CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 381:

  A nuclear facility manager determined the need to monitor utilization of water within the facility. A startup company just announced a state-of-the-art solution to address the need for integrating the business and ICS network. The solution requires a very small agent to be installed on the ICS equipment. Which of the following is the MOST important security control for the manager to invest in to protect the facility?

  A. Run a penetration test on the installed agent.

  B. Require that the solution provider make the agent source code available for analysis.

  C. Require through guides for administrator and users.

  D. Install the agent for a week on a test system and monitor the activities.

  Correct Answer: D

• Question 382:

  A security analyst is assisting with a computer crime investigation and has been asked to secure a PC and deliver it to the forensic lab. Which of the following items would be MOST helpful to secure the PC? (Choose three.)

  A. Tamper-proof seals

  B. Faraday cage

  C. Chain of custody form

  D. Drive eraser

  E. Write blockers

  F. Network tap

  G. Multimeter

  Correct Answer: ABC

• Question 383:

  Which of the following tools should a cybersecurity analyst use to verify the integrity of a forensic image before and after an investigation?

  A. strings

  B. sha1sum

  C. file

  D. dd

  E. gzip

  Correct Answer: B

• Question 384:

  A centralized tool for organizing security events and managing their response and resolution is known as:

  A. SIEM

  B. HIPS

  C. Syslog

  D. Wireshark

  Correct Answer: A

• Question 385:

  After a recent security breach, it was discovered that a developer had promoted code that had been written to the production environment as a hotfix to resolve a user navigation issue that was causing issues for several customers. The code had inadvertently granted administrative privileges to all users, allowing inappropriate access to sensitive data and reports. Which of the following could have prevented this code from being released into the production environment?

  A. Cross training

  B. Succession planning

  C. Automated reporting

  D. Separation of duties

  Correct Answer: D

• Question 386:

  Which of the following countermeasures should the security administrator apply to MOST effectively mitigate Bootkit-level infections of the organization's workstation devices?

  A. Remove local administrator privileges.

  B. Configure a BIOS-level password on the device.

  C. Install a secondary virus protection application.

  D. Enforce a system state recovery after each device reboot.

  Correct Answer: A

• Question 387:

  A new zero-day vulnerability was discovered within a basic screen capture app, which is used throughout the environment. Two days after discovering the vulnerability, the manufacturer of the software has not announced a remediation or if there will be a fix for this newly discovered vulnerability. The vulnerable application is not uniquely critical, but it is used occasionally by the management and executive management teams. The vulnerability allows remote code execution to gain privileged access to the system. Which of the following is the BEST course of actions to mitigate this threat?

  A. Work with the manufacturer to determine the time frame for the fix.

  B. Block the vulnerable application traffic at the firewall and disable the application services on each computer.

  C. Remove the application and replace it with a similar non-vulnerable application.

  D. Communicate with the end users that the application should not be used until the manufacturer has resolved the vulnerability.

  Correct Answer: D

• Question 388:

  Which of the following has the GREATEST impact to the data retention policies of an organization?

  A. The CIA classification matrix assigned to each piece of data

  B. The level of sensitivity of the data established by the data owner

  C. The regulatory requirements concerning the data set

  D. The technical constraints of the technology used to store the data

  Correct Answer: D

• Question 389:

  A company has decided to process credit card transactions directly. Which of the following would meet the requirements for scanning this type of data?

  A. Quarterly

  B. Yearly

  C. Bi-annually

  D. Monthly

  Correct Answer: A

• Question 390:

  A security analyst begins to notice the CPU utilization from a sinkhole has begun to spike. Which of the following describes what may be occurring?

  A. Someone has logged on to the sinkhole and is using the device.

  B. The sinkhole has begun blocking suspect or malicious traffic.

  C. The sinkhole has begun rerouting unauthorized traffic.

  D. Something is controlling the sinkhole and causing CPU spikes due to malicious utilization.

  Correct Answer: C