CompTIA CompTIA Certifications CS0-002 Questions & Answers

• Question 901:

  A company's marketing emails are either being found in a spam folder or not being delivered at all. The security analyst investigates the issue and discovers the emails in question are being sent on behalf of the company by a third party,

  mail.marketing.com. Below is the existing SPF record:

  v=spf1 a mx -all

  Which of the following updates to the SPF record will work BEST to prevent the emails from being marked as spam or blocked?

  A. v=spf1 a mx redirect:mail.marketing.com ?all

  B. v=spf1 a mx include:mail.marketing.com -all

  C. v=spf1 a mx +all

  D. v=spf1 a mx include:mail.marketing.com ~all

  Correct Answer: B

• Question 902:

  A security analyst is reviewing the following web server log: GET %2f..%2f..%2f.. %2f.. %2f.. %2f.. %2f../etc/passwd Which of the following BEST describes the issue?

  A. Directory traversal exploit

  B. Cross-site scripting

  C. SQL injection

  D. Cross-site request forgery

  Correct Answer: A

• Question 903:

  While analyzing logs from a WAF, a cybersecurity analyst finds the following:

  "GET /form.php?id=463225%2b%2575%256e%2569%256f%256e%2b%2573%2574% 2box3133333731,1223,1224andname=andstate=IL"

  Which of the following BEST describes what the analyst has found?

  A. This is an encrypted GET HTTP request

  B. A packet is being used to bypass the WAF

  C. This is an encrypted packet

  D. This is an encoded WAF bypass

  Correct Answer: D

• Question 904:

  A security analyst at a technology solutions firm has uncovered the same vulnerabilities on a vulnerability scan for a long period of time. The vulnerabilities are on systems that are dedicated to the firm's largest client. Which of the following is MOST likely inhibiting the remediation efforts?

  A. The parties have an MOU between them that could prevent shutting down the systems

  B. There is a potential disruption of the vendor-client relationship

  C. Patches for the vulnerabilities have not been fully tested by the software vendor

  D. There is an SLA with the client that allows very little downtime

  Correct Answer: D

• Question 905:

  A security analyst working in the SOC recently discovered Balances m which hosts visited a specific set of domains and IPs and became infected with malware. Which of the following is the MOST appropriate action to take in the situation?

  A. implement an IPS signature for the malware and update the blacklisting for the associated domains and IPs

  B. Implement an IPS signature for the malware and another signature request to Nock all the associated domains and IPs

  C. Implement a change request to the firewall setting to not allow traffic to and from the IPs and domains

  D. Implement an IPS signature for the malware and a change request to the firewall setting to not allow traffic to and from the IPs and domains

  Correct Answer: A

• Question 906:

  The inability to do remote updates of certificates. keys software and firmware is a security issue commonly associated with:

  A. web servers on private networks.

  B. HVAC control systems

  C. smartphones

  D. firewalls and UTM devices

  Correct Answer: B

• Question 907:

  A security manager has asked an analyst to provide feedback on the results of a penetration lest. After reviewing the results the manager requests information regarding the possible exploitation of vulnerabilities Much of the following information data points would be MOST useful for the analyst to provide to the security manager who would then communicate the risk factors to senior management? (Select TWO)

  A. Probability

  B. Adversary capability

  C. Attack vector

  D. Impact

  E. Classification

  F. Indicators of compromise

  Correct Answer: AD

• Question 908:

  Which of the following are components of the intelligence cycle? (Select TWO.)

  A. Collection

  B. Normalization

  C. Response

  D. Analysis

  E. Correction

  F. Dissension

  Correct Answer: BE

• Question 909:

  Which of the following would a security engineer recommend to BEST protect sensitive system data from being accessed on mobile devices?

  A. Use a UEFl boot password.

  B. Implement a self-encrypted disk.

  C. Configure filesystem encryption

  D. Enable Secure Boot using TPM

  Correct Answer: C

• Question 910:

  A cybersecurity analyst needs to rearchitect the network using a firewall and a VPN server to achieve the highest level of security To BEST complete this task, the analyst should place the:

  A. firewall behind the VPN server

  B. VPN server parallel to the firewall

  C. VPN server behind the firewall

  D. VPN on the firewall

  Correct Answer: C