CS0-002 Updated Questions for CompTIA CySA+ Certification

1. An analyst receives an alert from the continuous-monitoring solution about unauthorized changes to the firmware versions on several field devices. The asset owners confirm that no firmware version updates were performed by authorized technicians, and customers have not reported any performance issues or outages.

Which Of the following actions would be BEST for the analyst to recommend to the asset owners to secure the devices from further exploitation?

2. As part of the senior leadership team's ongoing nsk management activities the Chief Information Security Officer has tasked a security analyst with coordinating the right training and testing methodology to respond to new business initiatives or significant changes to existing ones The management team wants to examine a new business process that would use existing infrastructure to process and store sensitive data .

Which of the following would be appropnate for the security analyst to coordinate?

3. Which of the following is an advantage of SOAR over SIEM?

4. A financial organization has offices located globally. Per the organization’s policies and procedures, all executives who conduct Business overseas must have their mobile devices checked for malicious software or evidence of tempering upon their return. The information security department oversees the process, and no executive has had a device compromised. The Chief information Security Officer wants to Implement an additional safeguard to protect the organization's data.

Which of the following controls would work BEST to protect the privacy of the data if a device is stolen?

5. Which of the following are considered PII by themselves? (Select TWO).

6. CORRECT TEXT

You are a penetration tester who is reviewing the system hardening guidelines for a company. Hardening guidelines indicate the following.

✑ There must be one primary server or service per device.

✑ Only default port should be used

✑ Non- secure protocols should be disabled.

✑ The corporate internet presence should be placed in a protected subnet Instructions:

✑ Using the available tools, discover devices on the corporate network and the services running on these devices.

You must determine

✑ ip address of each device

✑ The primary server or service each device

✑ The protocols that should be disabled based on the hardening guidelines

7. A help desk technician inadvertently sent the credentials of the company's CRM n clear text to an employee's personal email account. The technician then reset the employee's account using the appropriate process and the employee's corporate email, and notified the security team of the incident

According to the incident response procedure, which of the following should the security team do NEXT?

8. Which of the following is the BEST way to gather patch information on a specific server?

9. A threat hurting team received a new loC from an ISAC that follows a threat actor's profile and activities.

Which of the following should be updated NEXT?

10. Which of the following are the MOST likely reasons lo include reporting processes when updating an incident response plan after a breach? (Select TWO).

11. While implementing a PKI for a company, a security analyst plans to utilize a dedicated server as the certAcate authority that is only used to sign intermediate certificates.

Which of the following are the MOST secure states for the certificate authority server when it is not in use? (Select TWO)

12. A company is aiming to test a new incident response plan. The management team has made it clear that the initial test should have no impact on the environment. The company has limited

resources to support testing.

Which of the following exercises would be the best approach?

13. A user reports a malware alert to the help desk. A technician verities the alert, determines the workstation is classified as a low-severity device, and uses network controls to block access. The technician then assigns the ticket to a security analyst who will complete the eradication and recovery processes.

Which of the following should the security analyst do next?

14. A forensic analyst is conducting an investigation on a compromised server .

Which of the following should the analyst do first to preserve evidence''

15. An organization has a strict policy that if elevated permissions are needed, users should always run commands under their own account, with temporary administrator privileges if necessary.

A security analyst is reviewing syslog entries and sees the following:





Which of the following entries should cause the analyst the MOST concern?

16. A security analyst is attempting to resolve an incident in which highly confidential company pricing information was sent to clients. It appears this information was unintentionally sent by an employee who attached it to public marketing material.

Which of the following configuration changes would work BEST to limit the risk of this incident being repeated?

17. After examining a header and footer file, a security analyst begins reconstructing files by scanning the raw data bytes of a hard disk and rebuilding them.

Which of the following techniques is the analyst using?

18. An analyst is responding 10 an incident involving an attack on a company-owned mobile device that was being used by an employee to collect data from clients in the held. Maiware was loaded on the device via the installation of a third-party software package The analyst has baselined the device .

Which of the following should the analyst do to BEST mitigate future attacks?

19. An organization wants to consolidate a number of security technologies throughout the organization and standardize a workflow for identifying security issues prioritizing the severity and automating a response .

