Navigate the terrains of certification with aplomb, bolstered by the unmatched repository of the CS0-002 dumps. Painstakingly tailored to mirror the multifaceted syllabus, the CS0-002 dumps unveil an expansive range of practice questions, ensuring conceptual depth. Be it the orderly flow of PDFs that resonates or the interactive simulations of the VCE format that fascinate, the CS0-002 dumps stand as the gold standard. A comprehensive study guide, interwoven with the ethos of the CS0-002 dumps, augments the learning landscape, highlighting critical milestones. As a testament to our relentless belief in these tools, we advocate our 100% Pass Guarantee.
[Hot Drop] Fuel your exam prep with the free CS0-002 PDF and Exam Questions, promising 100% success
Question 1:
A security analyst is providing a risk assessment for a medical device that will be installed on the corporate network. During the assessment, the analyst discovers the device has an embedded operating system that will be at the end of its life in two years. Due to the criticality of the device, the security committee makes a risk- based policy decision to review and enforce the vendor upgrade before the end of life is reached. Which of the following risk actions has the security committee taken?
A. Risk exception
B. Risk avoidance
C. Risk tolerance
D. Risk acceptance
Correct Answer: D
Question 2:
An organization is conducting penetration testing to identify possible network vulnerabilities. The penetration tester has already identified active hosts in the network and is now scanning individual hosts to determine if any are running a web server. The output from the latest scan is shown below:
Which of the following commands would have generated the output above?
A. map V 192.168.1.13 80
B. map P 192.168.1.0/24 ALL
C. map V 192.168.1.1 80
D. map P 192.168.1.13 ALL
Correct Answer: A
Question 3:
A routine vulnerability scan detected a known vulnerability in a critical enterprise web application. Which of the following would be the BEST next step?
A. Submit a change request to have the system patched
B. Evaluate the risk and criticality to determine it further action is necessary
C. Notify a manager of the breach and initiate emergency procedures.
D. Remove the application from production and Inform the users.
Correct Answer: B
Question 4:
An organization that uses SPF has been notified emails sent via its authorized third-party partner are getting rejected. A security analyst reviews the DNS entry and sees the following: v=spf1 ip4:180.10.6.5 ip4:180.10.6.10 include:robustmail.com `”all The organization\’s primary mail server IP is 180.10.6.6, and the secondary mail server IP is 180.10.6.5. The organization\’s third-party mail provider is “Robust Mail” with the domain name robustmail.com. Which of the following is the MOST
likely reason for the rejected emails?
A. SPF version 1 does not support third-party providers.
B. The primary and secondary email server IP addresses are out of sequence.
C. An incorrect IP version is being used.
D. The wrong domain name is in the SPF record.
Correct Answer: D
Question 5:
A security analyst wants to identify which vulnerabilities a potential attacker might initially exploit if the network is compromised Which of the following would provide the BEST results?
A. Baseline configuration assessment
B. Uncredentialed scan
C. Network ping sweep
D. External penetration test
Correct Answer: D
Question 6:
A security engineer must deploy X 509 certificates to two web servers behind a load balancer. Each web server is configured identically. Which of the following should be done to ensure certificate name mismatch errors do not occur?
A. Create two certificates, each with the same fully qualified domain name, and associate each with the web servers’ real IP addresses on the load balancer.
B. Create one certificate on the load balancer and associate the site with the web servers’ real IP addresses.
C. Create two certificates, each with the same fully qualified domain name, and associate each with a corresponding web server behind the load balancer.
D. Create one certificate and export it to each web server behind the load balancer.
Correct Answer: C
Question 7:
During a routine log review, a security analyst has found the following commands that cannot be identified from the Bash history log on the root user:
Which of the following commands should the analyst investigate FIRST?
A. Line 1
B. Line 2
C. Line 3
D. Line 4
E. Line 5
F. Line 6
Correct Answer: B
Question 8:
An organization wants to consolidate a number of security technologies throughout the organization and standardize a workflow for identifying security issues prioritizing the severity and automating a response.
Which of the following would best meet the organization\’s needs\’?
A. MaaS
B. SIEM
C. SOAR
D. CI/CD
Correct Answer: C
Explanation: A security orchestration, automation, and response (SOAR) system is a solution that combines various security technologies and workflows to identify security issues, prioritize their severity, and automate a response. A SOAR system can help an organization consolidate its security tools and processes and standardize its workflow for incident response. The other options are not relevant or comprehensive for this purpose. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0- 002), page 15; https://www.gartner.com/en/information-technology/glossary/security- orchestration-automation-and-response-soar
Question 9:
While observing several host machines, a security analyst notices a program is overwriting data to a buffer. Which of the following controls will best mitigate this issue?
