[Apr 25, 2024] New CompTIA CS0-002 Dumps with Test Engine and PDF (New Questions)
Pass Your CS0-002 Exam Easily - Real CS0-002 Practice Dump Updated
NEW QUESTION # 183
A company has contracted with a software development vendor to design a web portal for customers to access a medical records database. Which of the following should the security analyst recommend to BEST control the unauthorized disclosure of sensitive data when sharing the development database with the vendor?
- A. Enable data masking of sensitive data tables in the database.
- B. Use a de-identified data process for the development database.
- C. Establish an NDA with the vendor.
- D. Set all database tables to read only.
Answer: B
Explanation:
Explanation
https://privacy-analytics.com/resources/videos/what-is-the-difference-between-data-masking-de-identification-an
NEW QUESTION # 184
An organization's internal department frequently uses a cloud provider to store large amounts of sensitive dat a. A threat actor has deployed a virtual machine to at the use of the cloud hosted hypervisor, the threat actor has escalated the access rights. Which of the following actions would be BEST to remediate the vulnerability?
- A. Update lo the secure hypervisor version.
- B. Implement dedicated hardware for each customer.
- C. Implement an MFA solution.
- D. Sandbox the virtual machine.
Answer: A
NEW QUESTION # 185
A cybersecurity analyst is currently using Nessus to scan several FTP servers. Upon receiving the results of the scan, the analyst needs to further test to verify that the vulnerability found exists.
The analyst uses the following snippet of code:
Which of the following vulnerabilities is the analyst checking for?
- A. Format string attack
- B. SQL injection
- C. Default passwords
- D. Buffer overflow
Answer: B
NEW QUESTION # 186
It is important to parameterize queries to prevent .
- A. the establishment of a web shell that would allow unauthorized access.
- B. a memory overflow that executes code with elevated privileges.
- C. the queries from using an outdated library with security vulnerabilities.
- D. the execution of unauthorized actions against a database.
Answer: D
Explanation:
Reference:
https://stackoverflow.com/QUESTION NO:s/4712037/what-is-parameterized-query
NEW QUESTION # 187
During a recent audit, there were a lot of findings similar to and including the following:
Which of the following would be the BEST way to remediate these findings and minimize similar findings in the future?
- A. Run Microsoft Baseline Security Analyzer on all of the servers.
- B. Schedule regular vulnerability scans for all servers on the network.
- C. Use an automated patch management solution.
- D. Remove the affected software programs from the servers.
Answer: C
NEW QUESTION # 188
An organization has a policy that requires dedicated user accounts to run programs that need elevated privileges. Users must be part of a group that allows elevated permissions. While reviewing security logs, an analyst sees the following:
Which of the following hosts violates the organizational policies?
- A. lincoln
- B. gremlin
- C. pacer
- D. ford
Answer: A
Explanation:
The host "lincoln" violates the organizational policies that require dedicated user accounts to run programs that need elevated privileges. The log file shows that the user "ldavis" tried to run programs such as "su root", "sudo apache.bin", and "sudo grep" on the host "lincoln", which indicate attempts to gain elevated privileges or access sensitive files. The other hosts do not show any evidence of policy violation.
NEW QUESTION # 189
A new prototype for a company's flagship product was leaked on the internet As a result, the management team has locked out all USB drives Optical drive writers are not present on company computers The sales team has been granted an exception to share sales presentation files with third parties Which of the following would allow the IT team to determine which devices are USB enabled?
- A. Data loss prevention
- B. Asset tagging
- C. Device encryption
- D. SIEMIogs
Answer: D
Explanation:
A security information and event management (SIEM) system is a tool that collects and analyzes log data from various sources and provides alerts and reports on security incidents and events. A SIEM system can help the IT team to determine which devices are USB enabled by querying the log data for events related to USB device insertion, removal, or usage. The other options are not relevant or effective for this purpose. Reference: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 15; https://www.sans.org/reading-room/whitepapers/analyst/security-information-event-management-siem-implementation-33969
NEW QUESTION # 190
Hotspot Question
A security analyst suspects that a workstation may be beaconing to a command and control server.
You must inspect the logs from the company's web proxy server and the firewall to determine the best course of action to take in order to neutralize the threat with minimum impact to the organization.
Instructions:
If at any time you would like to bring back the initial state of the simulation, please select the Reset button.
When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
Answer:
Explanation:
NEW QUESTION # 191
Which of the following is a switch attack?
