CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 621:

  A security analyst needs to provide a copy of a hard drive for forensic analysis. Which of the following would allow the analyst to perform the task?

  A. dcfldd if=/dev/one of=/mnt/usb/evidence.bin hash=md5, sha1 hashlog=/mnt/usb/evidence.bin.hashlog

  B. dd if=/dev/sda of=/mnt/usb/evidence.bin bs=4096; sha5l2sum /mnt/usb/evidence.bin > /mnt/usb/evidence.bin.hash

  C. tar -zcf /mnt/usb/evidence.tar.gz / -except /mnt; sha256sum /mnt/usb/evidence.tar.gz > /mnt/usb/evidence.tar.gz.hash

  D. find / -type f -exec cp {} /mnt/usb/evidence/ \; sha1sum /mnt/usb/evidence/* > /mnt/usb/evidence/evidence.hash

  Correct Answer: B

• Question 622:

  A company's application development has been outsourced to a third-party development team. Based on the SLA. The development team must follow industry best practices for secure coding. Which of the following is the BEST way to verify this agreement?

  A. Input validation

  B. Security regression testing

  C. Application fuzzing

  D. User acceptance testing

  E. Stress testing

  Correct Answer: C

  Fuzzing or fuzz testing is a dynamic application security testing technique for negative testing. Fuzzing aims to detect known, unknown, and zero-day vulnerabilities https://brightsec.com/blog/fuzzing/

• Question 623:

  An analyst determines a security incident has occurred

  Which of the following is the most appropnate NEXT step in an incident response plan?

  A. Consult the malware analysis process

  B. Consult the disaster recovery plan

  C. Consult the data classification process

  D. Consult the communications plan

  Correct Answer: D

• Question 624:

  A security analyst needs to determine the best method for securing access to a top-secret datacenter Along with an access card and PIN code, which of the following additional authentication methods would be BEST to enhance the datacenter's security?

  A. Physical key

  B. Retinal scan

  C. Passphrase

  D. Fingerprint

  Correct Answer: B

• Question 625:

  A routine vulnerability scan detected a known vulnerability in a critical enterprise web application. Which of the following would be the BEST next step?

  A. Submit a change request to have the system patched

  B. Evaluate the risk and criticality to determine it further action is necessary

  C. Notify a manager of the breach and initiate emergency procedures.

  D. Remove the application from production and Inform the users.

  Correct Answer: A

• Question 626:

  A company offers a hardware security appliance to customers that provides remote administration of a device on the customer's network. Customers are not authorized to alter the configuration. The company deployed a software process to manage unauthorized changes to the appliance, log them, and forward them to a central repository for evaluation.

  Which of the following processes is the company using to ensure the appliance is not altered from its original configured state?

  A. CI/CD

  B. Software assurance

  C. Anti-tamper

  D. Change management

  Correct Answer: D

  change management - process through which changes to the configuration of information systems are monitored and controlled. Each individual component should have a separate document or database record that describes its initial state and subsequent changes

• Question 627:

  In SIEM software, a security analysis selected some changes to hash signatures from monitored files during the night followed by SMB brute-force attacks against the file servers.

  Based on this behavior, which of the following actions should be taken FIRST to prevent a more serious compromise?

  A. Fully segregate the affected servers physically in a network segment, apart from the production network.

  B. Collect the network traffic during the day to understand if the same activity is also occurring during business hours

  C. Check the hash signatures, comparing them with malware databases to verify if the files are infected.

  D. Collect all the files that have changed and compare them with the previous baseline

  Correct Answer: A

• Question 628:

  A security learn implemented a SCM as part for its security-monitoring program there is a requirement to integrate a number of sources Into the SIEM to provide better context relative to the events being processed. Which of the following BST describes the result the security learn hopes to accomplish by adding these sources?

  A. Data enrichment

  B. Continuous integration

  C. Machine learning

  D. Workflow orchestration

  Correct Answer: A

• Question 629:

  An organization has specific technical risk mitigation configurations that must be implemented before a new server can be approved for production Several critical servers were recently deployed with the antivirus missing unnecessary ports disabled and insufficient password complexity.

  Which of the following should the analyst recommend to prevent a recurrence of this risk exposure?

  A. Perform password-cracking attempts on all devices going into production

  B. Perform an Nmap scan on all devices before they are released to production

  C. Perform antivirus scans on all devices before they are approved for production

  D. Perform automated security controls testing of expected configurations pnor to production

  Correct Answer: D

• Question 630:

  An analyst is responding to an incident within a cloud infrastructure Based on the logs and traffic analysis, the analyst thinks a container has been compromised.

  Which of the following should Ihe analyst do FIRST?

  A. Perform threat hunting in other areas of the cloud infrastructure

  B. Contact law enforcement to report the incident

  C. Perform a root cause analysis on the container and the service logs

  D. Isolate the container from production using a predefined policy template

  Correct Answer: D