CompTIA CySA+ CS0-002 Updated Dumps

1. While planning segmentation for an ICS environment, a security engineer determines IT resources will need access to devices within the ICS environment without compromising security.

To provide the MOST secure access model in this scenario, the jumpbox should be.

2. As part of an organization’s information security governance process, a Chief Information Security Officer (CISO) is working with the compliance officer to update policies to include statements related to new regulatory and legal requirements.

Which of the following should be done to BEST ensure all employees are appropriately aware of changes to the policies?

3. CORRECT TEXT

While investigating an incident in a company's SIEM console, a security analyst found hundreds of failed SSH login attempts, which all occurred in rapid succession. The failed attempts were followed by a successful login on the root user Company policy allows systems administrators to manage their systems only from the company's internal network using their assigned corporate logins.

Which of the following are the BEST actions the analyst can take to stop any further compromise? (Select TWO).

A Configure /etc/sshd_config to deny root logins and restart the SSHD service.

B. Add a rule on the network IPS to block SSH user sessions

C. Configure /etc/passwd to deny root logins and restart the SSHD service.

D. Reset the passwords for all accounts on the affected system.

E. Add a rule on the perimeter firewall to block the source IP address.

F. Add a rule on the affected system to block access to port TCP/22.

4. A developer wrote a script to make names and other Pll data unidentifiable before loading a database export into the testing system.

Which of the following describes the type of control that is being used?

5. To prioritize the morning's work, an analyst is reviewing security alerts that have not yet been investigated.

Which of the following assets should be investigated FIRST?

6. A security analyst is reviewing a web application. If an unauthenticated user tries to access a page in the application, the user is redirected to the login page. After successful authentication, the user is then redirected back to the original page. Some users have reported receiving phishing emails with a link that takes them to the application login page but then redirects to a fake login page after successful authentication.

Which of the following will remediate this software vulnerability?

7. An information security analyst is working with a data owner to identify the appropriate controls to preserve the confidentiality of data within an enterprise environment One of the primary concerns is exfiltration of data by malicious insiders.

Which of the following controls is the MOST appropriate to mitigate risks?

8. The inability to do remote updates of certificates, keys, software, and firmware is a security issue commonly associated with:

9. A company was recently awarded several large government contracts and wants to determine its current risk from one specific APT.

Which of the following threat modeling methodologies would be the MOST appropriate to use during this analysis?

10. Joe, a penetration tester, used a professional directory to identify a network administrator and ID administrator for a client’s company. Joe then emailed the network administrator, identifying himself as the ID administrator, and asked for a current password as part of a security exercise.

Which of the following techniques were used in this scenario?

11. A Chief Information Security Officer (CISO) is concerned the development team, which consists of contractors, has too much access to customer data. Developers use personal workstations, giving the company little to no visibility into the development activities.

Which of the following would be BEST to implement to alleviate the CISO's concern?

12. An analyst is reviewing a list of vulnerabilities, which were reported from a recent vulnerability scan of a Linux server.

Which of the following is MOST likely to be a false positive?

13. A cybersecurity analyst has access to several threat feeds and wants to organize them while simultaneously comparing intelligence against network traffic.

Which of the following would BEST accomplish this goal?

14. An organization's Chief Information Security Officer (CISO) has asked department leaders to coordinate on communication plans that can be enacted in response to different cybersecurity incident triggers.

Which of the following is a benefit of having these communication plans?

15. A security team identified some specific known tactics and techniques to help mitigate repeated credential access threats, such as account manipulation and brute forcing.

Which of the following frameworks or models did the security team MOST likely use to identify the tactics and techniques'?

16. Which of the following software security best practices would prevent an attacker from being able to run arbitrary SQL commands within a web application? (Choose two.)

17. A company's modem response team is handling a threat that was identified on the network Security analysts have as at remote sites.

Which of the following is the MOST appropriate next step in the incident response plan?

