The Best Practice Test Preparation for the CS0-002 Certification Exam
CS0-002 Exam Dumps, Practice Test Questions BUNDLE PACK
NEW QUESTION # 191
A storage area network (SAN) was inadvertently powered off while power maintenance was being performed in a datacenter. None of the systems should have lost all power during the maintenance. Upon review, it is discovered that a SAN administrator moved a power plug when testing the SAN's fault notification features.
Which of the following should be done to prevent this issue from reoccurring?
- A. Ensure power configuration is covered in the datacenter change management policy and have the SAN administrator review this policy.
- B. Install a third power supply in the SAN so loss of any power intuit does not result in the SAN completely powering off.
- C. Ensure both power supplies on the SAN are serviced by separate circuits, so that if one circuit goes down, the other remains powered.
- D. Install additional batteries in the SAN power supplies with enough capacity to keep the system powered on during maintenance operations.
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION # 192
A security analyst is investigating a reported phishing attempt that was received by many users throughout the company The text of one of the emails is shown below:
Office 365 User.
It looks like you account has been locked out Please click this <a href=Tittp7/accountfix-office356 com/login php">link</a> and follow the pfompts to restore access Regards.
Security Team
Due to the size of the company and the high storage requirements, the company does not log DNS requests or perform packet captures of network traffic, but rt does log network flow data Which of the following commands will the analyst most likely execute NEXT?
- A. telnet office365.com 25
- B. curl http:// accountfix-office365.com/login. php
- C. nslookup accountfix-office365.com
- D. tracert 122.167.40.119
Answer: C
NEW QUESTION # 193
A company has implemented WPA2, a 20-character minimum for the WiFi passphrase, and a new WiFi passphrase every 30 days, and has disabled SSID broadcast on all wireless access points. Which of the following is the company trying to mitigate?
- A. Forced deauthentication
- B. Rainbow tables
- C. Downgrade attacks
- D. SSL pinning
Answer: C
NEW QUESTION # 194
Which of the following utilities could be used to resolve an IP address to a domain name, assuming the address has a PTR record?
- A. arp
- B. ping
- C. nbtstat
- D. ifconfig
Answer: B
NEW QUESTION # 195
A security analyst performed a targeted system vulnerability scan to obtain critical information. After the output result, the analyst used the OVAL XML language to review and calculate the discovered risk. Which of the following types of scans did the security analyst perform?
- A. Network map
- B. Active
- C. External
- D. Passive
Answer: B
Explanation:
An active scan is a type of system vulnerability scan that involves sending probes or packets to the target system, and analyzing the responses or behaviors of the system. An active scan can help obtain critical information about the system, such as open ports, running services, operating system, software versions, etc. An active scan can also use OVAL XML language to review and calculate the discovered risk. OVAL stands for Open Vulnerability and Assessment Language, and it is a standard for describing and exchanging information about system vulnerabilities and configurations.
NEW QUESTION # 196
A cybersecurity analyst is retained by a firm for an open investigation.
Upon arrival, the cybersecurity analyst reviews several security logs.
Given the following snippet of code:
Which of the following combinations BEST describes the situation and recommendations to be made for this situation?
- A. The cybersecurity analyst has discovered host 192.168.0.101 to be running thenc.exe file at
13:30 using the auto cron job remotely, there are no recommendations since this is not a threat currently. - B. The cybersecurity analyst has discovered host 192.168.0.101 is beaconing every day at 13:30 using thenc.exe file; recommend proceeding with the next step of removing the host from the network.
- C. The cybersecurity analyst has discovered host 192.168.0.101 using Windows Task Scheduler at
13:30 to runnc.exe; recommend proceeding with the next step of removing the host from the network. - D. The security analyst has discovered host 192.168.0.101 is a rogue device on the network, recommend proceeding with the next step of removing the host from the network.
Answer: C
NEW QUESTION # 197
Some hard disks need to be taken as evidence for further analysis during an incident response Which of the following procedures must be completed FIRST for this type of evtdertce acquisition?
- A. Extract the hard drives from the compromised machines and then plug them into a forensics machine to apply encryption over the stored data to protect it from non-authorized access
- B. Build the chain-of-custody document, noting the media model senal number size vendor, date, and time of acquisition
- C. Perform a disk sanitation using the command #dd if=/dev/ada of=/dev/adc ba=5i2 over the media that wil receive a copy of the coHected data
- D. Execute the command #dd if=/dev/ada of=/dev/adc ba=5i2 to clone the evidence data to external media to prevent any further change
Answer: B
NEW QUESTION # 198
It is important to parameterize queries to prevent.