A. Data execution prevention
B. Output encoding
C. Prepared statements
D. Parameterized queries
Correct Answer: A
Question 10:
Members of the sales team are using email to send sensitive client lists with contact information to their personal accounts The company\’s AUP and code of conduct prohibits this practice. Which of the following configuration changes would improve security and help prevent this from occurring?
A. Configure the DLP transport rules to provide deep content analysis.
B. Put employees\’ personal email accounts on the mail server on a blocklist.
C. Set up IPS to scan for outbound emails containing names and contact information.
D. Use Group Policy to prevent users from copying and pasting information into emails.
E. Move outbound emails containing names and contact information to a sandbox for further examination.
Correct Answer: A
Data loss prevention (DLP) is a set of policies and tools that aim to prevent unauthorized disclosure of sensitive data. DLP transport rules are rules that apply to email messages that are sent or received by an organization\’s mail server. These rules can provide deep content analysis, which means they can scan the content of email messages and attachments for sensitive data patterns, such as client lists or contact information. If a rule detects a violation of the DLP policy, it can take actions such as blocking, quarantining, or notifying the sender or recipient. This would improve security and help prevent sales team members from sending sensitive client lists to their personal accounts. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 14; https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow- rules/data-loss-prevention
Question 11:
A security analyst recently discovered two unauthorized hosts on the campus\’s wireless network segment from a man-m-the-middle attack .The security analyst also verified that privileges were not escalated, and the two devices did not gain access to other network devices
Which of the following would BEST mitigate and improve the security posture of the wireless network for this type of attack?
A. Enable MAC filtering on the wireless router and suggest a stronger encryption for the wireless network,
B. Change the SSID, strengthen the passcode, and implement MAC filtering on the wireless router.
C. Enable MAC filtering on the wireless router and create a whitelist that allows devices on the network
D. Conduct a wireless survey to determine if the wireless strength needs to be reduced.
Correct Answer: A
Question 12:
Which of the following factors would determine the regulations placed on data under data sovereignty laws?
A. What the company intends to do with the data it owns
B. The company\’s data security policy
C. The type of data the company stores
D. The data laws of the country in which the company is located
Correct Answer: D
Question 13:
An analyst is reviewing a list of vulnerabilities, which were reported from a recent vulnerability scan of a Linux server. Which of the following is MOST likely to be a false positive?
A. OpenSSH/OpenSSL Package Random Number Generator Weakness
B. Apache HTTP Server Byte Range DoS
C. GDI+ Remote Code Execution Vulnerability (MS08-052)
D. HTTP TRACE / TRACK Methods Allowed (002-1208)
E. SSL Certificate Expiry
Correct Answer: C
Question 14:
The IT department is concerned about the possibility of a guest device infecting machines on the corporate network or taking down the company\’s singe internet connection. Which of the following should a security analyst recommend to BEST meet the requirements outlined by the IT Department?
A. Require the guest machines to install the corporate-owned EDR solution.
B. Configure NAC to only alow machines on the network that are patched and have active antivirus.
C. Place a firewall In between the corporate network and the guest network
D. Configure the IPS with rules that will detect common malware signatures traveling from the guest network.
Correct Answer: B
Question 15:
A risk assessment concludes that the perimeter network has the highest potential for compromise by an attacker, and it is labeled as a critical risk environment. Which of the following is a valid compensating control to reduce the volume of valuable information in the perimeter network that an attacker could gain using active reconnaissance techniques?
A. A control that demonstrates that all systems authenticate using the approved authentication method
B. A control that demonstrates that access to a system is only allowed by using SSH
C. A control that demonstrates that firewall rules are peer reviewed for accuracy and approved before deployment
D. A control that demonstrates that the network security policy is reviewed and updated yearly
Correct Answer: C
Explanation: A valid compensating control to reduce the volume of valuable information in the perimeter network that an attacker could gain using active reconnaissance techniques is a control that demonstrates that firewall rules are peer reviewed for accuracy and approved before deployment. This control can help ensure that the firewall rules are configured correctly and securely, and that they do not allow unnecessary or unauthorized access to the perimeter network. The other options are not compensating controls or do not address the risk of active reconnaissance. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 14; https://www.isaca.org/resources/ isaca-journal/issues/2016/volume-3/compensating- controls