2023 CompTIA CS0-002 Exam Dumps Questions

1. An organization has the following policies:

* Services must run on standard ports.

* Unneeded services must be disabled.

The organization has the following servers:

* 192.168.10.1 - web server

* 192.168.10.2 - database server

A security analyst runs a scan on the servers and sees the following output:





Which of the following actions should the analyst take?

2. While conoXicting a cloud assessment, a security analyst performs a Prowler scan, which generates the following within the report:





Based on the Prowler report, which of the following is the BEST recommendation?

3. A security analyst is trying to track physical locations of threat actors via SIEM log information. However, correlating IP addresses with geolocation is taking a long time, so the analyst asks a security engineer to add geolocation to the SIEM tool.

This is an example of using:

4. Wncn of the following provides an automated approach 10 checking a system configuration?

5. A company's application development has been outsourced to a third-party development team. Based on the SLA. The development team must follow industry best practices for secure coding.

Which of the following is the BEST way to verify this agreement?

6. During an audit several customer order forms were found to contain inconsistencies between the actual price of an item and the amount charged to the customer Further investigation narrowed the cause of the issue to manipulation of the public-facing web form used by customers to order products.

Which of the following would be the BEST way to locate this issue?

7. Which of the following BEST explains the function of trusted firmware updates as they relate to hardware assurance?

8. During routine monitoring a security analyst identified the following enterpnse network traffic:

Packet capture output:





Which of the following BEST describes what the security analyst observed?

9. An analyst is coordinating with the management team and collecting several terabytes of data to analyze using advanced mathematical techniques in order to find patterns and correlations in events and activities.

Which of the following describes what the analyst is doing?

A. Data visualization

B. SOAR

C. Machine learning

D. SCAP

10. Which of the following SCAP standards provides standardization tor measuring and describing the seventy of security-related software flaws?

11. A security technician is testing a solution that will prevent outside entities from spoofing the company's email domain, which is compatia.org. The testing is successful, and the security technician is prepared to fully implement the solution.

Which of the following actions should the technician take to accomplish this task?

12. A company's legal and accounting teams have decided it would be more cost-effective to offload the risks of data storage to a third party. The IT management team has decided to implement a cloud model and has asked the security team for recommendations.

Which of the following will allow all data to be kept on the third-party network?

13. A cybersecunty analyst needs to harden a server that is currently being used as a web server The server needs to be accessible when entenng www company com into the browser Additionally web pages require frequent updates which are performed by a remote contractor.

Given the following output:





Which of the following should the cybersecunty analyst recommend to harden the server? (Select TWO).

14. A company's blocklist has outgrown the current technologies in place. The ACLs are at maximum, and the IPS signatures only allow a certain amount of space for domains to be added, creating the need for multiple signatures.

Which of the following configuration changes to the existing controls would be the MOST appropriate to improve performance?

15. The security team decides to meet informally to discuss and test the response plan for potential security breaches and emergency situations.

Which of the following types of training will the security team perform?

16. Which of the following activities is designed to handle a control failure that leads to a breach?

17. An analyst determines a security incident has occurred.

Which of the following is the most appropnate NEXT step in an incident response plan?

18. A security analyst is reviewing WAF alerts and sees the following request:





Which of the following BEST describes the attack?

19. A manufacturing company uses a third-party service provider lor Tier 1 security support One of the requirements is that the provider must only source talent from its own country due to geopolitical and national security interests

Which of the following can the manufacturing company implement to ensure the third-party service provider meets this requirement?

20. Which of the following ICS network protocols has no inherent security functions on TCP port 502?

21. A company uses an FTP server to support its critical business functions.

The FTP server is configured as follows:

• The FTP service is running with (he data duectory configured in /opt/ftp/data.

• The FTP server hosts employees' home aVectories in /home

• Employees may store sensitive information in their home directories

An loC revealed that an FTP director/ traversal attack resulted in sensitive data loss.

Which of the following should a server administrator implement to reduce the risk of current and future directory traversal attacks targeted at the FTP server?

22. Which of the following is the most effective approach to minimize the occurrence of vulnerabilities introduced by unintentional misconfigurations in the cloud?

23. A security analyst discovers suspicious activity going to a high-value corporate asset. After reviewing the traffic, the security analyst identifies that malware was successfully installed on a machine.

Which of the following should be completed first?

24. A routine vulnerability scan detected a known vulnerability in a critical enterprise web application.

Which of the following would be the BEST next step?

