100% Guaranteed Results CS0-002 Unlimited 299 Questions [2021]
CS0-002 Dumps PDF - Want To Pass CS0-002 Fast
Compliance & Assessment: 13%
- Applying concepts for organizational risk mitigation support: this measures the examinees’ skills in business impact analysis, risk calculation, risk identification process, systems assessment, supply chain assessment, training, exercise, documented compensating controls.
- Describing the significance of frameworks, procedures, controls, and policies: this topic covers one’s knowledge of frameworks, control types, policies and procedures, audits and assessments.
- Understanding the significance of data protection and privacy: the test takers will be measured based on their understanding of privacy versus security, non-technical controls, and technical controls.
NEW QUESTION 116
An employee was found to have performed fraudulent activities. The employee was dismissed, and the employee's laptop was sent to the IT service desk to undergo a data sanitization procedure. However, the security analyst responsible for the investigation wants to avoid data sanitization. Which of the following can the security analyst use to justify the request?
- A. GDPR
- B. Data retention
- C. Data correlation procedure
- D. Evidence retention
Answer: B
NEW QUESTION 117
A security analyst is reviewing packet captures from a system that was compromised. The system was already isolated from the network, but it did have network access for a few hours after being compromised. When viewing the capture in a packet analyzer, the analyst sees the following:
Which of the following can the analyst conclude?
- A. Malware is attempting to beacon to 128.50.100.3.
- B. Data is being exfiltrated over DNS.
- C. The system is scanning ajgidwle.com for PII.
- D. The system is running a DoS attack against ajgidwle.com.
Answer: B
NEW QUESTION 118
Considering confidentiality and integrity, which of the following make servers more secure than desktops? (Select THREE).
- A. Processing power
- B. Physical access restriction
- C. OS
- D. Trained operators
- E. Hard drive capacity
- F. VLANs
Answer: B,C,D
NEW QUESTION 119
The Chief Information Security Officer (CISO) has asked the security staff to identify a framework on which to base the security program. The CISO would like to achieve a certification showing the security program meets all required best practices. Which of the following would be the BEST choice?
- A. SDLC
- B. SANS
- C. OSSIM
- D. ISO
Answer: D
NEW QUESTION 120
An audit has revealed an organization is utilizing a large number of servers that are running unsupported operating systems.
As part of the management response phase of the audit, which of the following would BEST demonstrate senior management is appropriately aware of and addressing the issue?
- A. Copies of prior audits that did not identify the servers as an issue
- B. ACLs from perimeter firewalls showing blocked access to the servers
- C. Project plans relating to the replacement of the servers that were approved by management
- D. Minutes from meetings in which risk assessment activities addressing the servers were discussed
- E. Copies of change orders relating to the vulnerable servers
Answer: C
NEW QUESTION 121
An alert is issued from the SIEM that indicates a large number of failed logins for the same account name on one of the application servers starting at 10:20 a.m. No other significant failed login activity is detected. Using Splunk to search for activity pertaining to that account name, a security analyst finds the account has been authenticating successfully for some time and started to fail this morning. The account is attempting to authenticate from an internal server that is running a database to an application server. No other security activity is detected on the network.
The analyst discovers the account owner is a developer who no longer works for the company.
Which of the following is the MOST likely reason for the failed login attempts for that account?
- A. The host-based firewall is blocking port 389 LDAP communication, preventing the login credentials from being received by the application server
- B. The license for the application has expired, and the failed logins will continue to occur until a new license key is installed on the application
- C. The account that is failing to authenticate has not been maintained, and the company password change policy time frame has been reached for that account
- D. A successful malware attack has provided someone access to the network, and failed login attempts are an indication of an attempt to privilege access to the application
Answer: C
NEW QUESTION 122
A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verity that a user's data is not altered without the user's consent Which of the following would be an appropriate course of action?
- A. Replicate the data sets at regular intervals and continuously compare the copies for unauthorized changes.
- B. Automate the use of a hashing algorithm after verified users make changes to their data
- C. Use encryption first and then hash the data at regular, defined times.
- D. Use a DLP product to monitor the data sets for unauthorized edits and changes.
Answer: D
NEW QUESTION 123
An organization has had problems with security teams remediating vulnerabilities that are either false positives or are not applicable to the organization's servers. Management has put emphasis on security teams conducting detailed analysis and investigation before conducting any remediation.
The output from a recent Apache web server scan is shown below:
The team performs some investigation and finds this statement from Apache on 07/02/2008:
"Fixed in Apache HTTP server 2.2.6, 2.0.61, and 1.3.39"
Which of the following conditions would require the team to perform remediation on this finding?
- A. The organization is running version 2.2.6 and has ExtendedStatus enabled
- B. The organization is running version 1.3.39 and is using a public-server-status page
- C. The organization is running version 2.0.5 and has ExtendedStatus enabled
- D. The organization is running version 2.0.59 is not using a public-server-status page
Answer: C
NEW QUESTION 124
A monthly job to install approved vendor software updates and hot fixes recently stopped working. The security team performed a vulnerability scan, which identified several hosts as having some critical OS vulnerabilities, as referenced in the common vulnerabilities and exposures (CVE) database.
Which of the following should the security team do NEXT to resolve the critical findings in the most effective manner? (Choose two.)
- A. Patch the required hosts with the correct updates and hot fixes, and rescan them for vulnerabilities.
- B. Tag the computers with critical findings as a business risk acceptance.
- C. Manually patch the computers on the network, as recommended on the CVE website.
- D. Harden the hosts on the network, as recommended by the NIST framework.
- E. Remove the servers reported to have high and medium vulnerabilities.
- F. Resolve the monthly job issues and test them before applying them to the production network.
