Get 2022 Updated Free CompTIA CS0-002 Exam Questions & Answer
CS0-002 Dumps PDF and Test Engine Exam Questions
CompTIA CS0-002 Exam Syllabus Topics:
| Topic | Details |
|---|---|
Threat and Vulnerability Management - 22% | |
| Explain the importance of threat data and intelligence. | 1. Intelligence sources
2. Confidence levels
4. Threat classification
5. Threat actors
6. Intelligence cycle
7. Commodity malware
|
| Given a scenario, utilize threat intelligence to support organizational security. | 1. Attack frameworks
2. Threat research
3. Threat modeling methodologies
3. Threat intelligence sharing with supported functions
|
| Given a scenario, perform vulnerability management activities. | 1. Vulnerability identification
2. Validation
3. Remediation/mitigation
4. Scanning parameters and criteria
5. Inhibitors to remediation
|
| Given a scenario, analyze the output from common vulnerability assessment tools. | 1.Web application scanner
2.Infrastructure vulnerability scanner
3.Software assessment tools and techniques
4.Enumeration
5. Wireless assessment tools
6. Cloud infrastructure assessment tools
|
| Explain the threats and vulnerabilities associated with specialized technology. | 1. Mobile 2. Internet of Things (IoT) 3. Embedded 4. Real-time operating system (RTOS) 5. System-on-Chip (SoC) 6. Field programmable gate array (FPGA) 7. Physical access control 8. Building automation systems 9. Vehicles and drones
10. Workflow and process automation systems
|
| Explain the threats and vulnerabilities associated with operating in the cloud. | 1. Cloud service models
2. Cloud deployment models
3. Function as a Service (FaaS)/serverless architecture
|
| Given a scenario, implement controls to mitigate attacks and software vulnerabilities. | 1. Attack types
2. Vulnerabilities
|
Software and Systems Security - 18% | |
| Given a scenario, apply security solutions for infrastructure management. | 1. Cloud vs. on-premises 2. Asset management
3. Segmentation
4. Network architecture
5. Change management
7. Containerization
9. Cloud access security broker (CASB) |
| Explain software assurance best practices. | 1. Platforms Mobile Web application Client/server Embedded System-on-chip (SoC) Firmware 2. Software development life cycle (SDLC) integration 3. DevSecOps 4. Software assessment methods User acceptance testing Stress test application Security regression testing Code review 5. Secure coding best practices Input validation Output encoding Session management Authentication Data protection Parameterized queries 6. Static analysis tools 7. Dynamic analysis tools 8. Formal methods for verification of critical software 9. Service-oriented architecture
|
| Explain hardware assurance best practices. | 1. Hardware root of trust Trusted platform module (TPM) Hardware security module (HSM) 2. eFuse 3. Unified Extensible Firmware Interface (UEFI) 4. Trusted foundry 5. Secure processing
6. Anti-tamper |
Security Operations and Monitoring - 25% | |
| Given a scenario, analyze data as part of security monitoring activities. | 1. Heuristics 2. Trend analysis 3. Endpoint
4. Network
5. Log review
6. Impact analysis
7. Security information and event management (SIEM) review
8. Query writing
9. E-mail analysis
|
| Given a scenario, implement configuration changes to existing controls to improve security. | 1. Permissions 2. Whitelisting 3. Blacklisting 4. Firewall 5. Intrusion prevention system (IPS) rules 6. Data loss prevention (DLP) 7. Endpoint detection and response (EDR) 8. Network access control (NAC) 9. Sinkholing 10. Malware signatures
11. Sandboxing |
| Explain the importance of proactive threat hunting. | 1. Establishing a hypothesis 2. Profiling threat actors and activities 3. Threat hunting tactics
4. Reducing the attack surface area |
| Compare and contrast automation concepts and technologies. | 1. Workflow orchestration
2. Scripting
9. Continuous integration |
Incident Response - 22% | |
| Explain the importance of the incident response process. | 1. Communication plan
2. Response coordination with relevant entities
3. Factors contributing to data criticality
|
| Given a scenario, apply the appropriate incident response procedure. | 1. Preparation
2. Detection and analysis
3. Containment
4. Eradication and recovery
5. Post-incident activities
|
| Given an incident, analyze potential indicators of compromise. | 1. Network-related
2. Host-related
3. Application-related
|
| Given a scenario, utilize basic digital forensics techniques. | 1. Network
2. Endpoint
3. Mobile
9. Carving |
Compliance and Assessment - 13% | |
| Understand the importance of data privacy and protection. | 1. Privacy vs. security 2. Non-technical controls
3. Technical controls
|
| Given a scenario, apply security concepts in support of organizational risk mitigation. | 1. Business impact analysis 2. Risk identification process 3. Risk calculation
4. Communication of risk factors
6. Systems assessment
9. Supply chain assessment
|
| Explain the importance of frameworks, policies, procedures, and controls. | 1. Frameworks
2. Policies and procedures
3. Category
4. Control type
5. Audits and assessments
|
NEW QUESTION 172
Which of the following is a best practice when sending a file/data to another individual in an organization?
