CompTIA CS0-002 Exam Actual Questions

Text Material Preview

Itfreedumps provides the latest online questions for all IT certifications,
such as IBM, Microsoft, CompTIA, Huawei, and so on. 
Hot exams are available below. 
AZ-204 Developing Solutions for Microsoft Azure 
820-605 Cisco Customer Success Manager 
MS-203 Microsoft 365 Messaging 
HPE2-T37 Using HPE OneView 
300-415 Implementing Cisco SD-WAN Solutions (ENSDWI) 
DP-203 Data Engineering on Microsoft Azure 
500-220 Engineering Cisco Meraki Solutions v1.0 
NACE-CIP1-001 Coating Inspector Level 1 
NACE-CIP2-001 Coating Inspector Level 2 
200-301 Implementing and Administering Cisco Solutions 
Share some CS0-002 exam online questions below. 
1.An organization has the following risk mitigation policies
• Risks without compensating controls will be mitigated first it the nsk value is greater than $50,000
• Other nsk mitigation will be pnontized based on risk value.
The following risks have been identified:
 1 / 22
https://www.itfreedumps.com/exam/real-microsoft-az-204-dumps/
https://www.itfreedumps.com/exam/real-cisco-820-605-dumps/
https://www.itfreedumps.com/exam/real-microsoft-ms-203-dumps/
https://www.itfreedumps.com/exam/real-hp-hpe2-t37-dumps/
https://www.itfreedumps.com/exam/real-cisco-300-415-dumps/
https://www.itfreedumps.com/exam/real-microsoft-dp-203-dumps/
https://www.itfreedumps.com/exam/real-cisco-500-220-dumps/
https://www.itfreedumps.com/exam/real-nace-nace-cip1-001-dumps/
https://www.itfreedumps.com/exam/real-nace-nace-cip2-001-dumps/
https://www.itfreedumps.com/exam/real-cisco-200-301-dumps/
Which of the following is the ordei of priority for risk mitigation from highest to lowest?
A. A, C, D, B
B. B, C, D, A
C. C, B, A, D
D. C, D, A, B
E. D, C, B, A
Answer: C
Explanation:
The order of priority for risk mitigation from highest to lowest is C, B, A, D.
This order is based on applying the risk mitigation policies of the organization. According to the first
policy, risks without compensating controls will be mitigated first if the risk value is greater than
$50,000. Risk C has no compensating controls and a risk value of $75,000, so it is the highest
priority. Risk B also has no compensating controls, but a risk value of $40,000, so it is the second
priority. According to the second policy, other risk mitigation will be prioritized based on risk value.
Risk A has a risk value of $60,000 and a
compensating control of encryption, so it is the third priority. Risk D has a risk value of $50,000 and a
compensating control of backup power supply, so it is the lowest priority.
2.A security analyst has received a report that servers are no longer able to connect to the network.
After many hours of troubleshooting, the analyst determines a Group Policy Object is responsible for
the network connectivity Issues.
Which of the following solutions should the security analyst recommend to prevent an interruption of
service in the future?
A. Cl/CD pipeline
B. Impact analysis and reporting
C. Appropriate network segmentation
D. Change management process
Answer: D
Explanation:
A change management process is a set of procedures that ensures that any changes to a system or
service are planned, tested, approved, implemented and documented in a controlled and consistent
manner. A change management process can prevent an interruption of service caused by a Group
Policy Object (GPO) by ensuring that the GPO is properly configured, tested and authorized before
applying it to the servers. A change management process can also provide a way to roll back or undo
the changes if they cause any problems.
A CI/CD pipeline is a method of delivering software applications that involves continuous integration
(CI) and continuous delivery (CD). CI is the process of merging code changes from multiple
developers into a shared repository and testing them automatically. CD is the process of deploying
the code changes to different environments (such as testing, staging and production) and releasing
them to customers. A CI/CD pipeline does not prevent an interruption of service caused by a GPO,
but rather helps to deliver software applications faster and more reliably.
 2 / 22
An impact analysis and reporting is a process of assessing the potential effects of a change on a
system or service, such as performance, availability, security and compatibility. An impact analysis
and reporting can help to identify and mitigate any risks or issues associated with a change. However,
an impact analysis and reporting does not prevent an interruption of service caused by a GPO, but
rather helps to evaluate and communicate the consequences of a change.
Appropriate network segmentation is a practice of dividing a network into smaller subnetworks or
segments based on different criteria, such as function, location or security level. Appropriate network
segmentation can improve the performance, security and manageability of a network by reducing
congestion, isolating threats and controlling access. However, appropriate network segmentation
does not prevent an interruption of service caused by a GPO, but rather helps to protect and optimize
a network.
3.An organization has the following policies:
* Services must run on standard ports.
* Unneeded services must be disabled.
The organization has the following servers:
* 192.168.10.1 - web server
* 192.168.10.2 - database server
A security analyst runs a scan on the servers and sees the following output:
Which of the following actions should the analyst take?
A. Disable HTTPS on 192.168.10.1.
B. Disable IIS on 192.168.10.1.
C. Disable DNS on 192.168.10.2.
D. Disable MSSQL on 192.168.10.2.
E. Disable SSH on both servers.
Answer: E
Explanation:
 3 / 22
SSH stands for Secure Shell, which is a protocol that allows remote access and administration of a
server. If the organization has a policy that services must run on standard ports and unneeded
services must be disabled, then SSH should be disabled on both servers, because it runs on port 22,
which is not a standard port for a web server or a database server, and it is not needed for those
servers to function properly. Disabling HTTPS on 192.168.10.1, disabling IIS on 192.168.10.1,
disabling DNS on 192.168.10.1, or disabling MSSQL on 192.168.10.2 are not appropriate actions,
because they would affect the functionality of the web server or the database server and violate the
organization’s policy of running services on standard ports.