- A. the establishment of a web shell that would allow unauthorized access.
- B. the execution of unauthorized actions against a database.
- C. the queries from using an outdated library with security vulnerabilities.
- D. a memory overflow that executes code with elevated privileges.
Answer: B
NEW QUESTION # 199
A security analyst is reviewing a web application. If an unauthenticated user tries to access a page in the application, the user is redirected to the login page. After successful authentication, the user is then redirected back to the original page. Some users have reported receiving phishing emails with a link that takes them to the application login page but then redirects to a fake login page after successful authentication.
Which of the following will remediate this software vulnerability?
- A. Check for and enforce the proper domain for the redirect.
- B. Implement email filtering with anti-phishing protection.
- C. Deploy a WAF in front of the web application.
- D. Use a parameterized query to check the credentials.
- E. Enforce unique session IDs for the application.
Answer: D
NEW QUESTION # 200
A security analyst is investigating malicious traffic from an internal system that attempted to download proxy avoidance software as identified from the firewall logs but the destination IP is blocked and not captured. Which of the following should the analyst do?
- A. Capture live data using Wireshark
- B. Shut down the computer
- C. Determine if DNS logging is enabled.
- D. Take a snapshot
- E. Review the network logs.
Answer: C
Explanation:
The DNS debug log provides extremely detailed data about all DNS information that is sent and received by the DNS server, similar to the data that can be gathered using packet capture tools such as network monitor. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn800669(v=ws.11)#:~:text=The%20DNS%20debug%20log%20provides,tools%20such%20as%20network%20monitor.
NEW QUESTION # 201
A critical server was compromised by malware, and all functionality was lost. Backups of this server were taken; however, management believes a logic bomb may have been injected by a rootkit. Which of the following should a security analyst perform to restore functionality quickly?
- A. Work backward, restoring each backup until the server is clean
- B. Stand up a new server and restore critical data from backups
- C. Restore the previous backup and scan with a live boot anti-malware scanner
- D. Offload the critical data to a new server and continue operations
Answer: B
NEW QUESTION # 202
A company wants to run a leaner team and needs to deploy a threat management system with minimal human Interaction. Which of the following is the server component of the threat management system that can accomplish this goal?
- A. CVSS
- B. OpenlOC
- C. STIX
- D. TAXll
Answer: D
Explanation:
TAXII stands for Trusted Automated eXchange of Indicator Information, and it is a server component of a threat management system that can facilitate the exchange of threat intelligence data between different sources and consumers, using a standard protocol and format. TAXII can help deploy a threat management system with minimal human interaction, by automating the collection, processing, and dissemination of threat intelligence data.
NEW QUESTION # 203
A security analyst was transferred to an organization's threat-hunting team to track specific activity throughout the enterprise environment The analyst must observe and assess the number ot times this activity occurs and aggregate the results. Which of the following is the BEST threat-hunting method for the analyst to use?
- A. Stack counting
- B. Clustering
- C. Grouping
- D. Searching
Answer: A
NEW QUESTION # 204
A cybersecurity analyst has received the laptop of a user who recently left the company.
The analyst types `history' into the prompt, and sees this line of code in the latest bash history:
This concerns the analyst because this subnet should not be known to users within the company.
Which of the following describes what this code has done on the network?
- A. Performed a half open SYB scan on the network.
- B. Performed a ping sweep of the Class C network.
- C. Sent 255 ping packets to each host on the network.
- D. Sequentially sent an ICMP echo reply to the Class C network.
Answer: B
NEW QUESTION # 205
While conducting a cloud assessment, a security analyst performs a Prowler scan, which generates the following within the report:
Based on the Prowler report, which of the following is the BEST recommendation?
- A. Delete CloudDev access key 1.
- B. Delete access key 1.
- C. Delete access key 2.
- D. Delete BusinessUsr access key 1.
Answer: C
NEW QUESTION # 206
......
CompTIA Cybersecurity Analyst (CySA+) Certification, also known as the CS0-002 Exam, is a globally recognized certification that validates the skills and knowledge required for a cybersecurity analyst role. CompTIA Cybersecurity Analyst (CySA+) Certification Exam certification is designed to ensure that cybersecurity professionals have the necessary skills to identify, prevent, and respond to security threats and vulnerabilities. The CS0-002 exam covers a wide range of topics, including threat and vulnerability management, security operations and monitoring, incident response, and compliance and governance.
Prepare for the Actual CompTIA CySA+ CS0-002 Exam Practice Materials Collection: https://pass4sures.realvce.com/CS0-002-VCE-file.html