Latest CompTIA CySA+ Study Guide CS0-002 Exam Questions

1. A security analyst needs to obtain the footprint of the network.

The footprint must identify the following information;

• TCP and UDP services running on a targeted system

• Types of operating systems and versions

• Specific applications and versions

Which of the following tools should the analyst use to obtain the data?

2. A security analyst is investigating an incident that appears to have started with SOL injection against a publicly available web application.

Which of the following is the FIRST step the analyst should take to prevent future attacks?

3. A malicious artifact was collected during an incident response procedure. A security analyst is unable to run it in a sandbox to understand its features and method of operation.

Which of the following procedures is the BEST approach to perform a further analysis of the malware's capabilities?

4. A company just chose a global software company based in Europe to implement a new supply chain management solution.

Which of the following would be the MAIN concern of the company?

5. A security analyst needs to perform a search for connections with a suspicious IP on the network traffic. The company collects full packet captures at the Internet gateway and retains them for one week.

Which of the following will enable the analyst to obtain the BEST results?

6. The help desk noticed a security analyst that emails from a new email server are not being sent out. The new email server was recently added to the existing ones.

The analyst runs the following command on the new server.





Given the output, which of the following should the security analyst check NEXT?

7. The SOC has received reports of slowness across all workstation network segments. The currently installed antivirus has not detected anything, but a different anti-malware product was just downloaded

and has revealed a worm is spreading

Which of the following should be the NEXT step in this incident response?

8. The inability to do remote updates of certificates. keys software and firmware is a security issue commonly associated with:

9. CORRECT TEXT

You are a cybersecurity analyst tasked with interpreting scan data from Company A's servers. You must verify the requirements are being met for all of the servers and recommend changes if you find they are not.

The company's hardening guidelines indicate the following:

• TLS 1.2 is the only version of TLS running.

• Apache 2.4.18 or greater should be used.

• Only default ports should be used.



INSTRUCTIONS

Using the supplied data, record the status of compliance with the company's guidelines for each server.

The question contains two parts: make sure you complete Part 1 and Part 2. Make recommendations for issues based ONLY on the hardening guidelines provided.

10. An analyst is reviewing the following code output of a vulnerability scan:

if (search name ! = null )

{

%>

employee <%search names%> not found

}

Which of the following types of vulnerabilities does this MOST likely represent?

11. A security analyst inspects the header of an email that is presumed to be malicious and sees the following:





Which of the following is inconsistent with the rest of the header and should be treated as suspicious?

12. A security analyst is providing a risk assessment for a medical device that will be installed on the corporate network. During the assessment, the analyst discovers the device has an embedded operating system that will be at the end of its life in two years. Due to the criticality of the device, the security committee makes a risk- based policy decision to review and enforce the vendor upgrade before the end of life is reached.

Which of the following risk actions has the security committee taken?

13. An application server runs slowly and then triggers a high CPU alert. After investigating, a security analyst finds an unauthorized program is running on the server.

The analyst reviews the application log below.





Which of the following conclusions is supported by the application log?

14. A security analyst is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS.

Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise'?

15. A security analyst reviews the following aggregated output from an Nmap scan and the border firewall ACL:





Which of the following should the analyst reconfigure to BEST reduce organizational risk while maintaining current functionality?

16. A security analyst reviews SIEM logs and detects a well-known malicious executable running in a Windows machine. The up-to-date antivirus cannot detect the malicious executable.

Which of the following is the MOST likely cause of this issue?

17. A security analyst is evaluating two vulnerability management tools for possible use in an organization. The analyst set up each of the tools according to the respective vendor's instructions and generated a report of vulnerabilities that ran against the same target server.

Tool A reported the following:





Tool B reported the following:





Which of the following BEST describes the method used by each tool? (Choose two.)

18. The inability to do remote updates of certificates, keys, software, and firmware is a security issue commonly associated with:

19. After a breach involving the exfiltration of a large amount of sensitive data a security analyst is reviewing the following firewall logs to determine how the breach occurred:





Which of the following IP addresses does the analyst need to investigate further?

20. An analyst is performing penetration testing and vulnerability assessment activities against a new vehicle automation platform.

Which of the following is MOST likely an attack vector that is being utilized as part of the testing and assessment?

21. A security analyst is reviewing the following log from an email security service.





Which of the following BEST describes the reason why the email was blocked?

22. A small organization has proprietary software that is used internally. The system has not been well maintained and cannot be updated with the rest of the environment.

Which of the following is the BEST solution?

23. An information security analyst on a threat-hunting team Is working with administrators to create a hypothesis related to an internally developed web application.

The working hypothesis is as follows:

• Due to the nature of the industry, the application hosts sensitive data associated with many clients and Is a significant target

• The platform Is most likely vulnerable to poor patching and Inadequate server hardening, which expose vulnerable services.

• The application is likely to be targeted with SQL injection attacks due to the large number of reporting capabilities within the application.

As a result, the systems administrator upgrades outdated service applications and validates the endpoint configuration against an industry benchmark. The analyst suggests developers receive additional training on implementing identity and access management, and also implements a WAF to protect against SOL injection attacks.

Which of the following BEST represents the technique in use?

24. A Chief Security Officer (CSO) is working on the communication requirements (or an organization's incident response plan.

In addition to technical response activities, which of the following is the main reason why communication must be addressed in an effective incident response program?

25. A company’s Chief Information Security Officer (CISO) is concerned about the integrity of some highly confidential files. Any changes to these files must be tied back to a specific authorized user’s activity session.

Which of the following is the BEST technique to address the CISO’s concerns?

26. A hybrid control is one that:

27. A security analyst is researching an incident and uncovers several details that may link to other incidents. The security analyst wants to determine if other incidents are related to the current incident.

Which of the following threat research methodoloqies would be MOST appropriate for the analyst to use?

28. An organization wants to move non-essential services into a cloud computing environment. Management has a cost focus and would like to achieve a recovery time objective of 12 hours.

Which of the following cloud recovery strategies would work BEST to attain the desired outcome?

29. A security analyst discovers a vulnerability on an unpatched web server that is used for testing machine learning on Bing Data sets. Exploitation of the vulnerability could cost the organization $1.5 million in lost productivity. The server is located on an isolated network segment that has a 5% chance of being compromised.

Which of the following is the value of this risk?

30. An employee in the billing department accidentally sent a spreadsheet containing payment card data to a recipient outside the organization. The employee intended to send the spreadsheet to an internal staff member with a similar name and was unaware of the mistake until the recipient replied to the message.

In addition to retraining the employee, which of the following would prevent this from happening in the future?

31. Which of the following is MOST closely related to the concept of privacy?

32. An organization developed a comprehensive modern response policy Executive management approved the policy and its associated procedures.

Which of the following activities would be MOST beneficial to evaluate personnel's familiarity with incident response procedures?

33. A security analyst is generating a list of recommendations for the company's insecure API.

Which of the following is the BEST parameter mitigation rec

34. A team of security analysis has been alerted to potential malware activity. The initial examination indicates one of the affected workstations on beaconing on TCP port 80 to five IP addresses and attempting to spread across the network over port 445.

Which of the following should be the team's NEXT step during the detection phase of this response process?

35. Which of the following technologies can be used to house the entropy keys for disk encryption on desktops and laptops?