Reference: https://www.ssh.com/ssh/port
4.A new variant of malware is spreading on the company network using TCP 443 to contact its
command-and-control server. The domain name used for callback continues to change, and the
analyst is unable to predict future domain name variance .
Which of the following actions should the analyst take to stop malicious communications with the
LEAST disruption to service?
A. Implement a sinkhole with a high entropy level
B. Disable TCP/53 at the parameter firewall
C. Block TCP/443 at the edge router
D. Configure the DNS forwarders to use recursion
Answer: A
Explanation:
A sinkhole is a technique that redirects malicious network traffic to a controlled destination, such as a
fake server or a black hole. A sinkhole can be used to stop malicious communications with a
command-and-control server by preventing the malware from reaching its intended destination. A
high entropy level means that the sinkhole can generate random domain names that match the
changing domain name used by the malware for callback. Blocking TCP/443 at the edge router,
disabling TCP/53 at the perimeter firewall, or configuring the DNS forwarders to use recursion are
other possible actions that could stop malicious communications, but they could also disrupt
legitimate services that use those protocols or settings.
Reference: https://www.cisco.com/c/en/us/about/security-center/dns-sinkholing.html
5.A technician working at company.comreceived the following email:
After looking at the above communication, which of the following should the technician recommend to
the security team to prevent exposure of sensitive information and reduce the risk of corporate data
being stored on non-corporate assets?
A. Forwarding of corporate email should be disallowed by the company.
B. A VPN should be used to allow technicians to troubleshoot computer issues securely.
 4 / 22
C. An email banner should be implemented to identify emails coming from external sources.
D. A rule should be placed on the DLP to flag employee IDs and serial numbers.
Answer: C
Explanation:
An email banner is a message that is added to the top or bottom of an email to provide some
information or warning to the recipient. An email banner should be implemented to identify emails
coming from external sources to prevent exposure of sensitive information and reduce the risk of
corporate data being stored on non-corporate assets. An email banner can help employees recognize
phishing or spoofing attempts and avoid clicking on malicious links or attachments. It can also remind
employees not to share confidential information with external parties or forward corporate emails to
personal accounts. The other options are not relevant or effective for this purpose. References:
CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 13;
https://www.csoonline.com/article/3235970/what-is-spoofing-definition-and-how-to-prevent-it.html
6.A business recently acquired a software company. The software company's security posture is
unknown. However, based on an assessment, there are limited security controls. No significant
security monitoring exists.
Which of the following is the NEXT step that should be completed to obtain information about the
software company's security posture?
A. Develop an asset inventory to determine the systems within the software company
B. Review relevant network drawings, diagrams and documentation
C. Perform penetration tests against the software company's Internal and external networks
D. Baseline the software company's network to determine the ports and protocols in use.
Answer: A
Explanation:
An asset inventory is a list of all the hardware, software, data, and other
resources that an organization owns or uses. An asset inventory helps to identify what systems are
present in an organization, where they are located, what they do, and how they are configured2
Developing an asset inventory is the next step that should be completed to obtain information about
the software company’s security posture, as it provides a baseline for further analysis and
assessment of the systems’ vulnerabilities and risks.
Reference: 2 What Is an Asset Inventory? | UpGuard
7.A security analyst responds to a series of events surrounding sporadic bandwidth consumption from
an endpoint device.
The security analyst then identifies the following additional details:
• Bursts of network utilization occur approximately every seven days.
• The content being transferred appears to be encrypted or obfuscated.
• A separate but persistent outbound TCP connection from the host to infrastructure in a third-party
cloud is in place.
• The HDD utilization on the device grows by 10GB to 12GB over the course of every seven days.
• Single file sizes are 10GB.
Which of the following describes the most likely cause of the issue?
A. Memory consumption
B. Non-standard port usage
C. Data exfiltration
D. System update
E. Botnet participant
Answer: C
Explanation:
 5 / 22
data exfiltration is the unauthorized transfer of data from an organization’s network to an external
destination, usually for malicious purposes such as espionage, sabotage, or theft. The details given in
the question suggest that data exfiltration is occurring from an endpoint device. The bursts of network
utilization every seven days indicate periodic data transfers. The content being transferred appears to
be encrypted or obfuscated to avoid detection or analysis. The persistent outbound TCP connection
from the host to infrastructure in a third-party cloud indicates a possible command and control
channel for an attacker. The HDD utilization on the device grows by 10GB to 12GB over the course of
every seven days, and single file sizes are 10GB, indicating that large amounts of data are being
collected and compressed before being exfiltrated.
8.Which of the following organizational initiatives would be MOST impacted by data severighty
issues?