Which of the following would best meet the organization's needs'?

20. The Chief Information Security Officer (CISO) of a large financial institution is seeking a solution that will block a predetermined set of data points from being transferred or downloaded by employees. The CISO also wants to track the data assets by name, type, content, or data profile.

Which of the following BEST describes what the CIS wants to purchase?

21. A security analyst was transferred to an organization's threat-hunting team to track specific activity throughout the enterprise environment The analyst must observe and assess the number ot times this activity occurs and aggregate the results.

Which of the following is the BEST threat-hunting method for the analyst to use?

22. After a remote command execution incident occurred on a web server, a security analyst found the following piece of code in an XML file:





Which of the following it the BEST solution to mitigate this type of attack?

23. While observing several host machines, a security analyst notices a program is overwriting data to a buffer.

Which of the following controls will best mitigate this issue?

24. A computer hardware manufacturer developing a new SoC that will be used by mobile devices. The SoC should not allow users or the process to downgrade from a newer firmware to an older one.

Which of the following can the hardware manufacturer implement to prevent firmware downgrades?

25. An organization has the following policies:

* Services must run on standard ports.

* Unneeded services must be disabled.

The organization has the following servers:

* 192.168.10.1 - web server

* 192.168.10.2 - database server

A security analyst runs a scan on the servers and sees the following output:





Which of the following actions should the analyst take?

26. The following output is from a tcpdump al the edge of the corporate network:





Which of the following best describes the potential security concern?

27. Which of the following BEST describes what an organizations incident response plan should cover regarding how the organization handles public or private disclosures of an incident?

28. A cybersecunty analyst needs to harden a server that is currently being used as a web server. The server needs to be accessible when entenng www company com into the browser Additionally web pages require frequent updates which are performed by a remote contractor.

Given the following output:





Which of the following should the cybersecunty analyst recommend to harden the server? (Select TWO).

29. A security analyst is investigate an no client related to an alert from the threat detection platform on a host (10.0 1.25) in a staging environment that could be running a crypto mining tool because it in sending traffic to an IP address that are related to Bitcoin.

The network rules for the instance are the following:





Which of the following is the BEST way to isolate and triage the host?

30. A security analyst is reviewing the output of tcpdump to analyze the type of activity on a packet capture:





Which of the following generated the above output?

31. A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verify that a user's data is not altered without the user's consent.

Which of the following would be an appropriate course of action?

32. A security analyst identified some potentially malicious processes after capturing the contents of memory from a machine during incident response.

Which of the following procedures is the NEXT step for further in investigation?

33. A company experienced a security compromise due to the inappropriate disposal of one of its hardware appliances. Sensitive information stored on the hardware appliance was not removed prior to disposal.

Which of the following is the BEST manner in which to dispose of the hardware appliance?

34. A security technician configured a NIDS to monitor network traffic.

Which of the following is a condition in which harmless traffic is classified as a potential network attack?

35. When investigating a report of a system compromise, a security analyst views the following /var/log/secure log file:





Which of the following can the analyst conclude from viewing the log file?

36. Members of the sales team are using email to send sensitive client lists with contact information to their personal accounts. The company's AUP and code of conduct prohibits this practice.

Which of the following configuration changes would improve security and help prevent this from occurring?

37. An analyst received an alert regarding an application spawning a suspicious command shell process.

Upon further investigation, the analyst observes the following registry change occurring immediately after the suspicious event:





Which of the following was the suspicious event able to accomplish?

38. A security analyst at exampte.com receives a SIEM alert for an IDS signature and reviews the associated packet capture and TCP stream:









Winch of the following actions should the security analyst lake NEXT?

39. A company wants to configure the environment to allow passive network monitonng.

To avoid disrupting the sensitive network, which of the following must be supported by the scanner's NIC to assist with the company's request?

40. Wncn of the following provides an automated approach 10 checking a system configuration?

41. A technician working at company.com received the following email:





After looking at the above communication, which of the following should the technician recommend to the security team to prevent exposure of sensitive information and reduce the risk of corporate data being stored on non-corporate assets?