- A. CSRF
- B. Inference
- C. MAC overflow
- D. XSS
Answer: C
NEW QUESTION # 192
A network technician is concerned that an attacker is attempting to penetrate the network, and wants to set a rule on the firewall to prevent the attacker from learning which IP addresses are valid on the network. Which of the following protocols needs to be denied?
- A. SMTP
- B. ARP
- C. ICMP
- D. TCP
Answer: C
NEW QUESTION # 193
A security analyst receives an alert that highly sensitive information has left the company's network Upon investigation, the analyst discovers an outside IP range has had connections from three servers more than 100 times m the past month The affected servers are virtual machines Which of the following is the BEST course of action?
- A. Disconnect the affected servers from the network, use the virtual machine console to access the systems, determine which information has left the network, find the security weakness, and remediate
- B. Shut down the servers as soon as possible, move them to a clean environment, restart, run a vulnerability scanner to find weaknesses determine the root cause, remediate, and report
- C. Determine if any other servers have been affected, snapshot any servers found, determine the vector that was used to allow the data exfiltration. fix any vulnerabilities, remediate, and report.
- D. Report the data exfiltration to management take the affected servers offline, conduct an antivirus scan, remediate all threats found, and return the servers to service.
Answer: B
NEW QUESTION # 194
A security analyst received an alert from the antivirus software identifying a complex instance of malware on a company's network. The company does not have the resources to fully analyze the malware and determine its effect on the system. Which of the following is the BEST action to take in the incident recovery and post-incident response process?
- A. Wipe hard drives, reimage the systems, and return the affected systems to ready state.
- B. Detect and analyze the precursors and indicators; schedule a lessons learned meeting.
- C. Perform event correlation; create a log retention policy.
- D. Remove the malware and inappropriate materials; eradicate the incident.
Answer: D
NEW QUESTION # 195
A systems administrator believes a user's workstation has been compromised. The workstation's performance has been lagging significantly for the past several hours. The administrator runs the task list
/ v command and receives the following output:
Which of the following should a security analyst recognize as an indicator of compromise?
- A. dwm.exe being executed under the user context
- B. The abnormal behavior of paint.exe
- C. The high usage of vscode. exe * 32
- D. svchost.exe being executed as SYSTEM
Answer: C
Explanation:
The tasklist command is used to display a list of all running processes on a system. In this output, the security analyst should recognize the high memory usage (1302103K) of vscode.exe * 32, which is an indication that this process is consuming a large amount of system resources. This could be a sign that the system has been compromised, as malware often uses system resources to perform malicious activities.
NEW QUESTION # 196
A security analyst needs to provide the development learn with secure connectivity from the corporate network to a three-tier cloud environment. The developers require access to servers in all three tiers in order to perform various configuration tasks. Which of the following technologies should the analyst implement to provide secure transport?
- A. CASB
- B. Federation
- C. VPN
- D. VPC
Answer: C
NEW QUESTION # 197
To prioritize the morning's work, an analyst is reviewing security alerts that have not yet been investigated.
Which of the following assets should be investigated FIRST?
- A. A new test web server that is in the process of initial installation
- B. An accounting supervisor's laptop that is connected to the VPN
- C. The workstation of a developer who is installing software on a web server
- D. The laptop of the vice president that is on the corporate LAN
Answer: D
NEW QUESTION # 198
Clients are unable to access a company's API to obtain pricing dat
a. An analyst discovers sources other than
clients are scraping the API for data, which is causing the servers to exceed available resources. Which of the
following would be BEST to protect the availability of the APIs?
- A. Virtual private network
- B. Web application firewall
- C. IP whitelisting
- D. Certificate-based authentication
Answer: C
NEW QUESTION # 199
......
CompTIA Cybersecurity Analyst (CySA+) Certification Exam, also known as CS0-002, is a vendor-neutral certification that validates the skills and knowledge required for a cybersecurity analyst role. CompTIA Cybersecurity Analyst (CySA+) Certification Exam certification is designed for IT professionals who are responsible for identifying, preventing, and responding to security incidents. CompTIA Cybersecurity Analyst (CySA+) Certification Exam certification exam covers a wide range of skills, including threat and vulnerability management, incident response, security operations and monitoring, and security policies and procedures.
ITExamDownload just published the CompTIA CS0-002 exam dumps!: https://www.itexamdownload.com/CS0-002-valid-questions.html
For your comfort, ITExamDownload provides you the convenience of free CompTIA CySA+ braindumps demo: https://drive.google.com/open?id=1Z3gz_foF3j8V_g8_1CabhIeFW_VIdYw0