CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 751:

  A routine vulnerability scan detected a known vulnerability in a critical enterprise web application. Which of the following would be the BEST next step?

  A. Submit a change request to have the system patched

  B. Evaluate the risk and criticality to determine it further action is necessary

  C. Notify a manager of the breach and initiate emergency procedures.

  D. Remove the application from production and Inform the users.

  Correct Answer: B

• Question 752:

  A security analyst identified one server that was compromised and used as a data making machine, and a few of the hard drive that was created. Which of the following will MOST likely provide information about when and how the machine was compromised and where the malware is located?

  A. System timeline reconstruction

  B. System registry extraction

  C. Data carving

  D. Volatile memory analysts

  Correct Answer: A

• Question 753:

  A company wants to ensure confidential data from its storage media files is sanitized so the drives cannot oe reused. Which of the following is the BEST approach?

  A. Degaussing

  B. Shreoding

  C. Formatting

  D. Encrypting

  Correct Answer: B

• Question 754:

  During an incident response procedure, a security analyst collects a hard drive to analyze a possible vector of compromise. There is a Linux swap partition on the hard drive that needs to be checked. Which of the following, should the analyst use to extract human-readable content from the partition?

  A. strings

  B. head

  C. fsstat

  D. dd

  Correct Answer: A

• Question 755:

  An organization is focused on restructuring its data governance programs and an analyst has been Tasked with surveying sensitive data within the organization. Which of the following is the MOST accurate method for the security analyst to complete this assignment?

  A. Perform an enterprise-wide discovery scan.

  B. Consult with an internal data custodian.

  C. Review enterprise-wide asset Inventory.

  D. Create a survey and distribute it to data owners.

  Correct Answer: D

• Question 756:

  In response to an audit finding, a company's Chief information Officer (CIO) instructed the security department to Increase the security posture of the vulnerability management program. Currency, the company's vulnerability management program has the following attributes.

  Which of the following would BEST Increase the security posture of the vulnerably management program?

  A. Expand the ports Being scanned lo Include al ports increase the scan interval to a number the business win accept without causing service interruption. Enable authentication and perform credentialed scans

  B. Expand the ports being scanned to Include all ports. Keep the scan interval at its current level Enable authentication and perform credentialed scans.

  C. Expand the ports being scanned to Include at ports increase the scan interval to a number the business will accept without causing service Interruption. Continue unauthenticated scans.

  D. Continue scanning the well-known ports increase the scan interval to a number the business will accept without causing service Interruption. Enable authentication and perform credentialed scans.

  Correct Answer: A

• Question 757:

  Security awareness and compliance programs are most effective at reducing the likelihood and impact of attacks from:

  A. advanced persistent threats.

  B. corporate spies.

  C. hacktivists.

  D. insider threats.

  Correct Answer: D

• Question 758:

  A security analyst needs to recommend a solution that will allow users at a company to access cloud-based SaaS services but also prevent them from uploading and exfiltrating data. Which of the following solutions should the security analyst recommend?

  A. CASB

  B. MFA

  C. VPN

  D. VPS

  E. DLP

  Correct Answer: E

• Question 759:

  An organization has a strict policy that if elevated permissions are needed, users should always run commands under their own account, with temporary administrator privileges if necessary. A security analyst is reviewing syslog entries and sees the following:

  

  Which of the following entries should cause the analyst the MOST concern?

  A. <100>2 2020-01-10T19:33:41.002z webserver su 201 32001 = BOM ' su vi httpd.conf' failed for joe

  B. <100>2 2020-01-10T20:36:36.0010z financeserver su 201 32001 = BOM ' sudo vi users.txt success

  C. <100> 2020-01-10T19:33:48.002z webserver sudo 201 32001 = BOM ' su vi syslog.conf failed for jos

  D. <100> 2020-01-10T19:34..002z financeserver su 201 32001 = BOM ' su vi success

  E. <100> 2020-01-10T19:33:48.002z webserver sudo 201 32001 = BOM ' su vi httpd.conf' success

  Correct Answer: A

• Question 760:

  Which of the following is a reason to take a DevSecOps approach to a software assurance program?

  A. To find and fix security vulnerabilities earlier in the development process

  B. To speed up user acceptance testing in order to deliver the code to production faster

  C. To separate continuous integration from continuous development in the SDLC

  D. To increase the number of security-related bug fixes worked on by developers

  Correct Answer: A