A. Moving to a cloud-based environment
B. Migrating to locally hosted virtual servers
C. Implementing non-repudiation controls
D. Encrypting local database queries
Answer: A
Explanation:
Data sovereignty is the idea that data are subject to the laws and governance structures of the nation
where they are collected1 Data sovereignty issues can impact organizational initiatives that involve
transferring or storing data across different jurisdictions, such as moving to a cloud-based
environment. Cloud computing involves using remote servers and networks to store and process
data, which may be located in different countries or regions with different data protection laws and
regulations2 This can create challenges for organizations that need to comply with data sovereignty
requirements of their own country or their customers’ countries, such as data localization, data
access, data security, data breach notification, etc3
References: 1 Data sovereignty - Wikipedia 2 What Is Data Sovereignty? Everything You Need to
Know - Permission.io 3 What is data sovereignty? - IONOS
9.After a remote command execution incident occurred on a web server, a security analyst found the
following piece of code in an XML file:
Which of the following it the BEST solution to mitigate this type of attack?
A. Implement a better level of user input filters and content sanitization.
B. Property configure XML handlers so they do not process sent parameters coming from user inputs.
C. Use parameterized Queries to avoid user inputs horn being processed by the server.
D. Escape user inputs using character encoding conjoined with whitelisting
Answer: A
Explanation:
The piece of code in the XML file is an example of a command injection attack, which is a type of
attack that exploits insufficient input validation or output encoding to execute arbitrary commands on a
server or system2 The attacker can inject malicious commands into an XML element that is
processed by an XML handler on the server, and cause the server to execute those commands. The
best solution to mitigate this type of attack is to implement a better level of user input filters and
content sanitization, which means checking and validating any user input before processing it, and
 6 / 22
removing or encoding any potentially harmful characters or commands.
Reference: 2 Command Injection - OWASP
10.A security analyst identified one server that was compromised and used as a data making
machine, and a few of the hard drive that was created.
Which of the following will MOST likely provide information about when and how the machine was
compromised and where the malware is located?
A. System timeline reconstruction
B. System registry extraction
C. Data carving
D. Volatile memory analysts
Answer: A
Explanation:
System timeline reconstruction is a forensic analysis technique that involves creating a chronological
record of events that occurred on a system based on various sources of evidence such as log files,
registry entries, file timestamps, network traffic, etc. System timeline reconstruction can provide
information about when and how the machine was compromised and where the malware is located by
showing when suspicious activities or changes took place on the system, such as unauthorized
access attempts, file creation or modification, process execution,network connections, etc.
Reference: Timeline Analysis - ForensicsWiki
11.A cyber-security analyst is implementing a new network configuration on an existing network
access layer to prevent possible physical attacks.
Which of the following BEST describes a solution that would apply and cause fewer issues during the
deployment phase?
A. Implement port security with one MAC address per network port of the switch.
B. Deploy network address protection with DHCP and dynamic VLANs.
C. Configure 802.1X and EAPOL across the network
D. Implement software-defined networking and security groups for isolation
Answer: A
Explanation:
The security analyst should implement port security with one MAC address per network port of the
switch. This will help prevent possible physical attacks on the network access layer, such as MAC
flooding or MAC spoofing. Port security is a feature that allows a switch to limit the number of MAC
addresses that can be learned on a specific port. By setting the limit to one MAC address per port, the
switch will only allow traffic from the device that is connected to that port, and drop any traffic from
other devices that try to use that port. This will prevent attackers from connecting unauthorized
devices to the network or impersonating legitimate devices by changing their MAC addresses3.
12.A security analyst is investigate an no client related to an alert from the threat detection platform
on a host (10.0 1.25) in a staging environment that could be running a crypto mining tool because it in
sending traffic to an IP address that are related to Bitcoin.
The network rules for the instance are the following:
 7 / 22
Which of the following is the BEST way to isolate and triage the host?
A. Remove rules 1.2. and 3.
B. Remove rules 1.2. 4. and 5.
C. Remove rules 1.2. 3.4. and 5.
D. Remove rules 1.2. and 5.
E. Remove rules 1.4. and 5.
F. Remove rules 4 and 5
Answer: C
Explanation:
The best way to isolate and triage the host is to remove rules 1, 2, 3, 4, and
13.A security analyst sees the following OWASP ZAP output from a scan that was performed against
a modern version of Windows while testing for client-side vulnerabilities:
Which of the following is the MOST likely solution to the listed vulnerability?
A. Enable the browser's XSS filter.
B. Enable Windows XSS protection
C. Enable the browser's protected pages mode
D. Enable server-side XSS protection
Answer: A
Explanation:
Enabling the browser’s XSS filter would be the most likely solution to the listed vulnerability. The
vulnerability is a reflected cross-site scripting (XSS) attack, which occurs when a malicious script is
injected into a web page that reflects user input back to the browser without proper validation or
encoding. The malicious script can then execute in the browser and perform various actions, such as
stealing cookies, redirecting to malicious sites, or displaying fake content2. Enabling the browser’s
XSS filter can help prevent reflected XSS attacks by detecting and blocking malicious scripts before
they execute in the browser3.
14.A security analyst was transferred to an organization's threat-hunting team to track specific activity
throughout the enterprise environment The analyst must observe and assess the number ot times this
activity occurs and aggregate the results.
Which of the following is the BEST threat-hunting method for the analyst to use?
 8 / 22
A. Stack counting
B. Searching
C. Clustering
D. Grouping
Answer: A
Explanation:
Stack counting is the best threat-hunting method for the analyst to use to observe and assess the
number of times a specific activity occurs and aggregate the results. Stack counting is a technique
that involves collecting data from multiple sources, such as logs, events, or alerts, and grouping them
by a common attribute, such as an IP address, a user name, or a process name. Stack counting can
help identify patterns, trends, outliers, or anomalies in the data that may indicate malicious activity or
compromise.