- A. When encrypting, split the file: and then compress each file.
- B. Encrypt and then compress the file.
- C. Encrypt the file but do not compress it.
- D. Compress and then encrypt the file.
Answer: D
NEW QUESTION 173
A hybrid control is one that:
- A. is implemented at the enterprise and system levels
- B. is implemented differently on individual systems
- C. authenticates using passwords and hardware tokens
- D. has operational and technical components
Answer: A
NEW QUESTION 174
A security analyst is investigating a compromised Linux server.
The analyst issues the ps command and receives the following output.
Which of the following commands should the administrator run NEXT to further analyze the compromised system?
- A. kill -9 1301
- B. rpm -V openash-server
- C. /bin/la -1 /proc/1301/exe
- D. strace /proc/1301
Answer: D
NEW QUESTION 175
A security analyst reviews the following aggregated output from an Nmap scan and the border firewall ACL:
Which of the following should the analyst reconfigure to BEST reduce organizational risk while maintaining current functionality?
- A. Firewall
- B. Server2
- C. PC1
- D. Server1
- E. PC2
Answer: A
NEW QUESTION 176
Bootloader malware was recently discovered on several company workstations. All the workstations run Windows and are current models with UEFI capability.
Which of the following UEFI settings is the MOST likely cause of the infections?
- A. Compatibility mode
- B. Native mode
- C. Secure boot mode
- D. Fast boot mode
Answer: A
NEW QUESTION 177
An HR employee began having issues with a device becoming unresponsive after attempting to open an email attachment. When informed, the security analyst became suspicious of the situation, even though there was not any unusual behavior on the IDS or any alerts from the antivirus software.
Which of the following BEST describes the type of threat in this situation?
- A. Zero-day malware
- B. PII exfiltration
- C. Known virus
- D. Packet of death
Answer: A
NEW QUESTION 178
Hotspot Question
Malware is suspected on a server in the environment. The analyst is provided with the output of commands from servers in the environment and needs to review all output files in order to determine which process running on one of the servers may be malware. Servers 1, 2 and 4 are clickable. Select the Server which hosts the malware, and select the process which hosts this malware.
Instructions:
If any time you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
Answer:
Explanation:
NEW QUESTION 179
A company's marketing emails are either being found in a spam folder or not being delivered at all. The security analyst investigates the issue and discovers the emails in question are being sent on behalf of the company by a third party in1marketingpartners.com Below is the exiting SPP word:
Which of the following updates to the SPF record will work BEST to prevent the emails from being marked as spam or blocked?
A)
B)
C)
D)
- A. Option D
- B. Option A
- C. Option C
- D. Option B
Answer: D
NEW QUESTION 180
A security analyst receives a mobile device with symptoms of a virus infection. The virus is morphing whenever it is from sandbox to sandbox to analyze. Which of the following will help to identify the number of variations through the analysis life cycle?