25. An analyst is reviewing registry keys for signs of possible compromise.

The analyst observes the following entries:





Which of the following entries should the analyst investigate first?

26. A security analyst is reviewing malware files without running them.

Which of the following analysis types is the security analyst using?

27. An organization discovers motherboards within the environment that appear to have been physically altered during the manufacturing process.

Which of the following is the BEST course of action to mitigate the risk of this reoccurring?

28. Which of me following are reasons why consumer IoT devices should be avoided in an enterprise environment? (Select TWO)

29. A company has Detected a large number of tailed login attempts on its network A security analyst is investigating the network's activity logs to establish a pattern of behavior.

Which of the following techniques should the analyst use to analyze the increase in failed login attempts?

30. The following output is from a tcpdump al the edge of the corporate network:





Which of the following best describes the potential security concern?

31. A new prototype for a company's flagship product was leaked on the internet As a result, the management team has locked out all USB drives Optical drive writers are not present on company computers The sales team has been granted an exception to share sales presentation files with third parties.

Which of the following would allow the IT team to determine which devices are USB enabled?

32. A security analyst is investigate an no client related to an alert from the threat detection platform on a host (10.0 1.25) in a staging environment that could be running a cryptomining tool because it in sending traffic to an IP address that are related to Bitcoin.

The network rules for the instance are the following:





Which of the following is the BEST way to isolate and triage the host?

33. Which of the following BEST describes how logging and monitoring work when entering into a public cloud relationship with a service provider?

34. A security analyst discovers suspicious host activity while performing monitoring activities.

The analyst pulls a packet capture for the activity and sees the following:





Which of the following describes what has occurred?

35. A development team recently released a new version of a public-facing website for testing prior to production. The development team is soliciting the help of various teams to validate the functionality of the website due to its high visibility.

Which of the following activities best describes the process the development team is initiating?

36. HOTSPOT

The developers recently deployed new code to three web servers. A daffy automated external device scan report shows server vulnerabilities that are failure items according to PCI DSS.

If the venerability is not valid, the analyst must take the proper steps to get the scan clean.

If the venerability is valid, the analyst must remediate the finding.

After reviewing the information provided in the network diagram, select the STEP 2 tab to complete the simulation by selecting the correct Validation Result and Remediation Action for each server listed using the drop-down options.



INTRUCTIONS:

The simulation includes 2 steps.

Step1: Review the information provided in the network diagram and then move to the STEP 2 tab.









STEP 2: Given the Scenario, determine which remediation action is required to address the vulnerability.

37. During the security assessment of a new application, a tester attempts to log in to the application but receives the following message incorrect password for given username.

Which of the following can the tester recommend to decrease the likelihood that a malicious attacker will receive helpful information?

38. Which of the following best explains why it is important for companies to implement both privacy and security policies?

39. An organization wants to consolidate a number of security technologies throughout the organization and standardize a workflow for identifying security issues prioritizing the severity and automating a response.

Which of the following would best meet the organization's needs?

40. A company stores all of its data in the cloud. All company-owned laptops are currently unmanaged, and all users have administrative rights. The security team is having difficulty identifying a way to secure the environment.

Which of the following would be the BEST method to protect the company's data?

41. Which of the following is the BEST option to protect a web application against CSRF attacks?

42. A security analyst sees the following OWASP ZAP output from a scan that was performed against a modern version of Windows while testing for client-side vulnerabilities:





Which of the following is the MOST likely solution to the listed vulnerability?

43. A Chief Information Security Officer has requested a security measure be put in place to redirect certain traffic on the network.

Which of the following would best resolve this issue?

44. A current, validated DLP solution Is now in place because of a previous data breach However, a new data breach has taken place

The following symptoms were observed shorty after a recent sales meeting:

* Sensitive corporate documents appeared on the dark web.

* Unusually large packets of data were being sent out.

Which of the following is most likely occurring?

45. Which of the following data exfiltration discoveries would most likely require communicating a breach to regulatory agencies?

46. A security analyst is deploying a new application in the environment. The application needs to be integrated with several existing applications that contain SPI Pnor to the deployment, the analyst should conduct:

47. During a review of recent network traffic, an analyst realizes the team has seen this same traffic multiple times in the past three weeks, and it resulted in confirmed malware activity The analyst also notes there is no other alert in place for this traffic.

After resolving the security incident, which of the following would be the BEST action for the analyst to take to increase the chance of detecting this traffic in the future?

