CS0-004 Practice Questions PDF

Prévia do material em texto

https://www.passcert.com/CS0-004.html
Page 2
13 questions selected from source version V8.02
COMPTIA CYBERSECURITY ANALYST
Question 1
The Chief Information Security Officer wants to improve internal security measures by continuously validating
and verifying access to the production environment.
Which of the following concepts best describes this practice?
A. Secure access service edge
B. Next-generation firewall
C. Zero Trust
D. Privileged access management
Answer: C
COMPTIA CYBERSECURITY ANALYST
Question 2
Which of the following network architectures would best implement a perimeter-less network topology?
A. Hybrid cloud networks
B. Secure access service edge
C. Cloud-native computing
D. Content delivery networks
Answer: B
COMPTIA CYBERSECURITY ANALYST
Question 3
A security analyst uses a full pcap solution to extract all traffic from the last two days associated with the
10.213.4.27 file server.
This file server is under investigation due to concerns about potential data exfiltration using Domain Name
System (DNS) traffic.
Which of the following commands should the analyst use to extract any potentially leaked data from the
suspicious.pcap file?
A. strings suspicious.pcap | grep 10.213.4.27
B. zeek -r suspicious.pcap; grep 10.213.4.27 file.log
C. snort -r suspicious.pcap; grep eve.log 10.213.4.27
D. tcpdump -r suspicious.pcap port 53 and host 10.213.4.27
Answer: D
https://www.passcert.com/CS0-004.html
https://www.passcert.com/CS0-004.html
Page 3
COMPTIA CYBERSECURITY ANALYST
Question 4
A security operations center (SOC) analyst investigates the results of a password spray test conducted by
the vulnerability management team.
The analyst must:
Identify Linux systems that have successful and unsuccessful logins with username "User1".
Create an output report named "linux-events" of all the events to a flat file.
The analyst issues the following console command:
ls /var/log/
The shortened output of the command is below:
Which of the following commands should the analyst use to meet the report output requirements?
A. cat /var/log/sssd | grep "User1" > linux-events.txt
B. cat /var/log/faillog.log | grep "User1" > linux-events.txt
C. cat /var/log/syslog | grep "User1" > linux-events.txt
D. cat /var/log/auth.log | grep "User1" > linux-events.txt
Answer: D
COMPTIA CYBERSECURITY ANALYST
Question 5
Multiple users report unexpected mouse movements and terminal windows opening.
An analyst reviewing the network traffic logs observes the following:
Which of the following is the most likely reason for the reported symptoms?
A. Activity is on an internally addressable network.
B. A reverse tunnel is being used to send commands.
https://www.passcert.com/CS0-004.html
https://www.passcert.com/CS0-004.html
Page 4
Question 5 continued
C. Remote Desktop Protocol (RDP) is being used to remotely control the impacted computers.
D. Virtual Network Computing is being used to connect to systems.
Answer: D
COMPTIA CYBERSECURITY ANALYST
Question 6
A security team deploys a new scanning solution that requires root, domain administrator, and local server
administrator permissions on all systems.
Which of the following is the best way to help mitigate the risk for this level of access?
A. Enabling single sign-on for all administrators
B. Integrating token-based authentication using a privileged access management (PAM) solution
C. Using temporary, one-time passwords as part of the login process
D. Configuring agentless scanning for critical targets
Answer: B
COMPTIA CYBERSECURITY ANALYST
Question 7
An analyst receives the following output:
Which of the following is the correct number of discovered systems that are allowing unencrypted traffic?
A. 1
B. 2
C. 3
D. 5
Answer: B
https://www.passcert.com/CS0-004.html
https://www.passcert.com/CS0-004.html
Page 5
COMPTIA CYBERSECURITY ANALYST
Question 8
An analyst reviews a summarized vulnerability report through a governance, risk, and compliance (GRC)
reporting tool.
The following report correlates asset information from the configuration management database (CMDB)
against detected vulnerabilities:
Which of the following servers should the analyst prioritize based on the target value, the risk, and the
likelihood of exploitation?
A. PRODWEB-02
B. MPC-Control
C. DEVWIN11-01
D. PRODWEB-01
Answer: D
COMPTIA CYBERSECURITY ANALYST
Question 9
There is an alert coming from the security information and event management system.
Which of the following is the first task an analyst should complete?
A. Contact the incident coordinator to communicate the vulnerability.
B. Conduct remediation activities within the recovery phase.
C. Escalate the issue to the help desk team.
D. Perform triage activities that will identify the risk.
Answer: D
https://www.passcert.com/CS0-004.html
https://www.passcert.com/CS0-004.html
Page 6
COMPTIA CYBERSECURITY ANALYST
Question 10
A security analyst isolates a Windows 11 workstation from the network after known malware is detected. The
list of security information and event management (SIEM) events during the malware installation and timeline
does not identify a specific user who was logged in. The security analyst uses the local administrative
account to log in and would like a list of logins to the machine.
Which of the following PowerShell commands should the analyst use?
A. Eventvwr.exe -LogType "Security" EventID "*" | Export-Csv c:\temp\Seclog.csv -NoTypeInformation
B. Get-WinEvent -FilterHashTable @{ Logname="Security"
ED=4624;
} | Sort-Object TimeCreated -Descending | Export-Csv c:\temp\Seclog.csv -NoTypeInformation
C. Get-WinEvent -FilterHashTable @{ Logname="System"
ED=9754;
} | Sort-Object TimeCreated -Descending | Export-Csv c:\temp\Seclog.csv -NoTypeInformation
D. Get-WinEvent -FilterHashTable @{ Logname="Application"
ED=7124;
} | Sort-Object TimeCreated -Descending | Export-Csv c:\temp\Seclog.csv -NoTypeInformation
Answer: B
COMPTIA CYBERSECURITY ANALYST
Question 11
Which of the following occurs during the analysis phase of the incident response process?
A. Triage
B. Alert writing
C. Reimaging
D. Isolation
Answer: A
COMPTIA CYBERSECURITY ANALYST
Question 12
A security architect reviews a report from a third-party incident response consultant and observes the
following:
Which of the following frameworks did the consultant use to perform analysis?
A. Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege (STRIDE)
https://www.passcert.com/CS0-004.html
https://www.passcert.com/CS0-004.html
Page 7
Question 12 continued
B. MITRE ATT&CK
C. Diamond Model of Intrusion Analysis
D. National Institute of Standards and Technology (NIST) Cybersecurity Framework
E. Cyber Kill Chain
Answer: C
COMPTIA CYBERSECURITY ANALYST
Question 13
Which of the following is commonly used after an incident has been resolved to identify efficiencies and
corrective actions related to activities performed during the incident response process?
A. Lessons learned
B. Key performance indicators (KPIs) and performance metrics
C. Executive summary
D. Root cause analysis
Answer: A
https://www.passcert.com/CS0-004.html