- A. Log viewers
- B. Journaling
- C. Hashing utilities
- D. OS and process analysis
Answer: D
NEW QUESTION 181
A security analyst needs to obtain the footprint of the network. The footprint must identify the following information;
* TCP and UDP services running on a targeted system
* Types of operating systems and versions
* Specific applications and versions
Which of the following tools should the analyst use to obtain the data?
- A. ZAP
- B. Prowler
- C. Nmap
- D. Reaver
Answer: C
NEW QUESTION 182
For machine learning to be applied effectively toward security analysis automation, it requires __________.
- A. relevant training data.
- B. a threat feed API.
- C. a multicore, multiprocessor system.
- D. anomalous traffic signatures.
Answer: D
NEW QUESTION 183
Which of the following policies would slate an employee should not disable security safeguards, such as host firewalls and antivirus on company systems?
- A. Acceptable use policy
- B. Account management policy
- C. Password policy
- D. Code of conduct policy
Answer: A
NEW QUESTION 184
A monthly job to install approved vendor software updates and hot fixes recently stopped working. The security team performed a vulnerability scan, which identified several hosts as having some critical OS vulnerabilities, as referenced in the common vulnerabilities and exposures (CVE) database.
Which of the following should the security team do NEXT to resolve the critical findings in the most effective manner? (Choose two.)
- A. Resolve the monthly job issues and test them before applying them to the production network.
- B. Manually patch the computers on the network, as recommended on the CVE website.
- C. Remove the servers reported to have high and medium vulnerabilities.
- D. Tag the computers with critical findings as a business risk acceptance.
- E. Patch the required hosts with the correct updates and hot fixes, and rescan them for vulnerabilities.
- F. Harden the hosts on the network, as recommended by the NIST framework.
Answer: D,F
NEW QUESTION 185
The development team recently moved a new application into production for the accounting department. After this occurred, the Chief Information Officer (CIO) was contacted by the head of accounting because the application is missing a key piece of functionality that is needed to complete the corporation's quarterly tax returns. Which of the following types of testing would help prevent this from reoccurring?
- A. Security regression testing
- B. Input validation testing
- C. User acceptance testing
- D. Static code testing
Answer: C
NEW QUESTION 186
Which of the following types of policies is used to regulate data storage on the network?
- A. Acceptable use
- B. Password
- C. Account management
- D. Retention
Answer: D
Explanation:
Reference:
http://www.css.edu/administration/information-technologies/computing-policies/computer-and- network-policies.html
NEW QUESTION 187
A human resources employee sends out a mass email to all employees that contains their personnel records. A security analyst is called in to address the concern of the human resources director on how to prevent this from happening in the future.
Which of the following would be the BEST solution to recommend to the director?
- A. Install a data loss prevention system, and train human resources employees on its use.
Provide PII training to all employees at the company. Encrypt PII information. - B. Train all employees. Encrypt data sent on the company network. Bring in privacy personnel to present a plan on how PII should be handled.
- C. Enforce encryption on all emails sent within the company. Create a PII program and policy on how to handle data. Train all human resources employees.
- D. Install specific equipment to create a human resources policy that protects PII data. Train company employees on how to handle PII data. Outsource all PII to another company. Send the human resources director to training for PII handling.
Answer: A
NEW QUESTION 188
A recent vulnerability scan found four vulnerabilities on an organization's public Internet-facing IP addresses.
Prioritizing in order to reduce the risk of a breach to the organization, which of the following should be remediated FIRST?
- A. A cipher that is known to be cryptographically weak.
- B. An HTTP response that reveals an internal IP address.
- C. A buffer overflow that allows remote code execution.
- D. A website using a self-signed SSL certificate.
Answer: C
NEW QUESTION 189
An incident response team is responding to a breach of multiple systems that contain PII and PHI. Disclosing the incident to external entities should be based on:
- A. the communication plan
- B. senior management's guidance
- C. the responder's discretion
- D. the public relations policy
Answer: C
NEW QUESTION 190
A security analyst at a large financial institution is evaluating the security posture of a smaller financial company. The analyst is performing the evaluation as part of a due diligence process prior to a potential acquisition. With which of the following threats should the security analyst be MOST concerned? (Choose two.)
