CompTIA CS0-002 Practice Exam Questions

CompTIA CS0-002 Sample Question Answers

Question # 1

A security analyst is researching an incident and uncovers several details that may link toother incidents. The security analyst wants to determine if other incidents are related to thecurrent incident Which of the followinq threat research methodoloqies would be MOSTappropriate for the analyst to use?

A. Reputation data 
B. CVSS score 
C. Risk assessment 
D. Behavioral analysis 

Show Answer

Question # 2

An organization recently discovered some inconsistencies in the motherboards it receivedfrom a vendor. The organization's security team then provided guidance on how to ensurethe authenticity of the motherboards it received from vendors.Which of the following would be the BEST recommendation for the security analyst toprovide'?

A. The organization should evaluate current NDAs to ensure enforceability of legal actions. 
B. The organization should maintain the relationship with the vendor and enforcevulnerability scans. 
C. The organization should ensure all motherboards are equipped with a TPM. 
D. The organization should use a certified, trusted vendor as part of the supply chain. 

Show Answer

Question # 3

Which of the following data security controls would work BEST to prevent real Pll frombeing used in an organization's test cloud environment?

A. Digital rights management 
B. Encryption 
C. Access control 
D. Data loss prevention 
E. Data masking 

Show Answer

Question # 4

A security analyst received an alert from the SIEM indicating numerous login attempts fromusers outside their usual geographic zones, all of which were initiated through the webbased mail server. The logs indicate all domain accounts experienced two login attemptsduring the same time frame.Which of the following is the MOST likely cause of this issue?

A. A password-spraying attack was performed against the organization. 
B. A DDoS attack was performed against the organization. 
C. This was normal shift work activity; the SIEM's AI is learning. 
D. A credentialed external vulnerability scan was performed. 

Show Answer

Question # 5

As part of a review of incident response plans, which of the following is MOST important foran organization to understand when establishing the breach notification period?

A. Organizational policies 
B. Vendor requirements and contracts 
C. Service-level agreements 
D. Legal requirements 

Show Answer

Question # 6

Which of the following policies would state an employee should not disable securitysafeguards, such as host firewalls and antivirus on company systems?

A. Code of conduct policy 
B. Account management policy 
C. Password policy 
D. Acceptable use policy 

Show Answer

Question # 7

An analyst is investigating an anomalous event reported by the SOC. After reviewing thesystem logs the analyst identifies an unexpected addition of a user with root-level privilegeson the endpoint. Which of the following data sources will BEST help the analyst todetermine whether this event constitutes an incident?

A. Patching logs 
B. Threat feed 
C. Backup logs 
D. Change requests 
E. Data classification matrix 

Show Answer

Question # 8

A cybersecurity analyst is dissecting an intrusion down to the specific techniques andwants to organize them in a logical manner. Which of the following frameworks wouldBEST apply in this situation?

A. Pyramid of Pain 
B. MITRE ATT&CK 
C. Diamond Model of Intrusion Analysts 
D. CVSS v3.0 

Show Answer

Question # 9

A security analyst is investigating an incident that appears to have started with SOLinjection against a publicly available web application. Which of the following is the FIRSTstep the analyst should take to prevent future attacks?

A. Modify the IDS rules to have a signature for SQL injection. 
B. Take the server offline to prevent continued SQL injection attacks. 
C. Create a WAF rule In block mode for SQL injection 
D. Ask the developers to implement parameterized SQL queries. 

Show Answer

Question # 10

An organization's network administrator uncovered a rogue device on the network that isemulating the charactenstics of a switch. The device is trunking protocols and insertingtagging vathe flow of traffic at the data link layerWhich of the following BEST describes this attack?

A. VLAN hopping 
B. Injection attack 
C. Spoofing 
D. DNS pharming 

Show Answer