42. A digital forensics investigator works from duplicate images to preserve the integrity of the original evidence.

Which of the following types of media are most volatile and should be preserved? (Select two).

43. During a company’s most recent incident, a vulnerability in custom software was exploited on an externally facing server by an APT.

The lessons-learned report noted the following:

• The development team used a new software language that was not supported by the security team's automated assessment tools.

• During the deployment, the security assessment team was unfamiliar with the new language and struggled to evaluate the software during advanced testing. Therefore, the vulnerability was not detected.

• The current IPS did not have effective signatures and policies in place to detect and prevent runtime attacks on the new application.

To allow this new technology to be deployed securely going forward, which of the following will BEST address these findings? (Choose two.)

44. A risk assessment concludes that the perimeter network has the highest potential for compromise by an attacker, and it is labeled as a critical risk environment.

Which of the following is a valid compensating control to reduce the volume of valuable information in the perimeter network that an attacker could gain using active reconnaissance techniques?

45. A security analyst responds to a series of events surrounding sporadic bandwidth consumption from an endpoint device.

The security analyst then identifies the following additional details:

• Bursts of network utilization occur approximately every seven days.

• The content being transferred appears to be encrypted or obfuscated.

• A separate but persistent outbound TCP connection from the host to infrastructure in a third-party cloud is in place.

• The HDD utilization on the device grows by 10GB to 12GB over the course of every seven days.

• Single file sizes are 10GB.

Which of the following describes the most likely cause of the issue?

46. During a forensic investigation, a security analyst reviews some Session Initiation Protocol packets that came from a suspicious IP address. Law enforcement requires access to a VoIP call

that originated from the suspicious IP address.

Which of the following should the analyst use to accomplish this task?

47. HOTSPOT

The developers recently deployed new code to three web servers. A daffy automated external device scan report shows server vulnerabilities that are failure items according to PCI DSS.

If the venerability is not valid, the analyst must take the proper steps to get the scan clean.

If the venerability is valid, the analyst must remediate the finding.

After reviewing the information provided in the network diagram, select the STEP 2 tab to complete the simulation by selecting the correct Validation Result and Remediation Action for each server listed using the drop-down options.



INTRUCTIONS:

The simulation includes 2 steps.

Step1: Review the information provided in the network diagram and then move to the STEP 2 tab.









STEP 2: Given the Scenario, determine which remediation action is required to address the vulnerability.

48. During a review of the vulnerability scan results on a server, an information security analyst notices the following:





The MOST appropriate action for the analyst to recommend to developers is to change the web server so:

49. During a review of SIEM alerts, a security analyst discovers the SIEM is receiving many alerts per day from the file-integrity monitoring toot about files from a newly deployed application that should not change.

Which of the following steps should the analyst complete FIRST to respond to the issue?

50. In web application scanning, static analysis refers to scanning:

51. An organization has the following risk mitigation policies

• Risks without compensating controls will be mitigated first it the nsk value is greater than $50,000

• Other nsk mitigation will be pnontized based on risk value.

The following risks have been identified:





Which of the following is the ordei of priority for risk mitigation from highest to lowest?

52. Which of the following is the BEST option to protect a web application against CSRF attacks?

53. During a routine review of service restarts a security analyst observes the following in a server log:





Which of the following is the GREATEST security concern?

54. The security team decides to meet informally to discuss and test the response plan for potential security breaches and emergency situations.

Which of the following types of training will the security team perform?

55. A customer notifies a security analyst that a web application is vulnerable to information disclosure The analyst needs to indicate the seventy of the vulnerability based on its CVSS score, which the analyst needs to calculate When analyzing the vulnerability the analyst realizes that tor the attack to be successful, the Tomcat configuration file must be modified .

Which of the following values should the security analyst choose when evaluating the CVSS score?

56. Which of the following BEST describes HSM?

57. Which of the following organizational initiatives would be MOST impacted by data severighty issues?

58. An organizational policy requires one person to input accounts payable and another to do accounts receivable. A separate control requires one person to write a check and another person to sign all checks greater than $5,000 and to get an additional signature for checks greater than $10,000.

Which of the following controls has the organization implemented?