- A. The parent company is only going through this process to identify and steal the intellectual property of the smaller company.
- B. The industry regulator may decide that the acquisition will result in unfair competitive advantage if the acquisition were to take place.
- C. Employees at the company being acquired will be hostile to the security analyst and may not provide honest answers.
- D. Breach of confidentiality and market risks can occur if the potential acquisition is leaked to the press.
- E. The company being acquired may already be compromised and this could pose a risk to the parent company's assets.
- F. Employees at the company being acquired will be hostile to the security analyst and may not provide honest answers.
Answer: B,E
NEW QUESTION 191
A company wants to reduce the cost of deploying servers to support increased network growth. The company is currently unable to keep up with the demand, so it wants to outsource the infrastructure to a cloud-based solution.
Which of the following is the GREATEST threat for the company to consider when outsourcing its infrastructure?
- A. The cloud service provider is unable to issue sufficient documentation for configurations.
- B. The cloud service provider is unable to provide sufficient logging and monitoring.
- C. The cloud service provider has an SLA for system uptime that is lower than 99 9%.
- D. The cloud service provider conducts a system backup each weekend and once a week during peak business times.
Answer: A
NEW QUESTION 192
Which of the following is the MOST secure method to perform dynamic analysis of malware that can sense when it is in a virtual environment?
- A. Place the malware on a virtual server running SIFT and begin analysis.
- B. Place the malware on a virtual server connected to a VLAN.
- C. Place the malware on an isolated virtual server disconnected from the network.
- D. Place the malware in a virtual server that is running Windows and is connected to the network.
Answer: C
NEW QUESTION 193
An organization is experiencing issues with emails that are being sent to external recipients Incoming emails to the organization are working fine. A security analyst receives the following screenshot ot email error from the help desk.
The analyst the checks the email server and sees many of the following messages in the logs.
Error 550 - Message rejected
Which of the following is MOST likely the issue?
- A. Port 25 is not open.
- B. The DMARC queue is full
- C. The DKIM private key has expired
- D. SPF is failing.
Answer: D
NEW QUESTION 194
An information security analyst observes anomalous behavior on the SCADA devices in a power plant. This behavior results in the industrial generators overheating and destabilizing the power supply.
Which of the following would BEST identify potential indicators of compromise?
- A. Use Burp Suite to capture packets to the SCADA device's IP.
- B. Use Wireshark to capture packets between SCADA devices and the management system.
- C. Use tcpdump to capture packets from the SCADA device IP.
- D. Use Nmap to capture packets from the management system to the SCADA devices.
Answer: B
NEW QUESTION 195
......
What is CompTIA CS0-002 Exam
The new CompTIA CS0-002 Exam has been updated to reflect changes in the industry, as well as the need for security experts to focus on the security of software programs and be more aggressive in their knowledge of defense and risk. Security and safety experts must also ensure that their work complies with the IT regulatory standards that affect their daily work. With the ultimate goal of proactively safeguarding and continually improving the security of a company, CySA + will verify that the actual candidate has the skills and capabilities to: Take advantage of knowledge and risk detection strategies, Analyze and translate data, Identify and correct, vulnerabilities, Suggest preventive measures, Respond effectively to events and retrieve events
CompTIA CS0-002 is a prerequisite exam for the CompTIA Cybersecurity Analyst (CySA+) certification. This certificate is designed to validate the skills and knowledge of the professionals looking to demonstrate their ability to apply behavioral analytics to devices and networks to detect, combat, and prevent cybersecurity threats via consistent security monitoring.
Verified CS0-002 exam dumps Q&As with Correct 299 Questions and Answers: https://www.testsdumps.com/CS0-002_real-exam-dumps.html
Get New CS0-002 Certification – Valid Exam Dumps Questions: https://drive.google.com/open?id=1gtUbwQotud2NG1w8w23vKqy66Wj0rTGX