15.A small organization has proprietary software that is used internally. The system has not been wen
maintained and cannot be updated with the rest or the environment.
Which of the following is the BEST solution?
A. virtualize the system and decommission the physical machine.
B. Remove it from the network and require air gapping.
C. Implement privileged access management for identity access.
D. Implement MFA on the specific system.
Answer: A
Explanation:
A virtualized system is a system that runs on a software layer called a hypervisor that emulates the
hardware resources of a physical machine. A virtualized system can have its own operating system,
applications, and data that are isolated from other virtualized systems or the host machine3 A
virtualized system can be a solution for a small organization that has proprietary software that is used
internally but cannot be updated with the rest of the environment.
By virtualizing the system and decommissioning the physical machine, the organization can achieve
several benefits, such as:
✑ Reducing hardware costs and maintenance
✑ Improving performance and scalability
✑ Enhancing security and compliance
✑ Simplifying backup and recovery
✑ Enabling portability and compatibility
Reference: 3 What Is Virtualization? | VMware
16.A company is aiming to test a new incident response plan. The management team has made it
clear that the initial test should have no impact on the environment. The company has limited
resources to support testing.
Which of the following exercises would be the best approach?
A. Tabletop scenarios
B. Capture the flag
C. Red team vs. blue team
D. Unknown-environment penetration test
Answer: A
Explanation:
A tabletop scenario is an informal, discussion-based session in which a team discusses their roles
and responses during an emergency, walking through one or more example scenarios. A tabletop
scenario is the best approach for a company that wants to test a new incident response plan without
impacting the environment or using many resources. A tabletop scenario can help the company
 9 / 22
identify strengths and weaknesses in their plan, clarify roles and responsibilities, and improve
communication and coordination among team members. The other options are more intensive and
disruptive exercises that involve simulating a real incident or attack. References: CompTIA
Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 16;
https://www.linkedin.com/pulse/tabletop-exercises-explained-matt-lemon-phd
17.A company wants to configure the environment to allow passive network monitonng.
To avoid disrupting the sensitive network, which of the following must be supported by the scanner's
NIC to assist with the company's request?
A. Port bridging
B. Tunnel all mode
C. Full-duplex mode
D. Port mirroring
E. Promiscuous mode
Answer: E
Explanation:
Promiscuous mode is the mode that must be supported by the scanner’s NIC to assist with the
company’s request of passive network monitoring. Promiscuous mode is a mode of operation for a
network interface controller (NIC) that causes the controller to pass all traffic it receives to the central
processing unit (CPU) rather than passing only the frames that the controller is specifically
programmed to receive. This mode is normally used for packet sniffing, the practice of collecting and
logging packets that pass through the network for further analysis, such as the analysis of traffic or
bandwidth usage1. Promiscuous mode makes sure all transmitted data packets are received and
read by network adapters.
18.A product manager is working with an analyst to design a new application that will perform as a
data analytics platform and will be accessible via a web browser. The product manager suggests
using a PaaS provider to host the application.
Whichof the following is a security concern when using a PaaS solution?
A. The use of infrastructure-as-code capabilities leads to an increased attack surface.
B. Patching the underlying application server becomes the responsibility of the client.
C. The application is unable to use encryption at the database level.
D. Insecure application programming interfaces can lead to data compromise.
Answer: D
Explanation:
Insecure application programming interfaces (APIs) can lead to data compromise when using a PaaS
solution. APIs are interfaces that allow applications to communicate with each other and with the
underlying platform. APIs can expose sensitive data or functionality to unauthorized or malicious
users if they are not properly designed, implemented, or secured. Insecure APIs can result in data
breaches, denial of service, unauthorized access, or code injection.
Reference: https://spot.io/resources/cloud-security/paas-security-threats-solutions-and-best-practices/
19.During a company’s most recent incident, a vulnerability in custom software was exploited on an
externally facing server by an APT.
The lessons-learned report noted the following:
• The development team used a new software language that was not supported by the security team's
automated assessment tools.
• During the deployment, the security assessment team was unfamiliar with the new language and
struggled to evaluate the software during advanced testing. Therefore, the vulnerability was not
 10 / 22
detected.
• The current IPS did not have effective signatures and policies in place to detect and prevent runtime
attacks on the new application.
To allow this new technology to be deployed securely going forward, which of the following will BEST
address these findings? (Choose two.)
A. Train the security assessment team to evaluate the new language and verify that best practices for
secure coding have been followed
B. Work with the automated assessment-tool vendor to add support for the new language so these
vulnerabilities are discovered automatically
C. Contact the human resources department to hire new security team members who are already
familiar with the new language
D. Run the software on isolated systems so when they are compromised, the attacker cannot pivot to
adjacent systems
E. Instruct only the development team to document the remediation steps for this
vulnerability
F. Outsource development and hosting of the applications in the new language to a third-party vendor
so the risk is transferred to that provider
Answer: A,B
Explanation:
The solution will address the findings that the development team used a new software language that
was not supported by the security team's automated assessment tools and the security assessment
team was unfamiliar with the new language and struggled to evaluate the software during advanced
testing. The training of the security assessment team and working with the automated assessment-
tool vendor to add support for the new language will ensure that future deployments of the new
technology are secure and the vulnerabilities are detected and prevented.
