CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 481:

  A cybersecurity analyst has been asked to follow a corporate process that will be used to manage vulnerabilities for an organization. The analyst notices the policy has not been updated in three years. Which of the following should the analyst check to ensure the policy is still accurate?

  A. Threat intelligence reports

  B. Technical constraints

  C. Corporate minutes

  D. Governing regulations

  Correct Answer: A

• Question 482:

  Creating a lessons learned report following an incident will help an analyst to communicate which of the following information? (Select TWO)

  A. Root cause analysis of the incident and the impact it had on the organization

  B. Outline of the detailed reverse engineering steps for management to review

  C. Performance data from the impacted servers and endpoints to report to management

  D. Enhancements to the policies and practices that will improve business responses

  E. List of IP addresses, applications, and assets

  Correct Answer: AD

• Question 483:

  A computer has been infected with a virus and is sending out a beacon to command and control server through an unknown service. Which of the following should a security technician implement to drop the traffic going to the command and control server and still be able to identify the infected host through firewall logs?

  A. Sinkhole

  B. Block ports and services

  C. Patches

  D. Endpoint security

  Correct Answer: A

  Reference: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-DNS-Sinkhole/ta-p/58891

• Question 484:

  A web application has a newly discovered vulnerability in the authentication method used to validate known company users. The user ID of Admin with a password of "password" grants elevated access to the application over the Internet. Which of the following is the BEST method to discover the vulnerability before a production deployment?

  A. Manual peer review

  B. User acceptance testing

  C. Input validation

  D. Stress test the application

  Correct Answer: C

• Question 485:

  Which of the following policies BEST explains the purpose of a data ownership policy?

  A. The policy should describe the roles and responsibilities between users and managers, and the management of specific data types.

  B. The policy should establish the protocol for retaining information types based on regulatory or business needs.

  C. The policy should document practices that users must adhere to in order to access data on the corporate network or Internet.

  D. The policy should outline the organization's administration of accounts for authorized users to access the appropriate data.

  Correct Answer: D

• Question 486:

  Several users have reported that when attempting to save documents in team folders, the following message is received:

  The File Cannot Be Copied or Moved ?Service Unavailable.

  Upon further investigation, it is found that the syslog server is not obtaining log events from the file server to which the users are attempting to copy files. Which of the following is the MOST likely scenario causing these issues?

  A. The network is saturated, causing network congestion

  B. The file server is experiencing high CPU and memory utilization

  C. Malicious processes are running on the file server

  D. All the available space on the file server is consumed

  Correct Answer: A

• Question 487:

  A security analyst is performing a review of Active Directory and discovers two new user accounts in the accounting department. Neither of the users has elevated permissions, but accounts in the group are given access to the company's sensitive financial management application by default. Which of the following is the BEST course of action?

  A. Follow the incident response plan for the introduction of new accounts

  B. Disable the user accounts

  C. Remove the accounts' access privileges to the sensitive application

  D. Monitor the outbound traffic from the application for signs of data exfiltration

  E. Confirm the accounts are valid and ensure role-based permissions are appropriate

  Correct Answer: E

• Question 488:

  Which of the following actions should occur to address any open issues while closing an incident involving various departments within the network?

  A. Incident response plan

  B. Lessons learned report

  C. Reverse engineering process

  D. Chain of custody documentation

  Correct Answer: B

• Question 489:

  A security analyst has determined that the user interface on an embedded device is vulnerable to common SQL injections. The device is unable to be replaced, and the software cannot be upgraded. Which of the following should the security analyst recommend to add additional security to this device?

  A. The security analyst should recommend this device be placed behind a WAF.

  B. The security analyst should recommend an IDS be placed on the network segment.

  C. The security analyst should recommend this device regularly export the web logs to a SIEM system.

  D. The security analyst should recommend this device be included in regular vulnerability scans.

  Correct Answer: A

• Question 490:

  Which of the following principles describes how a security analyst should communicate during an incident?

  A. The communication should be limited to trusted parties only.

  B. The communication should be limited to security staff only.

  C. The communication should come from law enforcement.

  D. The communication should be limited to management only.

  Correct Answer: A