CS0-002 CompTIA CySA+ Exam Updated Questions and Answers

1. A company was recently awarded several large government contracts and wants to determine its current risk from one specific APT.

Which of the following threat modeling methodologies would be the MOST appropriate to use during this analysis?

2. An analyst wants to identify hosts that are connecting to the external FTP servers and what, if any, passwords are being used.

Which of the following commands should the analyst use?

3. During a cyber incident, which of the following is the BEST course of action?

4. A security analyst is reviewing packet captures from a system that was compromised. The system was already isolated from the network, but it did have network access for a few hours after being compromised.

When viewing the capture in a packet analyzer, the analyst sees the following:





Which of the following can the analyst conclude?

5. A security analyst is reviewing a suspected phishing campaign that has targeted an organisation. The organization has enabled a few email security technologies in the last year: however, the analyst believes the security features are not working.

The analyst runs the following command:

> dig domain._domainkey.comptia.orq TXT

Which of the following email protection technologies is the analyst MOST likely validating?

6. An analyst is investigating an anomalous event reported by the SOC. After reviewing the system logs the analyst identifies an unexpected addition of a user with root-level privileges on the endpoint.

Which of the following data sources will BEST help the analyst to determine whether this event constitutes an incident?

7. Which of the following BEST articulates the benefit of leveraging SCAP in an organization’s cybersecurity analysis toolset?

8. While analyzing network traffic, a security analyst discovers several computers on the network are connecting to a malicious domain that was blocked by a DNS sinkhole. A new private IP range is now visible, but no change requests were made to add it.

Which of the following is the BEST solution for the security analyst to implement?

9. An analyst is performing penetration testing and vulnerability assessment activities against a new vehicle automation platform.

Which of the following is MOST likely an attack vector that is being utilized as part of the testing and assessment?

10. An analyst is searching a log for potential credit card leaks. The log stores all data encoded in hexadecimal.

Which of the following commands will allow the security analyst to confirm the incident?

11. Which of the following sets of attributes BEST illustrates the characteristics of an insider threat from a security perspective?

12. A security analyst is evaluating two vulnerability management tools for possible use in an organization. The analyst set up each of the tools according to the respective vendor's instructions and generated a report of vulnerabilities that ran against the same target server.

Tool A reported the following:





Tool B reported the following:





Which of the following BEST describes the method used by each tool? (Choose two.)

13. An organization's network administrator uncovered a rogue device on the network that is emulating the charactenstics of a switch. The device is trunking protocols and inserting tagging va the flow of traffic at the data link layer

Which of the following BEST describes this attack?

14. An analyst is reviewing the following code output of a vulnerability scan:

if (search name ! = null )

{

%>

employee <%search names%> not found

}

Which of the following types of vulnerabilities does this MOST likely represent?

15. A development team uses open-source software and follows an Agile methodology with two-week sprints. Last month, the security team filed a bug for an insecure version of a common library. The DevOps team updated the library on the server, and then the security team rescanned the server to verify it was no longer vulnerable. This month, the security team found the same vulnerability on the server.

Which of the following should be done to correct the cause of the vulnerability?

16. While reviewing a cyber-risk assessment, an analyst notes there are concerns related to FPGA usage.

Which of the following statements would BEST convince the analyst's supervisor to use additional controls?

17. A user reports a malware alert to the help desk A technician verifies the alert, determines the workstation is classified as a low-severity device, and uses network controls to block access. The technician then assigns the ticket to a security analyst who will complete the eradication and recovery processes.

Which of the following should the security analyst do NEXT?

18. A security analyst is attempting to utilize the blowing threat intelligence for developing detection capabilities:





In which of the following phases is this APT MOST likely to leave discoverable artifacts?

19. Which of the following MOST accurately describes an HSM?

20. An organization developed a comprehensive modern response policy Executive management approved the policy and its associated procedures.

Which of the following activities would be MOST beneficial to evaluate personnel's familiarity with incident response procedures?

21. A company recently experienced multiple DNS DDoS attacks, and the information security analyst must provide a DDoS solution to deploy in the company's datacenter.

Which of the following would BEST prevent future attacks?

22. A security analyst suspects a malware infection was caused by a user who downloaded malware after clicking http://<malwaresource>/A.php in a phishing email.

To prevent other computers from being infected by the same malware variation, the analyst should create a rule on the.

