[Mar 14, 2023] CompTIA CS0-002 Real Exam Questions and Answers FREE
Pass CompTIA CS0-002 Exam Info and Free Practice Test
Why Has the CompTIA CySA+ Become So Popularly Accepted?
Unlike other cybersecurity certificates, CySA+ checks an individual’s knowledge comprehensively by combining both performance-based and multiple-choice questions in its exam. The US Department of Defense has also expressed its confidence in the value and validity of CompTIA CySA+ and approved it as a DoD 8570 baseline certification in 5 different professional categories, four of which are Cybersecurity Service Provider (CSSP) jobs. These are some out of many reasons why CySA+ is highly respected.
Certification Overview
CySA+ is a high-in-demand certificate, thanks to the fast growth of the information security segment of the IT field. As you would expect, the earning potentials are equally attractive. The average annual salary for an information security analyst was $99,730 in 2019, according to the Bureau of Labor Statistics.
When it comes to warding off attackers, anti-virus software, firewalls, and other traditional solutions don’t cut it. Consequently, organizations need a more dynamic approach to their system’s security. Professionals with CySA+ help in this regard. This certification endorses one's proficiency in using analytics-based plans to strengthen security. A CySA+ certified analyst can, through continuous monitoring, preemptively detect and combat malware and advance persistent threats.
This certification is a logical next step and an impressive addition for an IT professional who has already earned CompTIA Security+. More so, it puts you closer to becoming a CompTIA Advanced Security Practitioner (CASP+).
NEW QUESTION 174
The help desk provided a security analyst with a screenshot of a user's desktop:
For which of the following is aircrack-ng being used?
- A. Wireless access point discovery
- B. PCAP data collection
- C. Brute-force attack
- D. Rainbow attack
Answer: D
NEW QUESTION 175
An organization is performing vendor selection activities for penetration testing, and a security analyst is reviewing the MOA and rules of engagement, which were supplied with proposals.
Which of the following should the analyst expect will be included in the documents and why?
- A. The MOA should address the client SLA in relation to reporting results to regulatory authorities, including issuing banks for organizations that process cardholder data.
- B. The rules of engagement should include detailed results of the penetration scan, including all findings, as well as designation of whether vulnerabilities identified during the scanning phases are found to be exploitable during the penetration test.
- C. The exploitation standards should be addressed in the rules of engagement to ensure both parties are aware of the depth of exploitation that will be attempted by penetration testers.
- D. The scope of the penetration test should be included in the MOA to ensure penetration testing is conducted against only specifically authorized network resources.
Answer: B
NEW QUESTION 176
During a routine log review, a security analyst has found the following commands that cannot be identified from the Bash history log on the root user.
Which of the following commands should the analyst investigate FIRST?
- A. Line 4
- B. Line 5
- C. Line 6
- D. Line 3
- E. Line 2
- F. Line 1
Answer: E
NEW QUESTION 177
A company recently experienced financial fraud, which included shared passwords being compromised and improper levels of access being granted The company has asked a security analyst to help
improve its controls.
Which of the following will MOST likely help the security analyst develop better controls?
- A. An indicator of compromise
- B. An incident response plan
- C. An evidence summarization
- D. A lessons-learned report
Answer: B
NEW QUESTION 178
A cybersecurity analyst is supposing an incident response effort via threat intelligence. Which of the following is the analyst MOST likely executing?
- A. Requirements analysis and collection planning
- B. Containment and eradication
- C. Recovery and post-incident review
- D. Indicator enrichment and research pivoting
Answer: A
NEW QUESTION 179
Due to a nse m cyberattackers seeking PHI, a healthcare company that collects highly sensitive data from millions of customers is deploying a solution that will ensure the customers' data is protected by the organization internally and externally Which of the following countermeasures can BEST prevent the loss of customers' sensitive data?
- A. Implement privileged access management
- B. Implement multifactor authentication
- C. Implement a nsk management process
- D. Add more security resources to the environment
Answer: A
NEW QUESTION 180
While analyzing logs from a WAF, a cybersecurity analyst finds the following:
Which of the following BEST describes what the analyst has found?