18. A security analyst has a sample of malicious software and needs to know what the sample does. The analyst runs the sample in a carefully controlled and monitored virtual machine to observe the software behavior.

Which of the following malware analysis approaches is this?

19. Which of the following technologies can be used to house the entropy keys for task encryption on desktops and laptops?

20. An organization has not had an incident for several month. The Chief information Security Officer (CISO) wants to move to proactive stance for security investigations.

Which of the following would BEST meet that goal?

21. When reviewing a compromised authentication server, a security analyst discovers the following hidden file:





Further analysis shows these users never logged in to the server.

Which of the following types of attacks was used to obtain the file and what should the analyst recommend to prevent this type of attack from reoccurring?

22. An information security analyst discovered a virtual machine server was compromised by an attacker.

Which of the following should be the FIRST step to confirm and respond to the incident?

23. A malicious hacker wants to gather guest credentials on a hotel 802.11 network.

Which of the following tools is the malicious hacker going to use to gain access to information found on the hotel network?

24. An incident response team is responding to a breach of multiple systems that contain PII and PHI.

Disclosing the incident to external entities should be based on:

25. During the forensic analysis of a compromised machine, a security analyst discovers some binaries that are exhibiting abnormal behaviors. After extracting the strings, the analyst finds unexpected content.

Which of the following is the NEXT step the analyst should take?

26. A remote code execution vulnerability was discovered in the RDP. An organization currently uses RDP for remote access to a portion of its VDI environment. The analyst verified network-level authentication is enabled.

Which of the following is the BEST remediation for this vulnerability?

27. Bootloader malware was recently discovered on several company workstations. All the workstations run Windows and are current models with UEFI capability.

Which of the following UEFI settings is the MOST likely cause of the infections?

28. A security team wants to make SaaS solutions accessible from only the corporate campus.

Which of the following would BEST accomplish this goal?

29. An analyst wants to identify hosts that are connecting to the external FTP servers and what, if any, passwords are being used.

Which of the following commands should the analyst use?

30. An organization wants to move non-essential services into a cloud computing environment. Management has a cost focus and would like to achieve a recovery time objective of 12 hours.

Which of the following cloud recovery strategies would work BEST to attain the desired outcome?

31. A security analyst is reviewing vulnerability scan results and notices new workstations are being flagged as having outdated antivirus signatures.

The analyst observes the following plugin output:





The analyst uses the vendor's website to confirm the oldest supported version is correct.

Which of the following BEST describes the situation?

32. An employee in the billing department accidentally sent a spreadsheet containing payment card data to a recipient outside the organization. The employee intended to send the spreadsheet to an internal staff member with a similar name and was unaware of the mistake until the recipient replied to the message.

In addition to retraining the employee, which of the following would prevent this from happening in the future?

33. A user reports a malware alert to the help desk A technician verifies the alert, determines the workstation is classified as a low-severity device, and uses network controls to block access. The technician then assigns the ticket to a security analyst who will complete the eradication and recovery processes.

Which of the following should the security analyst do NEXT?

34. Data spillage occurred when an employee accidentally emailed a sensitive file to an external recipient.

Which of the following controls would have MOST likely prevented this incident?

35. While reviewing a cyber-risk assessment, an analyst notes there are concerns related to FPGA usage.

Which of the following statements would BEST convince the analyst's supervisor to use additional controls?

36. An organization has the following risk mitigation policy:

Risks with a probability of 95% or greater will be addressed before all others regardless of the impact.

All other prioritization will be based on risk value.

The organization has identified the following risks:





Which of the following is the order of priority for risk mitigation from highest to lowest?

37. During an investigation, a security analyst identified machines that are infected with malware the antivirus was unable to detect.

Which of the following is the BEST place to acquire evidence to perform data carving?

38. A security analyst needs to perform a search for connections with a suspicious IP on the network traffic. The company collects full packet captures at the Internet gateway and retains them for one week.

Which of the following will enable the analyst to obtain the BEST results?