23. Which of the following BEST describes the process by which code is developed, tested, and deployed in small batches?

24. While analyzing logs from a WAF, a cybersecurity analyst finds the following:





Which of the following BEST describes what the analyst has found?

25. A security analyst is supporting an embedded software team.

Which of the following is the BEST recommendation to ensure proper error handling at runtime?

26. A security analyst needs to develop a brief that will include the latest incidents and the attack phases of the incidents. The goal is to support threat intelligence and identify whether or not the incidents are linked.

Which of the following methods would be MOST appropriate to use?

27. A security analyst is building a malware analysis lab. The analyst wants to ensure malicious applications are not capable of escaping the virtual machines and pivoting to other networks.

To BEST mitigate this risk, the analyst should use.

28. A security analyst needs to reduce the overall attack surface.

Which of the following infrastructure changes should the analyst recommend?

29. A large insurance company wants to outsource its claim-handling operations to an overseas third-party organization.

Which of the following would BEST help to reduce the chance of highly sensitive data leaking?

30. A security analyst is conducting a post-incident log analysis to determine which indicators can be used to detect further occurrences of a data exfiltration incident.

The analyst determines backups were not performed during this time and reviews the following:





Which of the following should the analyst review to find out how the data was exfilltrated?

31. A security analyst is investigating malicious traffic from an internal system that attempted to download proxy avoidance software as identified from the firewall logs but the destination IP is blocked and not captured.

Which of the following should the analyst do?

32. An organization was alerted to a possible compromise after its proprietary data was found for sale on the Internet. An analyst is reviewing the logs from the next-generation UTM in an attempt to find evidence of this breach.

Given the following output:





Which of the following should be the focus of the investigation?

33. A security analyst recently discovered two unauthorized hosts on the campus's wireless network segment from a man-m-the-middle attack. The security analyst also verified that privileges were not escalated, and the two devices did not gain access to other network devices.

Which of the following would BEST mitigate and improve the security posture of the wireless network for this type of attack?

34. After receiving reports latency, a security analyst performs an Nmap scan and observes the following output:





Which of the following suggests the system that produced output was compromised?

35. A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verity that a user's data is not altered without the user's consent.

Which of the following would be an appropriate course of action?

36. HOTSPOT

Welcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the desk ticket queue.



INSTRUCTIONS

Click on me ticket to see the ticket details Additional content is available on tabs within the ticket

First, select the appropriate issue from the drop-down menu. Then, select the MOST likely root cause from second drop-down menu

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button

37. Which of the following would a security engineer recommend to BEST protect sensitive system data from being accessed on mobile devices?

38. While preparing of an audit of information security controls in the environment an analyst outlines a framework control that has the following requirements:

• All sensitive data must be classified

• All sensitive data must be purged on a quarterly basis

• Certificates of disposal must remain on file for at least three years

This framework control is MOST likely classified as:

39. A system administrator is doing network reconnaissance of a company’s external network to determine the vulnerability of various services that are running.

Sending some sample traffic to the external host, the administrator obtains the following packet capture:





Based on the output, which of the following services should be further tested for vulnerabilities?

40. A newly appointed Chief Information Security Officer (CISO) has completed a risk assessment review of the organization and wants to reduce the numerous risks that were identified.

Which of the following will provide a trend of risk mitigation?

41. Which of the following would MOST likely be included in the incident response procedure after a security breach of customer PII?

42. A development team signed a contract that requires access to an on-premises physical server. Access must be restricted to authorized users only and cannot be connected to the Internet.

Which of the following solutions would meet this requirement?

43. What is the executable file name or the malware?

44. When attempting to do a stealth scan against a system that does not respond to ping, which of the following Nmap commands BEST accomplishes that goal?

45. A security analyst is auditing firewall rules with the goal of scanning some known ports to check the firewall’s behavior and responses. The analyst executes the following commands.

Which of the following BEST describes the firewall rule?

46. A security analyst is investigating a system compromise. The analyst verities the system was up to date on OS patches at the time of the compromise.

Which of the following describes the type of vulnerability that was MOST likely expiated?

47. During an investigation, an incident responder intends to recover multiple pieces of digital mediA. Before removing the media, the responder should initiate:

48. A Chief Information Security Officer (CISO) is concerned developers have too much visibility into customer data.

Which of the following controls should be implemented to BEST address these concerns?