59. While reviewing system logs, a network administrator discovers the following entry:





Which of the following occurred?

60. Which of the following attack techniques has the GREATEST likelihood of quick success against Modbus assets?

61. A security analyst needs to provide a copy of a hard drive for forensic analysis.

Which of the following would allow the analyst to perform the task?

A)





B)





C)





D)

62. A Chief Executive Officer (CEO) is concerned about the company’s intellectual property being leaked to competitors. The security team performed an extensive review but did not find any indication of an outside breach. The data sets are currently encrypted using the Triple Data Encryption Algorithm.

Which of the following courses of action is appropriate?

63. While investigating reports or issues with a web server, a security analyst attempts to log in remotely and recedes the following message:





The analyst accesses the server console, and the following console messages are displayed:





The analyst is also unable to log in on the console.

While reviewing network captures for the server, the analyst sees many packets with the following signature:





Which of the following is the BEST step for the analyst to lake next in this situation?

64. Which of the following can detect vulnerable third-parly libraries before code deployment?

65. A security analyst is correlating, ranking, and enriching raw data into a report that will be interpreted by humans or machines to draw conclusions and create actionable recommendations .

Which of the following steps in the intelligence cycle is the security analyst performing?

66. Which of the following BEST identifies the appropriate use of threat intelligence as a function of detection and response?

67. A security analyst is reviewing the network security monitoring logs listed below:





Which of the following is the analyst most likely observing? (Select two).

68. A code review reveals a web application is using lime-based cookies for session management. This is a security concern because lime-based cookies are easy to:

69. A security analyst sees the following OWASP ZAP output from a scan that was performed against a modern version of Windows while testing for client-side vulnerabilities:





Which of the following is the MOST likely solution to the listed vulnerability?

70. After detecting possible malicious external scanning, an internal vulnerability scan was performed, and a critical server was found with an outdated version of JBoss. A legacy application that is running depends on that version of JBoss.

Which of the following actions should be taken FIRST to prevent server compromise and business disruption at the same time?

71. Legacy medical equipment, which contains sensitive data, cannot be patched.

Which of the following is the best solution to improve the equipment's security posture?

72. Which of the following is MOST important when developing a threat hunting program?

73. A security analyst is monitoring a company's network traffic and finds ping requests going to accounting and human resources servers from a SQL server. Upon investigation, the analyst discovers a technician responded to potential network connectivity issues.

Which of the following is the best way for the security analyst to respond?

74. An analyst is reviewing the following output as part of an incident:





Which of the Wowing is MOST likely happening?

75. A company's Chief Information Officer wants to use a CASB solution to ensure policies are being met during cloud access. Due to the nature of the company's business and risk appetite, the management team elected to not store financial information in the cloud. A security analyst needs to recommend a solution to mitigate the threat of financial data leakage into the cloud.

Which of the following should the analyst recommend?

76. The management team has asked a senior security engineer to explore DLP security solutions for the company's growing use of cloud-based storage.

Which of the following is an appropriate solution to control the sensitive data that is being stored in the cloud?

77. During an Incident, it Is determined that a customer database containing email addresses, first names, and last names was exfiltrated.

Which ot the following should the security analyst do NEXT?

78. While conoXicting a cloud assessment, a security analyst performs a Prowler scan, which generates the following within the report:





Based on the Prowler report, which of the following is the BEST recommendation?

79. During an audit several customer order forms were found to contain inconsistencies between the actual price of an item and the amount charged to the customer Further investigation narrowed the cause of the issue to manipulation of the public-facing web form used by customers to order products .

Which of the following would be the BEST way to locate this issue?

80. A development team recently released a new version of a public-facing website for testing prior to production. The development team is soliciting the help of various teams to validate the functionality of the website due to its high visibility.

Which of the following activities best describes the process the development team is initiating?

81. A software developer is correcting the error-handling capabilities of an application following the initial coding of the fix.

Which of the following would the software developer MOST likely performed to validate the code poor to pushing it to production?

82. A company's legal department is concerned that its incident response plan does not cover the countless ways security incidents can occur. The department has asked a security analyst to help tailor the response plan to provide broad coverage for many situations.

Which of the following is the best way to achieve this goal?