48. A security analyst needs to provide the development learn with secure connectivity from the corporate network to a three-tier cloud environment. The developers require access to servers in all three tiers in order to perform various configuration tasks.

Which of the following technologies should the analyst implement to provide secure transport?

49. A vulnerability scanner has identified an out-of-support database software version running on a server. The software update will take six to nine months to complete. The management team has agreed to a one-year extended support contract with the software vendor.

Which of the following BEST describes the risk treatment in this scenario?

50. A threat feed disclosed a list of files to be used as an loC for a zero-day vulnerability.

A cybersecurity analyst decided to include a custom lookup for these files on the endpoint's log-in script as a mechanism to:

51. An analyst is reviewing email headers to determine if an email has been sent from a legitimate sender. The organization uses SPF to validate email origination.

Which of the following most likely indicates an invalid originator?

52. The help desk is having difficulty keeping up with all onboarding and offboarding requests. Managers often submit, requests for new users at the last minute. causing the help desk to scramble to create accounts across many different Interconnected systems.

Which of the following solutions would work BEST to assist the help desk with the onboarding and offboarding process while protecting the company's assets?

53. While implementing a PKI for a company, a security analyst plans to utilize a dedicated server as the certAcate authority that is only used to sign intermediate certificates.

Which of the following are the MOST secure states for the certificate authority server when it is not in use? (Select TWO)

54. White reviewing incident reports from the previous night, a security analyst notices the corporate websites were defaced with po mcai propaganda.

Which of the following BEST Describes this type of actor?

55. A security analyst is reviewing the following Internet usage trend report:





Which of the following usernames should the security analyst investigate further?

56. An organization has the following vulnerability remediation policies:

• For production environment servers:

• Vulnerabilities with a CVSS score of 9.0 or greater must be remediated within 48 hours.

• Vulnerabilities with a CVSS score of 5.0 to 8.9 must be remediated within 96 hours.

• Vulnerabilities in lower environments may be left unremediated for up to two weeks.

* All vulnerability remediations must be validated in a testing environment before they are applied in the production environment.

The organization has two environments: production and testing. The accounting Prod server is the only server that contains highly sensitive information.

A recent vulnerability scan provided the following report:





Which of the following identifies the server that should be patched first? (Choose Two)

57. Which of the following is an advantage of SOAR over SIEM?

58. Which of following allows Secure Boot to be enabled?

59. Which of the following can detect vulnerable third-parly libraries before code deployment?

60. The Chief Information Security Officer (CISO) of a large financial institution is seeking a solution that will block a predetermined set of data points from being transferred or downloaded by employees.

The CISO also wants to track the data assets by name, type, content, or data profile.

Which of the following BEST describes what the CIS wants to purchase?

61. A team of network security analysts is examining network traffic to determine if sensitive data was exfiltrated. Upon further investigation, the analysts believe confidential data was compromised.

Which of the following capabilities would BEST defend against this type of sensitive data exfiltration?

62. A security is reviewing a vulnerability scan report and notes the following finding:





As part of the detection and analysis procedures, which of the following should the analyst do NEXT?

63. An organization is concerned about the proper handling of data and wants to implement measures to help safeguard customer data and the organization's proprietary information from exposure.

Which of the following is the first step to improve awareness of overall privacy and protection?

64. A security analyst is investigating an active threat of the system memory. While narrowing down the source of the threat, the analyst is inspecting all processes to isolate suspicious activity.

Which of the following techniques is the analyst using?

65. A development team has asked users to conduct testing to ensure an application meets the needs of the business.

Which of the fallowing types of testing docs This describe?

66. A security officer needs to find the most cost-effective solution to the current data privacy and protection gap found in the last security assessment.

Which of the following is the BEST recommendation?

67. A security analyst observes a large amount of scanning activity coming from an IP address outside the organization's environment.

Which of the following should the analyst do to block this activity?

68. A forensic analyst is conducting an investigation on a compromised server.

Which of the following should the analyst do first to preserve evidence''

69. An analyst is reviewing the following output as part of an incident:





Which of the Wowing is MOST likely happening?

70. While reviewing a vulnerability assessment, an analyst notices the following issue is identified in the report:





this finding, which of the following would be most appropriate for the analyst to recommend to the network engineer?

71. An employee contacts the SOC to report a high-severity bug that was identified in a new, internally developed web application, which went live in production last week. The SOC staff did not receive contact details or escalation procedures to follow.

Which of the following stages of the SDLC process was overlooked?