49. Ransomware is identified on a company's network that affects both Windows and MAC hosts. The command and control channel for encryption for this variant uses TCP ports from 11000 to 65000. The channel goes to good1. Iholdbadkeys.com, which resolves to IP address 72.172.16.2.

Which of the following is the MOST effective way to prevent any newly infected systems from actually encrypting the data on connected network drives while causing the least disruption to normal Internet traffic?

50. Which of the following assessment methods should be used to analyze how specialized software performs during heavy loads?

51. A security analyst gathered forensics from a recent intrusion in preparation for legal proceedings. The analyst used EnCase to gather the digital forensics. cloned the hard drive, and took the hard drive home for further analysis.

Which of the following of the security analyst violate?

52. A security analyst has discovered trial developers have installed browsers on all development servers in the company's cloud infrastructure and are using them to browse the Internet.

Which of the following changes should the security analyst make to BEST protect the environment?

53. An information security analyst on a threat-hunting team Is working with administrators to create a hypothesis related to an internally developed web application.

The working hypothesis is as follows:

• Due to the nature of the industry, the application hosts sensitive data associated with many clients and Is a significant target

• The platform Is most likely vulnerable to poor patching and Inadequate server hardening, which expose vulnerable services.

• The application is likely to be targeted with SQL injection attacks due to the large number of reporting capabilities within the application.

As a result, the systems administrator upgrades outdated service applications and validates the endpoint configuration against an industry benchmark. The analyst suggests developers receive additional training on implementing identity and access management, and also implements a WAF to protect against SOL injection attacks.

Which of the following BEST represents the technique in use?

54. A security analyst discovered a specific series of IP addresses that are targeting an organization. None of the attacks have been successful.

Which of the following should the security analyst perform NEXT?

55. Which of the following technologies can be used to house the entropy keys for task encryption on desktops and laptops?

56. An analyst is reviewing the following output:





Which of the following was MOST likely used to discover this?

57. The Cruel Executive Officer (CEO) of a large insurance company has reported phishing emails that contain malicious links are targeting the entire organza lion.

Which of the following actions would work BEST to prevent against this type of attack?

58. After a breach involving the exfiltration of a large amount of sensitive data a security analyst is reviewing the following firewall logs to determine how the breach occurred:





Which of the following IP addresses does the analyst need to investigate further?

59. A forensic analyst took an image of a workstation that was involved in an incident To BEST ensure the image is not tampered with me analyst should use:

60. A user's computer has been running slowly when the user tries to access web pages.

A security analyst runs the command netstat -aon from the command line and receives the following output:





Which of the following lines indicates the computer may be compromised?

61. Portions of a legacy application are being refactored to discontinue the use of dynamic SQL.

Which of the following would be BEST to implement in the legacy application?

62. A security analyst is investigating a malware infection that occurred on a Windows system. The system was not connected to a network and had no wireless capability Company policy prohibits using portable media or mobile storage. The security analyst is trying to determine which user caused the malware to get onto the system.

Which of the following registry keys would MOST likely have this information?

63. A security analyst is trying to determine if a host is active on a network.

The analyst first attempts the following:





The analyst runs the following command next:





Which of the following would explain the difference in results?

64. A company creates digitally signed packages for its devices.

Which of the following BEST describes the method by which the security packages are delivered to the company's customers?

65. A system is experiencing noticeably slow response times, and users are being locked out frequently. An analyst asked for the system security plan and found the system comprises two servers: an application server in the DMZ and a database server inside the trusted domain.

Which of the following should be performed NEXT to investigate the availability issue?

66. An application server runs slowly and then triggers a high CPU alert. After investigating, a security analyst finds an unauthorized program is running on the server.

The analyst reviews the application log below.





Which of the following conclusions is supported by the application log?

67. While planning segmentation for an ICS environment, a security engineer determines IT resources will need access to devices within the ICS environment without compromising security.

To provide the MOST secure access model in this scenario, the jumpbox should be.

68. A cybersecurity analyst is establishing a threat hunting and intelligence group at a growing organization.

Which of the following is a collaborative resource that would MOST likely be used for this purpose?

69. A security analyst is providing a risk assessment for a medical device that will be installed on the corporate network. During the assessment, the analyst discovers the device has an embedded operating system that will be at the end of its life in two years. Due to the criticality of the device, the security committee makes a risk- based policy decision to review and enforce the vendor upgrade before the end of life is reached.

Which of the following risk actions has the security committee taken?