20.An organization is focused on restructuring its data governance programs and an analyst has been
Tasked with surveying sensitive data within the organization.
Which of the following is the MOST accurate method for the security analyst to complete this
assignment?
A. Perform an enterprise-wide discovery scan.
B. Consult with an internal data custodian.
C. Review enterprise-wide asset Inventory.
D. Create a survey and distribute it to data owners.
Answer: A
Explanation:
A data governance program is a collection of practices, policies, and procedures that manage,
leverage, and protect the data assets of an organization1. It requires changing the workplace culture
and adding some software1. To survey sensitive data within the organization, the most accurate
method is to perform an enterprise-wide discovery scan that can identify and classify data from
various sources and systems2. This way, the analyst can have a comprehensive view of the data
landscape and its quality, security, accessibility, and usage. Consulting with an internal data
custodian (B) or reviewing enterprise-wide asset inventory © may provide some insights, but not as
accurate or complete as a discovery scan. Creating a survey and distributing it to data owners (D)
may be time-consuming and unreliable, as data owners may not have the full knowledge or
awareness of their data.
References:
1: https://www.analytics8.com/blog/8-steps-to-start-your-data-governance-program/
2: https://solutionsreview.com/data-management/the-best-data-governance-tools-and-software/
 11 / 22
21.Which of me following are reasons why consumer IoT devices should be avoided in an enterprise
environment? (Select TWO)
A. Message queuing telemetry transport does not support encryption.
B. The devices may have weak or known passwords.
C. The devices may cause a dramatic Increase in wireless network traffic.
D. The devices may utilize unsecure network protocols.
E. Multiple devices may interface with the functions of other loT devices.
F. The devices are not compatible with TLS 12.
Answer: B,D
Explanation:
Consumer IoT devices are devices that connect to the internet and provide various functions or
services for personal or home use, such as smart speakers, cameras, thermostats, etc. Consumer
IoT devices should be avoided in an enterprise environment because they may pose security risks or
challenges for the organization’s network and data. Some of the reasons why consumer IoT devices
should be avoided are:
✑ The devices may have weak or known passwords: Many consumer IoT devices come with default
or hardcoded passwords that are easy to guess or find online. Some devices may not allow users to
change their passwords or enforce strong password policies. This can make them vulnerable to brute-
force attacks or unauthorized access by attackers.
✑ The devices may utilize unsecure network protocols: Many consumer IoT devices use unsecure
network protocols to communicate with other devices or servers, such as HTTP, FTP, Telnet, etc.
These protocols do not encrypt or authenticate the data they transmit or receive, which can expose
them to interception, modification, or spoofing by attackers.
Reference: Why Consumer IoT Devices Should Be Avoided In Enterprise Environments | Security
Boulevard
22.A company's blocklist has outgrown the current technologies in place. The ACLs are at maximum,
and the IPS signatures only allow a certain amount of space for domains to be added, creating the
need for multiple signatures.
Which of the following configuration changes to the existing controls would be the MOST appropriate
to improve performance?
A. Implement a host-file-based solution that will use a list of all domains to deny for all machines on
the network.
B. Create an IDS for the current blocklist to determine which domains are showing activity and may
need to be removed
C. Review the current blocklist and prioritize it based on the level of threat severity. Add the domains
with the highest severity to the blocklist.
D. Review the current blocklist to determine which domains can be removed from the list and then
update the ACLs
Answer: D
Explanation:
This is the most effective way to improve performance, as it allows you to reduce the amount of
domains in the blocklist and reduce the size of the ACLs. By reviewing the blocklist and removing
domains that are no longer active or no longer pose a threat, the blocklist can be reduced and the
ACLs updated accordingly. This will reduce the amount of traffic and processing power required to
manage the blocklist, and can help improve overall performance.
23.Industry partners from critical infrastructure organizations were victims of attacks on their SCADA
devices. The attacker was able to gain access to the SCADAby logging in to an account with weak
credentials.
 12 / 22
Which of the following identity and access management solutions would help to mitigate this risk?
A. Multifactor authentication
B. Manual access reviews
C. Endpoint detection and response
D. Role-based access control
Answer: D
Explanation:
RBAC helps organizations manage access to critical infrastructure networks by assigning access
based on roles. This allows organizations to control who can access specific resources and helps
eliminate weak credentials that attackers could exploit. Manual reviews and endpoint detection and
response can also help to mitigate risk, but role based access control is the best solution for this
scenario.
24.A cybersecunty analyst needs to harden a server that is currently being used as a web server. The
server needs to be accessible when entenng www company com into the browser Additionally web
pages require frequent updates which are performed by a remote contractor.
Given the following output:
Which of the following should the cybersecunty analyst recommend to harden the server? (Select
TWO).
A. Uninstall the DNS service
B. Perform a vulnerability scan
C. Change the server's IP to a private IP address
D. Disable the Telnet service
E. Block port 80 with the host-based firewall
F. Change the SSH port to a non-standard port
Answer: D,F
Explanation:
Disabling the Telnet service would harden the server by removing an insecure protocol that transmits
data in cleartext and could allow unauthorized access to the server. Changing the SSH port to a non-
standard port would harden the server by reducing the exposure to brute-force attacks or port scans
that target the default SSH port (22). Uninstalling the DNS service, performing a vulnerability scan,
changing the server’s IP to a private IP address, or blocking port 80 with the host-based firewall would
not harden the server or could affect its functionality as a web server.