72. Which of the following types of controls defines placing an ACL on a file folder?

73. An organization wants to collect loCs from multiple geographic regions so it can sell the information to its customers.

Which of the following should the organization deploy to accomplish this task?

74. An organization prohibits users from logging in to the administrator account. If a user requires elevated permissions. the user's account should be part of an administrator group, and the user should escalate permission only as needed and on a temporary basis.

The organization has the following reporting priorities when reviewing system activity:

• Successful administrator login reporting priority - high

• Failed administrator login reporting priority - medium

• Failed temporary elevated permissions - low

• Successful temporary elevated permissions - non-reportable

A security analyst is reviewing server syslogs and sees the following:

Which of the following events is the HIGHEST reporting priority?

75. Which of the following BEST explains the function of a managerial control?

76. An email analysis system notifies a security analyst that the following message was quarantined and requires further review.





Which of the following actions should the security analyst take?

77. A security analyst at exampte.com receives a SIEM alert for an IDS signature and reviews the associated packet capture and TCP stream:









Winch of the following actions should the security analyst lake NEXT?

78. A company is setting up a small, remote office to support five to ten employees. The company's home office is in a different city, where the company uses a cloud service provider for its business applications and a local server to host its data.

To provide shared access from the remote office to the local server and the business applications, which of the following would be the easiest and most secure solution?

79. An internally developed file-monitoring system identified the following except as causing a program to crash often:





Which of the following should a security analyst recommend to fix the issue?

80. During an Incident, it Is determined that a customer database containing email addresses, first names, and last names was exfiltrated.

Which of the following should the security analyst do NEXT?

81. An analyst received an alert regarding an application spawning a suspicious command shell process.

Upon further investigation, the analyst observes the following registry change occurring immediately after the suspicious event:





Which of the following was the suspicious event able to accomplish?

82. A security analyst notices the following proxy log entries:





Which of the following is the user attempting to do based on the log entries?

83. A company is experiencing a malware attack within its network. A security engineer notices many of the impacted assets are connecting outbound to a number of remote destinations and exfiltrating data. The security engineer also see that deployed, up-to-date antivirus signatures are ineffective.

Which of the following is the BEST approach to prevent any impact to the company from similar attacks in the future?

84. Which of the following incident response components can identify who is the llaison between multiple lines of business and the pubic?

85. During the onboarding process for a new vendor, a security analyst obtains a copy of the vendor's latest penetration test summary:





Performed by: Vendor Red Team Last performed: 14 days ago

Which of the following recommendations should the analyst make first?

86. According to a static analysis report for a web application, a dynamic code evaluation script injection vulnerability was found.

Which of the following actions is the BEST option to fix the vulnerability in the source code?

87. HOTSPOT

A security analyst performs various types of vulnerability scans. Review the vulnerability scan results to determine the type of scan that was executed and if a false positive occurred for each device.



Instructions:

Select the Results Generated drop-down option to determine if the results were generated from a credentialed scan, non-credentialed scan, or a compliance scan.

For ONLY the credentialed and non-credentialed scans, evaluate the results for false positives and check the findings that display false positives. NOTE: If you would like to uncheck an option that is currently selected, click on the option a second time.

Lastly, based on the vulnerability scan results, identify the type of Server by dragging the Server to the results.

The Linux Web Server, File-Print Server and Directory Server are draggable.

If at any time you would like to bring back the initial state of the simulation, please select the Reset All button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

88. Which of the following are considered PII by themselves? (Select TWO).

89. A security team has begun updating the risk management plan, incident response plan, and system security plan to ensure compliance with security review guidelines.

Which of the following can be executed by internal managers to simulate and validate the proposed changes?

90. During an incident response procedure, a security analyst acquired the needed evidence from the hard drive of a compromised machine.

Which of the following actions should the analyst perform next to ensure the data integrity of the evidence?

91. A technician working at company.com received the following email:





After looking at the above communication, which of the following should the technician recommend to the security team to prevent exposure of sensitive information and reduce the risk of corporate data being stored on non-corporate assets?

92. When investigating a compromised system, a security analyst finds the following script in the /tmp directory:





Which of the following attacks is this script attempting, and how can it be mitigated?

93. A digital forensics investigator works from duplicate images to preserve the integrity of the original evidence.

Which of the following types of media are most volatile and should be preserved? (Select two).

94. Which of the following BEST identifies the appropriate use of threat intelligence as a function of detection and response?

95. A security administrator needs to provide access from partners to an Isolated laboratory network inside an organization that meets the following requirements:

• The partners' PCs must not connect directly to the laboratory network.