70. While conducting a network infrastructure review, a security analyst discovers a laptop that is plugged into a core switch and hidden behind a desk.

The analyst sees the following on the laptop's screen:





Which of the following is the BEST action for the security analyst to take?

71. An organization is experiencing issues with emails that are being sent to external recipients Incoming emails to the organization are working fine. A security analyst receives the following screenshot of email error from the help desk.





The analyst the checks the email server and sees many of the following messages in the logs.

Error 550 - Message rejected

Which of the following is MOST likely the issue?

72. During an investigation, an analyst discovers the following rule in an executive’s email client:

IF * TO <[email protected]> THEN mailto: <[email protected]>

SELECT FROM ‘sent’ THEN DELETE FROM <[email protected]>

The executive is not aware of this rule.

Which of the following should the analyst do FIRST to evaluate the potential impact of this security incident?

73. Which of the following policies would state an employee should not disable security safeguards, such as host firewalls and antivirus on company systems?

74. A remote code execution vulnerability was discovered in the RDP. An organization currently uses RDP for remote access to a portion of its VDI environment. The analyst verified network-level authentication is enabled

Which of the following is the BEST remediation for this vulnerability?

75. Which of the following software security best practices would prevent an attacker from being able to run arbitrary SQL commands within a web application? (Choose two.)

76. An organization has not had an incident for several months. The Chief Information Security Officer (CISO) wants to move to a more proactive stance for security investigations.

Which of the following would BEST meet that goal?

77. A security analyst wants to identify which vulnerabilities a potential attacker might initially exploit if the network is compromised.

Which of the following would provide the BEST results?

78. A SIEM solution alerts a security analyst of a high number of login attempts against the company's webmail portal. The analyst determines the login attempts used credentials from a past data breach.

Which of the following is the BEST mitigation to prevent unauthorized access?

79. An employee was found to have performed fraudulent activities. The employee was dismissed, and the employee's laptop was sent to the IT service desk to undergo a data sanitization procedure. However, the security analyst responsible for the investigation wants to avoid data sanitization.

Which of the following can the security analyst use to justify the request?

80. Which of the following is the MOST important objective of a post-incident review?

81. A security analyst was alerted to a tile integrity monitoring event based on a change to the vhost-paymonts .conf file.

The output of the diff command against the known-good backup reads as follows





Which of the following MOST likely occurred?

82. A security analyst needs to identify possible threats to a complex system a client is developing.

Which of the following methodologies would BEST address this task?

83. During a review of vulnerability scan results an analyst determines the results may be flawed because a control-baseline system which is used to evaluate a scanning tools effectiveness was reported as not vulnerable Consequently, the analyst verifies the scope of the scan included the control-baseline host which was available on the network during the scan. The use of a control-baseline endpoint in this scenario assists the analyst in confirming.

84. A cybersecurity analyst is supposing an incident response effort via threat intelligence.

Which of the following is the analyst MOST likely executing?

85. Clients are unable to access a company’s API to obtain pricing data. An analyst discovers sources other than clients are scraping the API for data, which is causing the servers to exceed available resources.

Which of the following would be BEST to protect the availability of the APIs?

86. Following a recent security breach, a company decides to investigate account usage to ensure privileged accounts are only being utilized during typical business hours. During the investigation, a security analyst determines an account was consistently utilized in the middle of the night.

Which of the following actions should the analyst take NEXT?

87. A security analyst receives a CVE bulletin, which lists several products that are used in the enterprise. The analyst immediately deploys a critical security patch.

Which of the following BEST describes the reason for the analyst's immediate action?

88. An information security analyst is reviewing backup data sets as part of a project focused on eliminating archival data sets.

Which of the following should be considered FIRST prior to disposing of the electronic data?

89. A malicious hacker wants to gather guest credentials on a hotel 802.11 network.

Which of the following tools is the malicious hacker going to use to gain access to information found on the hotel network?

90. Bootloader malware was recently discovered on several company workstations. All the workstations run Windows and are current models with UEFI capability.

Which of the following UEFI settings is the MOST likely cause of the infections?

91. An analyst identifies multiple instances of node-to-node communication between several endpoints within the 10.200.2.0/24 network and a user machine at the IP address 10.200.2.5. This user machine at the IP address 10.200.2.5 is also identified as initiating outbound communication during atypical business hours with several IP addresses that have recently appeared on threat feeds.

Which of the following can be inferred from this activity?