Answer: A,E
NEW QUESTION 125
A cybersecurity analyst is supposing an incident response effort via threat intelligence. Which of the following is the analyst MOST likely executing?
- A. Indicator enrichment and research pivoting
- B. Containment and eradication
- C. Recovery and post-incident review
- D. Requirements analysis and collection planning
Answer: D
NEW QUESTION 126
A small electronics company decides to use a contractor to assist with the development of a new FPGA- based device. Several of the development phases will occur off-site at the contractor's labs. Which of the following is the main concern a security analyst should have with this arrangement?
- A. Making multiple trips between development sites increases the chance of physical damage to the FPGAs.
- B. FPGA applications are easily cloned, increasing the possibility of intellectual property theft.
- C. Moving the FPGAs between development sites will lessen the time that is available for security testing.
- D. Development phases occurring at multiple sites may produce change management issues.
Answer: B
NEW QUESTION 127
A cybersecurity analyst is establishing a threat hunting and intelligence group at a growing organization. Which of the following is a collaborative resource that would MOST likely be used for this purpose?
- A. loC feeds
- B. ISAC
- C. VSS scores
- D. Scrum
Answer: B
NEW QUESTION 128
Company A suspects an employee has been exfiltrating PII via a USB thumb drive. An analyst is tasked with attempting to locate the information on the drive. The PII in question includes the following:
Which of the following would BEST accomplish the task assigned to the analyst?
- A. \d(3)-d(2)-\d(4)
- B. 3 [0-9]\d-2[0-9]\d-4[0-9]\d
- C. \d[9] `XXX-XX-XX'
- D. ?[3]-?[2]-?[3]
Answer: A
NEW QUESTION 129
Because some clients have reported unauthorized activity on their accounts, a security analyst is reviewing network packet captures from the company's API server. A portion of a capture file is shown below:
POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s="http://schemas.s/soap/envelope/"><s:Body><GetIPLocation+xmlns="http://tempuri.org/">
<request+xmlns:a="http://schemas.somesite.org"+xmlns:i="http://www.w3.org/2001/XMLSchema-instance"></s:Body></s:Envelope> 192.168.1.22 - - api.somesite.com 200 0 1006 1001 0 192.168.1.22 POST /services/v1_0/Public/Members.svc/soap <<a:Password>Password123</a:Password><a:ResetPasswordToken+i:nil="true"/> <a:ShouldImpersonatedAuthenticationBePopulated+i:nil="true"/><a:Username>[email protected]</a:Username></request></Login></s:Body></s:Envelope> 192.168.5.66 - - api.somesite.com 200 0 11558 1712 2024 192.168.4.89 POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetIPLocation+xmlns="http://tempuri.org/"> <a:IPAddress>516.7.446.605</a:IPAddress><a:ZipCode+i:nil="true"/></request></GetIPLocation></s:Body></s:Envelope> 192.168.1.22 - - api.somesite.com 200 0 1003 1011 307 192.168.1.22 POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><IsLoggedIn+xmlns="http://tempuri.org/"> <request+xmlns:a="http://schemas.datacontract.org/2004/07/somesite.web+xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:Authentication> <a:ApiToken>kmL4krg2CwwWBan5BReGv5Djb7syxXTNKcWFuSjd</a:ApiToken><a:ImpersonateUserId>0</a:ImpersonateUserId><a:LocationId>161222</a:LocationId> <a:NetworkId>4</a:NetworkId><a:ProviderId>''1=1</a:ProviderId><a:UserId>13026046</a:UserId></a:Authentication></request></IsLoggedIn></s:Body></s:Envelope> 192.168.5.66 - - api.somesite.com 200 0 1378 1209 48 192.168.4.89 Which of the following MOST likely explains how the clients' accounts were compromised?
- A. The clients' usernames and passwords were transmitted in cleartext.
- B. The clients' authentication tokens were impersonated and replayed.
- C. An XSS scripting attack was carried out on the server.
- D. A SQL injection attack was carried out on the server.
Answer: A
NEW QUESTION 130
A security analyst is reviewing a suspected phishing campaign that has targeted an organisation. The organization has enabled a few email security technologies in the last year: however, the analyst believes the security features are not working. The analyst runs the following command:
> dig domain._domainkey.comptia.orq TXT
Which of the following email protection technologies is the analyst MOST likely validating?
- A. DKIM
- B. DNSSEC
- C. SPF
- D. DMARC
Answer: C
NEW QUESTION 131
A security analyst is concerned that unauthorized users can access confidential data stored in the production server environment. All workstations on a particular network segment have full access to any server in production.
Which of the following should be deployed in the production environment to prevent unauthorized access? (Choose two.)
- A. IPS
- B. Firewall
- C. DLP system
- D. Honeypot
- E. Jump box
Answer: B,E
NEW QUESTION 132
......
CompTIA CS0-002 Exam advantages
- CompTIA certifications help you improve job security in your current internship.
- CompTIA certifications provide an incentive for IT career opportunities.
- Using the CompTIA certification can lead to greater consumer satisfaction. Businesses can easily scale up with CompTIA certified workers who can increase their efficiency.
- Having CompTIA certifications helps you work with managers in whose IT profession you intend to advance.
- CompTIA certifications can be unlocked for profitable positions in government and military technology.
- Help professionals be respected and trusted in the IT workplace.
Updated Verified CS0-002 Q&As - Pass Guarantee: https://www.prepawayete.com/CompTIA/CS0-002-practice-exam-dumps.html
CS0-002 Practice Exam Dumps - 99% Marks In CompTIA Exam: https://drive.google.com/open?id=1SAeD3B9lGdWnUuE5bZzYfQho9Sojm-0J