CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 711:

  Company A is m the process of merging with Company B As part of the merger, connectivity between the ERP systems must be established so portent financial information can be shared between the two entitles. Which of the following will establish a more automated approach to secure data transfers between the two entities?

  A. Set up an FTP server that both companies can access and export the required financial data to a folder.

  B. Set up a VPN between Company A and Company B. granting access only lo the ERPs within the connection

  C. Set up a PKI between Company A and Company B and Intermediate shared certificates between the two entities

  D. Create static NATs on each entity's firewalls that map lo the ERP systems and use native ERP authentication to allow access.

  Correct Answer: B

• Question 712:

  A cyber-security analyst is implementing a new network configuration on an existing network access layer to prevent possible physical attacks. Which of the following BEST describes a solution that would apply and cause fewer issues during the deployment phase?

  A. Implement port security with one MAC address per network port of the switch.

  B. Deploy network address protection with DHCP and dynamic VLANs.

  C. Configure 802.1X and EAPOL across the network

  D. Implement software-defined networking and security groups for isolation

  Correct Answer: A

• Question 713:

  Some hard disks need to be taken as evidence for further analysis during an incident response.

  Which of the following procedures must be completed FIRST for this type of evtdertce acquisition?

  A. Extract the hard drives from the compromised machines and then plug them into a forensics machine to apply encryption over the stored data to protect it from non-authorized access

  B. Build the chain-of-custody document, noting the media model senal number size vendor, date, and time of acquisition

  C. Perform a disk sanitation using the command 8dd if=/d/zo of=/d/c b?iM over the media that wil receive a copy of the coHected data

  D. Execute the command #dd if=/dev/ada of=/dev/adc ba=5i2 to clone the evidence data to external media to prevent any further change

  Correct Answer: B

• Question 714:

  Which of the following BEST identifies the appropriate use of threat intelligence as a function of detection and response?

  A. To identify weaknesses in an organization's security posture

  B. To identify likely attack scenarios within an organization

  C. To build a business security plan for an organization

  D. To build a network segmentation strategy

  Correct Answer: B

• Question 715:

  An organization discovers motherboards within the environment that appear to have been physically altered during the manufacturing process. Which of the following is the BEST course of action to mitigate the risk of this reoccurring?

  A. Perform an assessment of the firmware to determine any malicious modifications.

  B. Conduct a trade study to determine if the additional risk constitutes further action.

  C. Coordinate a supply chain assessment to ensure hardware authenticity.

  D. Work with IT to replace the devices with the known-altered motherboards.

  Correct Answer: C

• Question 716:

  A manufacturing company uses a third-party service provider lor Tier 1 security support One of the requirements is that the provider must only source talent from its own country due to geopolitical and national security interests/

  Which of the following can the manufacturing company implement to ensure the third-party service provider meets this requirement?

  A. Implement a secure supply chain program with governance

  B. Implement blacklisting for IP addresses from outside the country

  C. Implement strong authentication controls for all contractors

  D. Implement user behavior analytics for key staff members

  Correct Answer: A

• Question 717:

  Which of the following are the MOST likely reasons lo include reporting processes when updating an incident response plan after a breach? (Select TWO).

  A. To establish a clear chain of command

  B. To meet regulatory requirements for timely reporting

  C. To limit reputation damage caused by the breach

  D. To remediate vulnerabilities that led to the breach

  E. To isolate potential insider threats

  F. To provide secure network design changes

  Correct Answer: AB

  A. To establish a clear chain of command

  B. To meet regulatory requirements for timely reporting

  A. To establish a clear chain of command is important because it ensures that the individuals involved in the incident response process understand their roles and responsibilities and can work together effectively to contain the incident and minimize damage. B. To meet regulatory requirements for timely reporting is important because it ensures that the incident is communicated to the appropriate individuals and organizations in a timely manner, which can help to meet regulatory requirements and limit reputation damage.

• Question 718:

  Which of the following BEST explains the function of trusted firmware updates as they relate to hardware assurance?

  A. Trusted firmware updates provide organizations with development, compilation, remote access, and customization for embedded devices.

  B. Trusted firmware updates provide organizations with security specifications, open- source libraries, and custom toots for embedded devices.

  C. Trusted firmware updates provide organizations with remote code execution, distribution, maintenance, and extended warranties for embedded devices

  D. Trusted firmware updates provide organizations with secure code signing, distribution, installation. and attestation for embedded devices.

  Correct Answer: D

• Question 719:

  During a forensic investigation, a security analyst reviews some Session Initiation Protocol packets that came from a suspicious IP address. Law enforcement requires access to a VoIP call that originated from the suspicious IP address. Which of the following should the analyst use to accomplish this task?

  A. Wireshark

  B. iptables

  C. Tcpdump

  D. Netflow

  Correct Answer: A

• Question 720:

  While implementing a PKI for a company, a security analyst plans to utilize a dedicated server as the certAcate authority that is only used to sign intermediate certificates. Which of the following are the MOST secure states for the certificate authority server when it is not in use? (Select TWO)

  A. On a private VLAN

  B. Full disk encrypted

  C. Powered off

  D. Backed up hourly

  E. VPN accessible only

  F. Air gapped

  Correct Answer: CF