• The tools the partners need to access while on the laboratory network must be available to all partners

• The partners must be able to run analyses on the laboratory network, which may take hours to complete

Which of the following capabilities will MOST likely meet the security objectives of the request?

96. A security analyst needs to automate the incident response process for malware infections.

When the following logs are generated, an alert email should automatically be sent within 30 minutes:





Which of the following is the best way for the analyst to automate alert generation?

97. An organization is developing software to match customers' expectations.

Before the software goes into production, it must meet the following quality assurance guidelines

• Uncover all the software vulnerabilities.

• Safeguard the interest of the software's end users.

• Reduce the likelihood that a defective program will enter production.

• Preserve the Interests of me software producer

Which of me following should be performed FIRST?

98. A company's Chief Information Officer wants to use a CASB solution to ensure policies are being met during cloud access. Due to the nature of the company's business and risk appetite, the management team elected to not store financial information in the cloud. A security analyst needs to recommend a solution to mitigate the threat of financial data leakage into the cloud.

Which of the following should the analyst recommend?

99. A company is building a new internal network. Instead of creating new credentials, the company wants to streamline each employee's authentication.

Which of the following technologies would best fulfill this requirement?

100. An information security analyst is compiling data from a recent penetration test and reviews the following output:





The analyst wants to obtain more information about the web-based services that are running on the target.

Which of the following commands would most likely provide the needed information?

101. A company has a cluster of web servers that is critical to the business. A systems administrator installed a utility to troubleshoot an issue, and the utility caused the entire cluster to 90 offline.

Which of the following solutions would work BEST prevent to this from happening again?

102. An online gaming company was impacted by a ransomware attack. An employee opened an attachment that was received via an SMS attack on a company-issued mobile device while connected to the network.

Which of the following actions would help during the forensic analysis of the mobile device? (Select TWO).

103. A company is required to monitor for unauthorized changes to baselines on all assets to comply with industry regulations. Two of the remote units did not recover after scans were performed on the assets. An analyst needs to recommend a solution to prevent recurrence.

Which of the following is the best way to satisfy the regulatory requirement without impacting the availability to similar assets and creating an unsustainable process?

A. Manually review the baselines daily and document the results in a change history log

B. Document exceptions with compensating controls to demonstrate the risk mitigation efforts.

C. Implement a new scanning technology to satisfy the monitoring requirement and train the team.

D. Purchase new remote units from other vendors with a proven ability to support scanning requirements.

104. During a review of the vulnerability scan results on a server, an information security analyst notices the following:





The MOST appropriate action for the analyst to recommend to developers is to change the web server so:

105. A security analyst performs a weekly vulnerability scan on a network that has 240 devices and receives a report with 2.450 pages.

Which of the following would most likely decrease the number of false positives?

106. Which of the following is the best method to review and assess the security of the cloud service models used by a company on multiple CSPs?

107. A security analyst is concerned about sensitive data living on company file servers following a zero-day attack that nearly resulted in a breach of millions of customer records. The after action report indicates a lack of controls around the file servers that contain sensitive data.

Which of the following DLP considerations would best help the analyst to classify and address the sensitive data on the file servers?

108. During a routine security review, anomalous traffic from 9.9.9.9 was observed accessing a web server in the corporate perimeter network. The server is mission critical and must remain accessible around the world to serve web content. The Chief Information Security Officer has directed that improper traffic must be restricted.

The following output is from the web server:





Which of the following is the best method to accomplish this task?

109. A security analyst found an old version of OpenSSH running on a DMZ server and determined the following piece of code could have led to a command execution through an integer overflow;





Which of the following controls must be in place to prevent this vulnerability?

110. An intrusion detection analyst reported an inbound connection originating from an unknown IP address recorded on the VPN server for multiple internal hosts. During an investigation, a security analyst determines there were no identifiers associated with the hosts.

Which of the following should the security analyst enforce to obtain the best information?

111. During a risk assessment, a senior manager inquires about what the cost would be if a unique occurrence would impact the availability of a critical service. The service generates $1 ,000 in revenue for the organization. The impact of the attack would affect 20% of the server's capacity to perform jobs. The organization expects that five out of twenty attacks would succeed during the year.

Which of the following is the calculated single loss expectancy?

112. An organization's Cruel Information Security Officer is concerned the proper control are not in place to identify a malicious insider.

Which of the following techniques would be BEST to identify employees who attempt to steal data or do harm to the organization?