CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 891:

  A threat feed notes malicious actors have been infiltrating companies and exfiltration data to a specific set of domains Management at an organization wants to know if it is a victim Which of the following should the security analyst recommend to identity this behavior without alerting any potential malicious actors?

  A. Create an IPS rule to block these domains and trigger an alert within the SIEM tool when these domains are requested

  B. Add the domains to a DNS sinkhole and create an alert m the SIEM toot when the domains are queried

  C. Look up the IP addresses for these domains and search firewall logs for any traffic being sent to those IPs over port 443

  D. Query DNS logs with a SIEM tool for any hosts requesting the malicious domains and create alerts based on this information

  Correct Answer: D

• Question 892:

  A cybersecurity analyst is reading a daily intelligence digest of new vulnerabilities The type of vulnerability that should be disseminated FIRST is one that:

  A. enables remote code execution that is being exploited in the wild.

  B. enables data leakage but is not known to be m the environment

  C. enables lateral movement and was reported as a proof of concept

  D. affected the organization in the past but was probably contained and eradicated

  Correct Answer: A

• Question 893:

  A security analyst implemented a solution that would analyze the attacks that the organization's firewalls failed to prevent. The analyst used the existing systems to enact the solution and executed the following command:

  S sudo nc -1 -v -c maildemon . py 25 caplog, txt

  Which of the following solutions did the analyst implement?

  A. Log collector

  B. Crontab mail script

  C. Snikhole

  D. Honeypot

  Correct Answer: A

• Question 894:

  A large software company wants to move source control and deployment pipelines into a cloud- computing environment. Due to the nature of the business management determines the recovery time objective needs to be within one hour. Which of the following strategies would put the company in the BEST position to achieve the desired recovery time?

  A. Establish an alternate site with active replication to other regions

  B. Configure a duplicate environment in the same region and load balance between both instances

  C. Set up every cloud component with duplicated copies and auto scaling turned on

  D. Create a duplicate copy on premises that can be used for failover in a disaster situation

  Correct Answer: A

• Question 895:

  A cybersecurity analyst is supposing an incident response effort via threat intelligence. Which of the following is the analyst MOST likely executing?

  A. Requirements analysis and collection planning

  B. Containment and eradication

  C. Recovery and post-incident review

  D. Indicator enrichment and research pivoting

  Correct Answer: D

• Question 896:

  An organization has several system that require specific logons Over the past few months, the security analyst has noticed numerous failed logon attempts followed by password resets. Which of the following should the analyst do to reduce the occurrence of legitimate failed logons and password resets?

  A. Use SSO across all applications

  B. Perform a manual privilege review

  C. Adjust the current monitoring and logging rules

  D. Implement multifactor authentication

  Correct Answer: A

• Question 897:

  An analyst has been asked to provide feedback regarding the control required by a revised regulatory framework At this time, the analyst only needs to focus on the technical controls. Which of the following should the analyst provide an assessment of?

  A. Tokenization of sensitive data

  B. Establishment o' data classifications

  C. Reporting on data retention and purging activities

  D. Formal identification of data ownership

  E. Execution of NDAs

  Correct Answer: A

• Question 898:

  A security analyst has discovered suspicious traffic and determined a host is connecting to a known malicious website. The MOST appropriate action for the analyst to take would be lo implement a change request to:

  A. update the antivirus software

  B. configure the firewall to block traffic to the domain

  C. add the domain to the blacklist

  D. create an IPS signature for the domain

  Correct Answer: B

• Question 899:

  A security analyst is supporting an embedded software team. Which of the following is the BEST recommendation to ensure proper error handling at runtime?

  A. Perform static code analysis.

  B. Require application fuzzing.

  C. Enforce input validation

  D. Perform a code review

  Correct Answer: B

• Question 900:

  A security analyst has discovered trial developers have installed browsers on all development servers in the company's cloud infrastructure and are using them to browse the Internet.

  Which of the following changes should the security analyst make to BEST protect the environment?

  A. Create a security rule that blocks Internet access in the development VPC

  B. Place a jumpbox m between the developers' workstations and the development VPC

  C. Remove the administrator profile from the developer user group in identity and access management

  D. Create an alert that is triggered when a developer installs an application on a server

  Correct Answer: A