- A. This is an encrypted packet
- B. This is an encrypted GET HTTP request
- C. This is an encoded WAF bypass
- D. A packet is being used to bypass the WAF
Answer: C
NEW QUESTION 181
During an investigation, a security analyst determines suspicious activity occurred during the night shift over the weekend. Further investigation reveals the activity was initiated from an internal IP going to an external website.
Which of the following would be the MOST appropriate recommendation to prevent the activity from happening in the future?
- A. A firewall rule that will block traffic from the specific IP addresses
- B. An IPS signature modification for the specific IP addresses
- C. An IDS signature modification for the specific IP addresses
- D. A firewall rule that will block port 80 traffic
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION 182
The Chief Information Officer (CIO) of a large healthcare institution is concerned about all machines having direct access to sensitive patient information. Which of the following should the security analyst implement to BEST mitigate the risk of sensitive data exposure?
- A. Network segmentation
- B. A cloud access service broker system
- C. MFA on all workstations
- D. NAC to ensure minimum standards are met
Answer: A
NEW QUESTION 183
An analyst performs a routine scan of a host using Nmap and receives the following output:
Which of the following should the analyst investigate FIRST?
- A. Port 22
- B. Port 21
- C. Port 23
- D. Port 80
Answer: C
NEW QUESTION 184
A malicious hacker wants to gather guest credentials on a hotel 802.11 network. Which of the following tools is the malicious hacker going to use to gain access to information found on the hotel network?
- A. Aircrak-ng
- B. Nikto
- C. Nessus
- D. tcpdump
Answer: B
NEW QUESTION 185
A security analyst has received reports of very slow, intermittent access to a public-facing corporate server. Suspecting the system may be compromised, the analyst runs the following commands:
Based on the output from the above commands, which of the following should the analyst do NEXT to further the investigation?
- A. Run crontab -r; rm -rf /tmp/.t to remove and disable the malware on the system.
- B. Examine the server logs for further indicators of compromise of a web application.
- C. Run kill -9 1325 to bring the load average down so the server is usable again.
- D. Perform a binary analysis on the /tmp/.t/t file, as it is likely to be a rogue SSHD server.
Answer: B
NEW QUESTION 186
A company's security administrator needs to automate several security processes related to testing for the existence of changes within the environment Conditionally other processes will need to be created based on input from prior processes
Which of the following is the BEST method for accomplishing this task?
- A. API integration and data enrichment
- B. Workflow orchestration and scripting
- C. Machine learning and process monitoring
- D. Continuous integration and configuration management
Answer: B
NEW QUESTION 187
A security analyst is scanning the network to determine if a critical security patch was applied to all systems in an enterprise. The Organization has a very low tolerance for risk when it comes to resource availability. Which of the following is the BEST approach for configuring and scheduling the scan?
- A. Make sure the scan is credentialed, uses a ironed plug-in set, scans all host IP addresses in the enterprise, and is scheduled during off-business hours so it has the least impact on operations.
- B. Make sure the scan is uncredentialed, covers at hosts in the patch management system, and Is scheduled during of business hours so it has the least impact on operations.
- C. Make sure the scan is credentialed, has the latest software and signature versions, covers all external hosts in the patch management system and is scheduled during off-business hours so it has the least impact on operations.
- D. Make sure the scan is credentialed, covers at hosts in the patch management system, and is scheduled during business hours so it can be terminated if it affects business operations.
Answer: A
NEW QUESTION 188
Which of the following utilities could be used to resolve an IP address to a domain name, assuming the address has a PTR record?
- A. arp
- B. ping
- C. ifconfig
- D. nbtstat
Answer: B
NEW QUESTION 189
......