39. A hybrid control is one that:

40. An analyst is working with a network engineer to resolve a vulnerability that was found in a piece of legacy hardware, which is critical to the operation of the organization's production line. The legacy hardware does not have third-party support, and the OEM manufacturer of the controller is no longer in operation. The analyst documents the activities and verifies these actions prevent remote exploitation of the vulnerability.

Which of the following would be the MOST appropriate to remediate the controller?

41. During an incident, a cybersecurity analyst found several entries in the web server logs that are related to an IP with a bad reputation.

Which of the following would cause the analyst to further review the incident?

A)





B)





C)





D)





E)

42. During a cyber incident, which of the following is the BEST course of action?

43. Which of the following is the MOST important objective of a post-incident review?

44. An organization has been seeing increased levels of malicious traffic. A security analyst wants to take a more proactive approach to identify the threats that are acting against the organization’s network.

Which of the following approaches should the security analyst recommend?

45. A development team signed a contract that requires access to an on-premises physical server. Access must be restricted to authorized users only and cannot be connected to the Internet.

Which of the following solutions would meet this requirement?

46. As part of a review of incident response plans, which of the following is MOST important for an organization to understand when establishing the breach notification period?

47. A company wants to establish a threat-hunting team.

Which of the following BEST describes the rationale for integration intelligence into hunt operations?

48. A general contractor has a list of contract documents containing critical business data that are stored at a public cloud provider. The organization’s security analyst recently reviewed some of the storage containers and discovered most of the containers are not encrypted.

Which of the following configurations will provide the MOST security to resolve the vulnerability?

49. While analyzing network traffic, a security analyst discovers several computers on the network are connecting to a malicious domain that was blocked by a DNS sinkhole. A new private IP range is now visible, but no change requests were made to add it.

Which of the following is the BEST solution for the security analyst to implement?

50. Which of the following threat classifications would MOST likely use polymorphic code?

51. The help desk noticed a security analyst that emails from a new email server are not being sent out. The new email server was recently added to the existing ones.

The analyst runs the following command on the new server.





Given the output, which of the following should the security analyst check NEXT?

52. An information security analyst observes anomalous behavior on the SCADA devices in a power plant. This behavior results in the industrial generators overheating and destabilizing the power supply.

Which of the following would BEST identify potential indicators of compromise?

53. A user receives a potentially malicious email that contains spelling errors and a PDF document. A security analyst reviews the email and decides to download the attachment to a Linux sandbox for review.

Which of the following commands would MOST likely indicate if the email is malicious?

54. As part of a review of modern response plans, which of the following is MOST important for an organization lo understand when establishing the breach notification period?

55. A security analyst is reviewing the following log from an email security service.





Which of the following BEST describes the reason why the email was blocked?

56. During a review of vulnerability scan results an analyst determines the results may be flawed because a control-baseline system which is used to evaluate a scanning tools effectiveness was reported as not vulnerable Consequently, the analyst verifies the scope of the scan included the control-baseline host which was available on the network during the scan. The use of a control-baseline endpoint in this scenario assists the analyst in confirming.

57. A company just chose a global software company based in Europe to implement a new supply chain management solution.

Which of the following would be the MAIN concern of the company?

58. A security analyst on the threat-hunting team has developed a list of unneeded, benign services that are currently running as part of the standard OS deployment for workstations. The analyst will provide this list to the operations team to create a policy that will automatically disable the services for all workstations in the organization.

Which of the following BEST describes the security analyst's goal?

59. An analyst is reviewing the following output:





Which of the following was MOST likely used to discover this?

60. Ann, a user, reports to the security team that her browser began redirecting her to random sites while using her Windows laptop. Ann further reports that the OS shows the C: drive is out of space despite having plenty of space recently. Ann claims she not downloaded anything.

The security team obtains the laptop and begins to investigate, noting the following:

✑ File access auditing is turned off.

✑ When clearing up disk space to make the laptop functional, files that appear to be cached web pages are immediately created in a temporary directory, filling up the available drive space.