Reference: https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html
 13 / 22
25.While monitoring the information security notification mailbox, a security analyst notices several
emails were repotted as spam.
Which of the following should the analyst do FIRST?
A. Block the sender In the email gateway.
B. Delete the email from the company's email servers.
C. Ask the sender to stop sending messages.
D. Review the message in a secure environment.
Answer: D
Explanation:
The security analyst should review the message in a secure environment first. This will help
determine if the message is indeed spam or if it contains any malicious content, such as malware
attachments or phishing links. Reviewing the message in a secure environment means using a
sandbox or an isolated system that can prevent any potential harm to the analyst’s system or
network. If the message is confirmed to be spam or malicious, then the analyst can take further
actions, such as blocking the sender, deleting the email, or notifying the users3.
26.While observing several host machines, a security analyst notices a program is overwriting data to
a buffer.
Which of the following controls will best mitigate this issue?
A. Data execution prevention
B. Output encoding
C. Prepared statements
D. Parameterized queries
Answer: A
Explanation:
Data execution prevention (DEP) is a security feature that prevents code from being executed in
memory regions that are marked as data-only. This helps mitigate buffer overflow attacks, which are a
type of attack where a program overwrites data to a buffer beyond its allocated size, potentially
allowing malicious code to be executed. DEP can be implemented at the hardware or software level
and can prevent unauthorized code execution in memory buffers. References: CompTIA
Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 10;
https://docs.microsoft.com/en-us/windows/win32/memory/data-execution-prevention
27.While reviewing a vulnerability assessment, an analyst notices the following issue is identified in
the report:
this finding, which of the following would be most appropriate for the analyst to recommend to the
network engineer?
A. Reconfigure the device to support only connections leveraging TLSv1.2.
B. Obtain a new self-signed certificate and select AES as the hashing algorithm.
C. Replace the existing certificate with a certificate that uses only MD5 for signing.
D. Use only signed certificates with cryptographically secure certificate sources.
 14 / 22
Answer: A
Explanation:
The vulnerability assessment report shows that the device is using SSLv3, which is an outdated and
insecure protocol for secure communication over a network. SSLv3 has several known vulnerabilities,
such as POODLE, that allow attackers to decrypt or modify the encrypted data. To remediate this
issue, the analyst should recommend reconfiguring the device to support only connections leveraging
TLSv1.2, which is a newer and more secure protocol that provides stronger encryption,
authentication, and integrity protection for the data transmitted over the network.
28.Which of the following is a difference between SOAR and SCAP?
A. SOAR can be executed taster and with fewer false positives than SCAP because of advanced
heunstics
B. SOAR has a wider breadth of capability using orchestration and automation, while SCAP is more
limited in scope
C. SOAR is less expensive because process and vulnerability remediation is more automated than
what SCAP does
D. SOAR eliminates the need for people to perform remediation, while SCAP relies heavily on
security analysts
Answer: B
Explanation:
SOAR has a wider breadth of capability using orchestration and automation, while SCAP is more
limited in scope. SOAR (Security Orchestration, Automation and Response) is a technology that helps
coordinate, execute and automate tasks between various people and tools within a single platform.
SOAR can help improve the efficiency and effectiveness of security operations by reducing manual
effort, enhancing collaboration, and accelerating incident response1. SCAP (Security Content
Automation Protocol) is a standard that enables automated vulnerability management, measurement
and policy compliance evaluation of systems deployed in an organization2. SCAP can help assess
the security posture and compliance status of systems by using predefined specifications and
checklists. However, SCAP does not provide orchestration or automation capabilities beyond
vulnerability scanning and reporting.
29.A security analyst observes a large amount of scanning activity coming from an IP address outside
the organization's environment.
Which of the following should the analyst do to block this activity?
A. Create an IPS rule to block the subnet.
B. Sinkhole the IP address.
C. Create a firewall rule to block the IP address.
D. Close all unnecessary open ports.
Answer: C
Explanation:
A firewall is a device or software that controls the incoming and outgoing network traffic based on
predefined rules. Creating a firewall rule to block the IP address that is scanning the organization’s
environment is an effective way to stop this activity and prevent potential attacks. Creating an IPS rule
to block the subnet, sinkholing the IP address, or closing all unnecessary open ports are other
possible actions, but they are not as specific or efficient as creating a firewall rule to block the IP
address.
Reference: https://www.cisco.com/c/en/us/solutions/small-business/resource-
center/security/firewall.html
 15 / 22
30.A security analyst is reviewing WAF alerts and sees the following request:
Which of the following BEST describes the attack?
A. SQL injection
B. LDAP injection
C. Command injection
D. Denial of service
Answer: A
Explanation:
The attack is a SQL injection attack. SQL injection is a type of attackthat exploits a security
vulnerability in an application’s software that allows user input to be executed as SQL commands by
the underlying database3. SQL injection can enable an attacker to perform various malicious actions
on the database, such as reading, modifying, deleting or creating data; executing commands; or
bypassing authentication. The request shows that the attacker has entered a malicious SQL
statement in the username parameter that attempts to drop (delete) all tables in the database.
31.A security analyst wants to capture large amounts of network data that will be analyzed at a later
time. The packet capture does not need to be in a format that is readable by humans, since it will be
put into a binary file called "packetCapture." The capture must be as efficient as possible, and the
analyst wants to minimize the likelihood that packets will be missed.
Which of the following commands will best accomplish the analyst's objectives?
