION 78
During an investigation, a security analyst identified machines that are infected with malware the antivirus was unable to detect.
Which of the following is the BEST place to acquire evidence to perform data carving?
- A. Network packets
- B. The hard drive
- C. The Windows Registry
- D. The system memory
Answer: D
NEW QUESTION 79
Which of the following BEST describes the process by which code is developed, tested, and deployed in small batches?
- A. SDLC
- B. Dynamic code analysis
- C. Waterfall
- D. Agile
Answer: D
NEW QUESTION 80
A security analyst is evaluating two vulnerability management tools for possible use in an organization. The analyst set up each of the tools according to the respective vendor's instructions and generated a report of vulnerabilities that ran against the same target server.
Tool A reported the following:
Tool B reported the following:
Which of the following BEST describes the method used by each tool? (Choose two.)
- A. Tool A is agent based.
- B. Tool B is agent based.
- C. Tool A used fuzzing logic to test vulnerabilities.
- D. Tool A is unauthenticated.
- E. Tool B utilized machine learning technology.
- F. Tool B is unauthenticated.
Answer: B,D
NEW QUESTION 81
A security technician configured a NIDS to monitor network traffic. Which of the following is a condition in which harmless traffic is classified as a potential network attack?
- A. False negative
- B. False positive
- C. True negative
- D. True positive
Answer: A
NEW QUESTION 82
During which of the following NIST risk management framework steps would an information system security engineer identify inherited security controls and tailor those controls to the system?
- A. Access
- B. Select
- C. Implement
- D. Categorize
Answer: B
NEW QUESTION 83
Welcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the desk ticket queue.
INSTRUCTIONS
Click on me ticket to see the ticket details Additional content is available on tabs within the ticket First, select the appropriate issue from the drop-down menu. Then, select the MOST likely root cause from second drop-down menu If at any time you would like to bring back the initial state of the simulation, please click the Reset All button
Answer:
Explanation:
NEW QUESTION 84
A team of security analysis has been alerted to potential malware activity. The initial examination indicates one of the affected workstations on beaconing on TCP port 80 to five IP addresses and attempting to spread across the network over port 445. Which of the following should be the team's NEXT step during the detection phase of this response process?
- A. Engage the engineering team to block SMB traffic internally and outbound HTTP traffic to the five IP addresses
Identify potentially affected systems by creating a correlation - B. Depending on system critically remove each affected device from the network by disabling wired and wireless connections
- C. Identify potentially affected system by creating a correlation search in the SIEM based on the network traffic.
- D. Escalate the incident to management ,who will then engage the network infrastructure team to keep them informed
Answer: C
NEW QUESTION 85
A cybersecurity analyst is currently checking a newly deployed server that has an access control list applied.
When conducting the scan, the analyst received the following code snippet of results:
Which of the following describes the output of this scan?
- A. The analyst has discovered a True Positive, and the status code is correct providing a file not found error message.
- B. The analyst has discovered a True Positive, and the status code is incorrect providing a forbidden message.
- C. The analyst has discovered a False Positive, and the status code is incorrect providing an OK message.
- D. The analyst has discovered a False Positive, and the status code is incorrect providing a server error message.
Answer: A
NEW QUESTION 86
While reviewing three months of logs, a security analyst notices probes from random company laptops going to SCADA equipment at the company's manufacturing location. Some of the probes are getting responses from the equipment even though firewall rules are in place, which should block this type of unauthorized activity. Which of the following should the analyst recommend to keep this activity from originating from company laptops?
- A. Install security software and a host-based firewall on the SCADA equipment.
- B. Require connections to the SCADA network to go through a forwarding proxy.
- C. Implement a group policy on company systems to block access to SCADA networks.
- D. Update the firewall rules to block SCADA network access from those laptop IP addresses.
Answer: C
NEW QUESTION 87
A company has been a victim of multiple volumetric DoS attacks. Packet analysis of the offending traffic shows the following:
Which of the following mitigation techniques is MOST effective against the above attack?
- A. The company should implement the following ACL at their gateway firewall:DENY IP HOST
192.168.1.1 170.43.30.0/24. - B. The company should contact the upstream ISP and ask that RFC1918 traffic be dropped.
- C. The company should implement a network-based sinkhole to drop all traffic coming from
192.168.1.1 at their gateway router. - D. The company should enable the DoS resource starvation protection feature of the gateway NIPS.
Answer: B
NEW QUESTION 88
A user's computer has been running slowly when the user tries to access web pages. A security analyst runs the command netstat -aon from the command line and receives the following output:
Which of the following lines indicates the computer may be compromised?
- A. Line 3
- B. Line 2
- C. Line 5
- D. Line 4
- E. Line 1
- F. Line 6
Answer: D
NEW QUESTION 89
......
Pass CompTIA CS0-002 exam - questions - convert Tets Engine to PDF: https://passguide.validtorrent.com/CS0-002-valid-exam-torrent.html