✑ All processes running appear to be legitimate processes for this user and machine.

✑ Network traffic spikes when the space is cleared on the laptop.

✑ No browser is open.

Which of the following initial actions and tools would provide the BEST approach to determining what is happening?

61. Portions of a legacy application are being refactored to discontinue the use of dynamic SQL.

Which of the following would be BEST to implement in the legacy application?

62. Clients are unable to access a company’s API to obtain pricing data. An analyst discovers sources other than clients are scraping the API for data, which is causing the servers to exceed available resources.

Which of the following would be BEST to protect the availability of the APIs?

63. A development team uses open-source software and follows an Agile methodology with two-week sprints. Last month, the security team filed a bug for an insecure version of a common library. The DevOps team updated the library on the server, and then the security team rescanned the server to verify it was no longer vulnerable. This month, the security team found the same vulnerability on the server.

Which of the following should be done to correct the cause of the vulnerability?

64. A company has contracted with a software development vendor to design a web portal for customers to access a medical records database.

Which of the following should the security analyst recommend to BEST control the unauthorized disclosure of sensitive data when sharing the development database with the vendor?

65. A company’s Chief Information Security Officer (CISO) is concerned about the integrity of some highly confidential files. Any changes to these files must be tied back to a specific authorized user’s activity session.

Which of the following is the BEST technique to address the CISO’s concerns?

66. A Chief Executive Officer (CEO) is concerned about the company’s intellectual property being leaked to competitors. The security team performed an extensive review but did not find any indication of an outside breach. The data sets are currently encrypted using the Triple Data Encryption Algorithm.

Which of the following courses of action is appropriate?

67. As part of an exercise set up by the information security officer, the IT staff must move some of the network systems to an off-site facility and redeploy them for testing. All staff members must ensure their respective systems can power back up and match their gold image. If they find any inconsistencies, they must formally document the information.

Which of the following BEST describes this test?

68. A security analyst is reviewing the following web server log:





Which of the following BEST describes the issue?

69. An organization needs to limit its exposure to accidental disclosure when employees send emails that contain personal information to recipients outside the company.

Which of the following technical controls would BEST accomplish this goal?

70. The threat intelligence department recently learned of an advanced persistent threat that is leveraging a new strain of malware, exploiting a system router. The company currently uses the same device mentioned in the threat report.

Which of the following configuration changes would BEST improve the organization’s security posture?

71. Understanding attack vectors and integrating intelligence sources are important components of:

72. During an investigation, an analyst discovers the following rule in an executive’s email client:

IF * TO <[email protected]> THEN mailto: <[email protected]>

SELECT FROM ‘sent’ THEN DELETE FROM <[email protected]>

The executive is not aware of this rule.

Which of the following should the analyst do FIRST to evaluate the potential impact of this security incident?

73. Which of the following types of policies is used to regulate data storage on the network?

74. The steering committee for information security management annually reviews the security incident register for the organization to look for trends and systematic issues. The steering committee wants to rank the risks based on past incidents to improve the security program for next year Below is the incident register for the organization.





Which of the following should the organization consider investing in FIRST due to the potential impact of availability?

75. A security analyst working in the SOC recently discovered Balances m which hosts visited a specific set of domains and IPs and became infected with malware.

Which of the following is the MOST appropriate action to take in the situation?

76. A security team is implementing a new vulnerability management program in an environment that has a historically poor security posture. The team is aware of issues patch management in the environment and expects a large number of findings.

Which of the following would be the MOST efficient way to increase the security posture of the organization in the shortest amount of time?

77. Risk management wants IT to implement a solution that will permit an analyst to intercept,

execute, and analyze potentially malicious files that are downloaded from the Internet.

Which of the following would BEST provide this solution?

78. A cybersecurity analyst is contributing to a team hunt on an organization's endpoints.

Which of the following should the analyst do FIRST?

79. A team of security analysis has been alerted to potential malware activity. The initial examination indicates one of the affected workstations on beaconing on TCP port 80 to five IP addresses and attempting to spread across the network over port 445.