A. tcpdump -w packetCapture
B. tcpdump -a packetCapture
C. tcpdump -n packetCapture
D. nmap -v > packetCapture
E. nmap -oA > packetCapture
Answer: A
Explanation:
The tcpdump command is a network packet analyzer tool that can capture and display network traffic.
The -w option specifies a file name to write the captured packets to, in a binary format that can be
read by tcpdump or other tools later. This option is useful for capturing large amounts of network data
that will be analyzed at a later time, as the question requires. The packet capture does not need to be
in a format that is readable by humans, since it will be put into a binary file called “packetCapture”.
The capture must be as efficient as possible, and the -w option minimizes the processing and output
overhead of tcpdump, reducing the likelihood that packets will be missed.
32.A security analyst is reviewing the network security monitoring logs listed below:
 16 / 22
Which of the following is the analyst most likely observing? (Select two).
A. 10.1.1.128 sent potential malicious traffic to the web server.
B. 10.1.1.128 sent malicious requests, and the alert is a false positive
C. 10.1.1.129 successfully exploited a vulnerability on the web server
D. 10.1.1.129 sent potential malicious requests to the web server
E. 10.1.1.129 can determine mat port 443 is being used
F. 10.1.1.130 can potentially obtain information about the PHP version
Answer: D,F
Explanation:
A security analyst is reviewing the network security monitoring logs listed below and is most likely
observing that 10.1.1.129 sent potential malicious requests to the web server and that 10.1.1.130 can
potentially obtain information about the PHP version. The logs show that 10.1.1.129 sent two
requests to the web server with suspicious parameters, such as “union select” and “or 1=1”, which are
commonly used for SQL injection attacks. The logs also show that 10.1.1.130 sent a request to the
web server with a parameter “phpinfo”, which is a function that displays information about the PHP
configuration and environment, which can be useful for attackers to find vulnerabilities or exploit them.
References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page
8; https://owasp.org/www-community/attacks/SQL_Injection;
https://www.php.net/manual/en/function.phpinfo.php
33.As part of an Intelligence feed, a security analyst receives a report from a third-party trusted
source. Within the report are several detrains and reputational information that suggest the company's
employees may be targeted for a phishing campaign.
 17 / 22
Which of the following configuration changes would be the MOST appropriate for Mergence
gathering?
A. Update the whitelist.
B. Develop a malware signature.
C. Sinkhole the domains
D. Update the Blacklist
Answer: D
Explanation:
A blacklist is a list of domains, IP addresses, email addresses, or other identifiers that are known or
suspected to be malicious or harmful. A blacklist can be used to block or filter unwanted or dangerous
traffic from reaching a network or system2 Updating the blacklist can help prevent phishing
campaigns by adding the domains or email addresses of the phishing sources to the list and
preventing them from sending emails to the company’s employees.
Reference: 2 What Is a Blacklist? | Malwarebytes
34.CORRECT TEXT
A security analyst discovers suspicious host activity while performing monitoring activities.
The analyst pulls a packet capture for the activity and sees the following:
Which of the following describes what has occurred?
The host attempted to download an application from utoftor.com.
B. The host downloaded an application from utoftor.com.
C. The host attempted to make a secure connection to utoftor.com.
D. The host rejected the connection from utoftor.com.
Answer: C
Explanation:
The packet capture shows that the host sent a Client Hello message to utoftor.com on port 443. This
message is part of the TLS (Transport Layer Security) handshake protocol, which is used to establish
a secure connection between a client and a server1. The Client Hello message contains information
such as the supported TLS version, cipher suites, and extensions that the client can use for the
secure connection. The server is expected to respond with a Server Hello message that selects the
parameters for the secure connection. However, the packet capture does not show any response
from the server, which means that the host only attempted to make a secure connection to
utoftor.com, but did not succeed. The host did not download (B) or reject (D) any application from
utoftor.com.
35.During an Incident, it Is determined that a customer database containing email addresses, first
names, and last names was exfiltrated.
Which ot the following should the security analyst do NEXT?
 18 / 22
A. Consult with the legal department for regulatory impact.
B. Encrypt the database with available tools.
C. Email the customers to inform them of the breach.
D. Follow the incident communications process.
Answer: D
Explanation:
An incident communications process is a set of procedures that defines how to communicate with
internal and external stakeholders during and after an incident, such as customers, employees,
management, regulators and media. An incident communications process can help to provide
accurate, timely and consistent information about the incident, its impact and the actions taken to
resolve it. An incident communications process can also help to maintain trust and reputation, comply
with legal obligations and prevent misinformation or confusion3.
36.A company has a cluster of web servers that is critical to the business. A systems administrator
installed a utility to troubleshoot an issue, and the utility caused the entire cluster to 90 offline.
Which of the following solutions would work BEST prevent to this from happening again?
A. Change management
B. Application whitelisting
C. Asset management
D. Privilege management
Answer: A
Explanation:
Change Management
o The process through which changes to the configuration of information systems are monitored and
controlled, as part of the organization's overall configuration management efforts
o Each individual component should have a separate document or database record that describes its
initial state and subsequent changes Configuration information
Patches installed
Backup records
Incident reports/issues
o Change management ensures all changes are planned and controlled to minimize risk of a service
disruption
Change management is a process that ensures changes to systems or processes are introduced in a
controlled and coordinated manner. Change management helps to minimize the impact of changes
on the business operations and avoid unintended consequences or errors3 Change management can
help prevent the issue of utility installation affectingthe web server cluster by ensuring that the utility
is properly planned, tested, approved, documented, communicated, and monitored.