CompTIA CS0-002 Exam Syllabus Topics:
| Topic | Details |
|---|---|
Threat and Vulnerability Management - 22% | |
| Explain the importance of threat data and intelligence. | 1. Intelligence sources
2. Confidence levels
4. Threat classification
5. Threat actors
6. Intelligence cycle
7. Commodity malware
|
| Given a scenario, utilize threat intelligence to support organizational security. | 1. Attack frameworks
2. Threat research
3. Threat modeling methodologies
3. Threat intelligence sharing with supported functions
|
| Given a scenario, perform vulnerability management activities. | 1. Vulnerability identification
2. Validation
3. Remediation/mitigation
4. Scanning parameters and criteria
5. Inhibitors to remediation
|
| Given a scenario, analyze the output from common vulnerability assessment tools. | 1.Web application scanner
2.Infrastructure vulnerability scanner
3.Software assessment tools and techniques
4.Enumeration
5. Wireless assessment tools
6. Cloud infrastructure assessment tools
|
| Explain the threats and vulnerabilities associated with specialized technology. | 1. Mobile 2. Internet of Things (IoT) 3. Embedded 4. Real-time operating system (RTOS) 5. System-on-Chip (SoC) 6. Field programmable gate array (FPGA) 7. Physical access control 8. Building automation systems 9. Vehicles and drones
10. Workflow and process automation systems
|
| Explain the threats and vulnerabilities associated with operating in the cloud. | 1. Cloud service models
2. Cloud deployment models
3. Function as a Service (FaaS)/serverless architecture
|
| Given a scenario, implement controls to mitigate attacks and software vulnerabilities. | 1. Attack types
2. Vulnerabilities
|
Software and Systems Security - 18% | |
| Given a scenario, apply security solutions for infrastructure management. | 1. Cloud vs. on-premises 2. Asset management
3. Segmentation
4. Network architecture
5. Change management
7. Containerization
9. Cloud access security broker (CASB) |
| Explain software assurance best practices. | 1. Platforms Mobile Web application Client/server Embedded System-on-chip (SoC) Firmware 2. Software development life cycle (SDLC) integration 3. DevSecOps 4. Software assessment methods User acceptance testing Stress test application Security regression testing Code review 5. Secure coding best practices Input validation Output encoding Session management Authentication Data protection Parameterized queries 6. Static analysis tools 7. Dynamic analysis tools 8. Formal methods for verification of critical software 9. Service-oriented architecture
|
| Explain hardware assurance best practices. | 1. Hardware root of trust Trusted platform module (TPM) Hardware security module (HSM) 2. eFuse 3. Unified Extensible Firmware Interface (UEFI) 4. Trusted foundry 5. Secure processing
6. Anti-tamper |
Security Operations and Monitoring - 25% | |
| Given a scenario, analyze data as part of security monitoring activities. | 1. Heuristics 2. Trend analysis 3. Endpoint
4. Network
5. Log review
6. Impact analysis
7. Security information and event management (SIEM) review
8. Query writing
9. E-mail analysis
|
| Given a scenario, implement configuration changes to existing controls to improve security. | 1. Permissions 2. Whitelisting 3. Blacklisting 4. Firewall 5. Intrusion prevention system (IPS) rules 6. Data loss prevention (DLP) 7. Endpoint detection and response (EDR) 8. Network access control (NAC) 9. Sinkholing 10. Malware signatures
11. Sandboxing |
| Explain the importance of proactive threat hunting. | 1. Establishing a hypothesis 2. Profiling threat actors and activities 3. Threat hunting tactics
4. Reducing the attack surface area |
| Compare and contrast automation concepts and technologies. | 1. Workflow orchestration
2. Scripting
9. Continuous integration |
Incident Response - 22% | |
| Explain the importance of the incident response process. | 1. Communication plan
2. Response coordination with relevant entities
3. Factors contributing to data criticality
|
| Given a scenario, apply the appropriate incident response procedure. | 1. Preparation
2. Detection and analysis
3. Containment
4. Eradication and recovery
5. Post-incident activities
|
| Given an incident, analyze potential indicators of compromise. | 1. Network-related
2. Host-related
3. Application-related
|
Latest CS0-002 Exam Dumps CompTIA Exam: https://pass4sure.guidetorrent.com/CS0-002-dumps-questions.html