Which of the following should be the team's NEXT step during the detection phase of this response process?

80. A company's marketing emails are either being found in a spam folder or not being delivered at all. The security analyst investigates the issue and discovers the emails in question are being sent on behalf of the company by a third party in1marketingpartners.com

Below is the exiting SPP word:





Which of the following updates to the SPF record will work BEST to prevent the emails from being marked as spam or blocked?

A)





B)





C)





D)

81. A host is spamming the network unintentionally.

Which of the following control types should be used to address this situation?

82. A security analyst scanned an internal company subnet and discovered a host with the following Nmap output.





Based on the output of this Nmap scan, which of the following should the analyst investigate FIRST?

83. A security analyst is reviewing the following requirements (or new time clocks that will be installed in a shipping warehouse:

• The clocks must be configured so they do not respond to ARP broadcasts.

• The server must be configured with static ARP entries for each clock.

Which of the following types of attacks will this configuration mitigate?

84. A security analyst is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS.

Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise'?

85. A bad actor bypasses authentication and reveals all records in a database through an SQL injection. Implementation of which of the following would work BEST to prevent similar attacks in

86. Which of the following BEST articulates the benefit of leveraging SCAP in an organization’s cybersecurity analysis toolset?

87. HOTSPOT

Welcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the desk ticket queue.



INSTRUCTIONS

Click on me ticket to see the ticket details Additional content is available on tabs within the ticket

First, select the appropriate issue from the drop-down menu. Then, select the MOST likely root cause from second drop-down menu

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button

88. An organization that handles sensitive financial information wants to perform tokenization of data to enable the execution of recurring transactions. The organization is most interested m a secure, built-in device to support its solution.

Which of the following would MOST likely be required to perform the desired function?

89. An organization supports a large number of remote users.

Which of the following is the BEST option to protect the data on the remote users1 laptops?

90. A security analyst is conducting a post-incident log analysis to determine which indicators can be used to detect further occurrences of a data exfiltration incident.

The analyst determines backups were not performed during this time and reviews the following:





Which of the following should the analyst review to find out how the data was exfilltrated?

91. A development team is testing a new application release. The team needs to import existing client PHI data records from the production environment to the test environment to test accuracy and functionality.

Which of the following would BEST protect the sensitivity of this data while still allowing the team to perform the testing?

92. A security analyst has discovered malware is spreading across multiple critical systems and is originating from a single workstations, which belongs to a member of the cyber-infrastructure team who has legitimate administrator credentials. An analysis of the traffic indicates the workstation swept the networking looking for vulnerable hosts to infect.

Which of the following would have worked BEST to prevent the spread of this infection?

93. A malicious artifact was collected during an incident response procedure. A security analyst is unable to run it in a sandbox to understand its features and method of operation.

Which of the following procedures is the BEST approach to perform a further analysis of the malware's capabilities?

94. A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verity that a user's data is not altered without the user's consent.

Which of the following would be an appropriate course of action?

95. Which of the following BEST describes the process by which code is developed, tested, and deployed in small batches?

96. A company’s change management team has asked a security analyst to review a potential change to the email server before it is released into production.

The analyst reviews the following change request:





Which of the following is the MOST likely reason for the change?

97. A monthly job to install approved vendor software updates and hot fixes recently stopped working. The security team performed a vulnerability scan, which identified several hosts as having some critical OS vulnerabilities, as referenced in the common vulnerabilities and exposures (CVE) database.

Which of the following should the security team do NEXT to resolve the critical findings in the most effective manner? (Choose two.)

98. A cybersecurity analyst needs to rearchitect the network using a firewall and a VPN server to achieve the highest level of security.

To BEST complete this task, the analyst should place the:

99. The Cruel Executive Officer (CEO) of a large insurance company has reported phishing emails that contain malicious links are targeting the entire organza lion.

Which of the following actions would work BEST to prevent against this type of attack?