Reference: 3 What is change management? | ITIL | AXELOS
37.A developer is working on a program to convert user-generated input in a web form before it is
displayed by the browser. This technique is referred to as:
A. output encoding.
B. data protection.
C. query parameterization.
D. input validation.
Answer: A
Explanation:
Output encoding is a technique that converts user-generated input in a web form before it is displayed
by the browser. Output encoding is a form of data sanitization that prevents cross-site scripting (XSS)
attacks, which occur when malicious scripts are injected into web pages and executed by
 19 / 22
unsuspecting users4. Output encoding works by replacing special characters in user input, such as <,
>, ", ', &, etc., with their HTML-encoded equivalents, such as <, >, ", ', &, etc. This prevents the
browser from interpreting the user input as HTML or JavaScript code and executing it.
38.A security analyst needs to provide the development team with secure connectivity from the
corporate network to a three-tier cloud environment. The developers require access to servers in all
three tiers in order to perform various configuration tasks.
Which of the following technologies should the analyst implement to provide secure transport?
A. CASB
B. VPC
C. Federation
D. VPN
Answer: D
Explanation:
A VPN is a secure network connection that allows users to access their private corporate networks
over the internet, while keeping the connection encrypted and secure. This makes it an ideal solution
for providing the development team with secure connectivity from the corporate network to a three-tier
cloud environment. https://www.comptia.org/content/virtual-private-networks
39.An organization's internal department frequently uses a cloud provider to store large amounts of
sensitive data. A threat actor has deployed a virtual machine to at the use of the cloud hosted
hypervisor, the threat actor has escalated the access rights.
Which of the following actions would be BEST to remediate the vulnerability?
A. Sandbox the virtual machine.
B. Implement an MFA solution.
C. Update lo the secure hypervisor version.
D. Implement dedicated hardware for each customer.
Answer: C
Explanation:
MFA can be used to reduce the likelihood that the attacker gains access to the VM, however, the
scenario specifically states that the attacker was able to escalate rights and the question asks what
can be done to remediate the vulnerability. the vulnerability in this case would be the ability to
escalate rights.
The best way to remediate the vulnerability is to update to the secure hypervisor version. A hypervisor
is a software that creates and manages virtual machines on a physical server. A hypervisor can be
vulnerable to various attacks, such as privilege escalation, code injection, or denial-of-service.
Updating to the secure hypervisor version can help fix any known bugs or flaws in the hypervisor
software and prevent attackers from exploiting them. Updating to the secure hypervisor version can
also provide additional security features or enhancements that can improve the protection of the
virtual machines and their data.
40.During an incident response procedure, a security analyst collects a hard drive to analyze a
possible vector of compromise. There is a Linux swap partition on the hard drive that needs to be
checked.
Which of the following, should the analyst use to extract human-readable content from the partition?
A. strings
B. head
C. fsstat
D. dd
 20 / 22
Answer: A
Explanation:
The strings command is a Linux utility that can extract human-readable content from any file or
partition3. It can be used to analyze a Linux swap partition by finding text strings that may indicate
malicious activity or compromise4. The head command (B) can only display the first few lines of a file
or partition, which may not contain any useful information. The fsstat command © can only display file
system statistics such as size, type, and layout, which may not reveal any human-readable content.
The dd command (D) can only copy or convert a file or partition, which may not extract any human-
readable content.
References: 3: https://linux.die.net/man/1/strings 4 : https://www.linuxjournal.com/content/using-
strings-command
41.Which of the following attack techniques has the GREATEST likelihood of quick success against
Modbus assets?
A. Remote code execution
B. Buffer overflow
C. Unauthenticated commands
D. Certificate spoofing
Answer: C
Explanation:
Modbus is a communication protocol that is widely used in industrial control systems (ICS). Modbus
does not have any built-in security features, such as authentication or encryption, which makes it
vulnerable to various attacks. One of the most common and effective attack techniques against
Modbus assets is to send unauthenticated commands to manipulate or disrupt the operation of the
devices. Remote code execution, buffer overflow, and certificate spoofing are other attack techniques,
but they have less likelihood of quick success against Modbus assets.
Reference: https://www.sciencedirect.com/science/article/pii/S2405959517300045
42.A security analyst who works in the SOC receives a new requirement to monitor for indicators of
compromise.
Which of the following is the first action the analyst should take in this situation?
A. Develop a dashboard to track the indicators of compromise.
B. Develop a query to search for the indicators of compromise.
C. Develop a new signature to alert on the indicators of compromise.
D. Develop a new signature to block the indicators of compromise.
Answer: B
Explanation:
Developing a query to search for the indicators of compromise is the first action the analyst should
take in this situation. Indicators of compromise (IOCs) are pieces of information that suggest a system
or network has been compromised by an attacker. IOCs can include IP addresses, domain names,
file hashes, URLs, or other artifacts that are associated with malicious activity. Developing a query to
search for IOCs can help to identify any potential incidents or threats in the environment and initiate
further investigation or response.
Reference: https://www.crowdstrike.com/cybersecurity-101/incident-response/indicators-of-
compromise/
 21 / 22
Get CS0-002 exam dumps full version.
 22 / 22
https://www.itfreedumps.com/exam/real-comptia-cs0-002-dumps/