What High Quality CS0-002 Practice Exam Is

NEW QUESTION 1
A cybersecurity analyst is supporting an incident response effort via threat intelligence. Which of the following is the analyst MOST likely executing?

• A. Requirements analysis and collection planning
• B. Containment and eradication
• C. Recovery and post-incident review
• D. Indicator enrichment and research pivoting

Answer: A

NEW QUESTION 2
A security analyst has a sample of malicious software and needs to know what the sample does? The analyst runs the sample in a carefully controlled and monitored virtual machine to observe the software behavior. Which of the following malware analysis approaches is this?

• A. White box testing
• B. Fuzzing
• C. Sandboxing
• D. Static code analysis

Answer: C

NEW QUESTION 3
A security analyst discovers a vulnerability on an unpatched web server that is used for testing machine learning on Bing Data sets. Exploitation of the vulnerability could cost the organization $1.5 million in lost productivity. The server is located on an isolated network segment that has a 5% chance of being compromised. Which of the following is the value of this risk?

• A. $75.000
• B. $300.000
• C. $1.425 million
• D. $1.5 million

Answer: A

NEW QUESTION 4
The inability to do remote updates of certificates. keys software and firmware is a security issue commonly associated with:

• A. web servers on private networks.
• B. HVAC control systems
• C. smartphones
• D. firewalls and UTM devices

Answer: B

NEW QUESTION 5
A security analyst needs to reduce the overall attack surface.
Which of the following infrastructure changes should the analyst recommend?

• A. Implement a honeypot.
• B. Air gap sensitive systems.
• C. Increase the network segmentation.
• D. Implement a cloud-based architecture.

Answer: C

NEW QUESTION 6
A security analyst is reviewing vulnerability scan results and notices new workstations are being flagged as having outdated antivirus signatures. The analyst observes the following plugin output:
Antivirus is installed on the remote host:
Installation path: C:\Program Files\AVProduct\Win32\ Product Engine: 14.12.101
Engine Version: 3.5.71
Scanner does not currently have information about AVProduct version 3.5.71. It may no longer be supported.
The engine version is out of date. The oldest supported version from the vendor is 4.2.11. The analyst uses the vendor's website to confirm the oldest supported version is correct. Which of the following BEST describes the situation?

• A. This is a false positive, and the scanning plugin needs to be updated by the vendor.
• B. This is a true negative, and the new computers have the correct version of the software.
• C. This is a true positive, and the new computers were imaged with an old version of the software.
• D. This is a false negative, and the new computers need to be updated by the desktop team.

Answer: C

NEW QUESTION 7
Which of the following would MOST likely be included in the incident response procedure after a security breach of customer PII?

• A. Human resources
• B. Public relations
• C. Marketing
• D. Internal network operations center

Answer: B

NEW QUESTION 8
A security analyst is building a malware analysis lab. The analyst wants to ensure malicious applications are not capable of escaping the virtual machines and pivoting to other networks.
To BEST mitigate this risk, the analyst should use.

• A. an 802.11ac wireless bridge to create an air gap.
• B. a managed switch to segment the lab into a separate VLAN.
• C. a firewall to isolate the lab network from all other networks.
• D. an unmanaged switch to segment the environments from one another.

Answer: C

NEW QUESTION 9
Which of the following is the BEST way to share incident-related artifacts to provide non-repudiation?

• A. Secure email
• B. Encrypted USB drives
• C. Cloud containers
• D. Network folders

Answer: B

NEW QUESTION 10
An analyst identifies multiple instances of node-to-node communication between several endpoints within the 10.200.2.0/24 network and a user machine at the IP address 10.200.2.5. This user machine at the IP address 10.200.2.5 is also identified as initiating outbound communication during atypical business hours with several IP addresses that have recently appeared on threat feeds.
Which of the following can be inferred from this activity?

• A. 10.200.2.0/24 is infected with ransomware.
• B. 10.200.2.0/24 is not routable address space.
• C. 10.200.2.5 is a rogue endpoint.
• D. 10.200.2.5 is exfiltrating data.

Answer: D

NEW QUESTION 11
A user receives a potentially malicious email that contains spelling errors and a PDF document. A security analyst reviews the email and decides to download the attachment to a Linux sandbox for review.
Which of the following commands would MOST likely indicate if the email is malicious?

• A. sha256sum ~/Desktop/file.pdf
• B. file ~/Desktop/file.pdf
• C. strings ~/Desktop/file.pdf | grep "<script"
• D. cat < ~/Desktop/file.pdf | grep -i .exe

Answer: A

NEW QUESTION 12
A security analyst has discovered trial developers have installed browsers on all development servers in the company's cloud infrastructure and are using them to browse the Internet. Which of the following changes should the security analyst make to BEST protect the environment?

• A. Create a security rule that blocks Internet access in the development VPC
• B. Place a jumpbox m between the developers' workstations and the development VPC
• C. Remove the administrator profile from the developer user group in identity and access management
• D. Create an alert that is triggered when a developer installs an application on a server

Answer: A

NEW QUESTION 13
A SIEM solution alerts a security analyst of a high number of login attempts against the company's webmail portal. The analyst determines the login attempts used credentials from a past data breach. Which of the following is the BEST mitigation to prevent unauthorized access?

• A. Single sign-on
• B. Mandatory access control
• C. Multifactor authentication
• D. Federation
• E. Privileged access management

Answer: E

NEW QUESTION 14
A security analyst recently discovered two unauthorized hosts on the campus's wireless network segment from a man-m-the-middle attack .The security analyst also verified that privileges were not escalated, and the two devices did not gain access to other network devices Which of the following would BEST mitigate and improve the security posture of the wireless network for this type of attack?

• A. Enable MAC filtering on the wireless router and suggest a stronger encryption for the wireless network,
• B. Change the SSID, strengthen the passcode, and implement MAC filtering on the wireless router.
• C. Enable MAC filtering on the wireless router and create a whitelist that allows devices on the network
• D. Conduct a wireless survey to determine if the wireless strength needs to be reduced.

Answer: A

NEW QUESTION 15
A security analyst working in the SOC recently discovered Balances m which hosts visited a specific set of domains and IPs and became infected with malware. Which of the following is the MOST appropriate action to take in the situation?

• A. implement an IPS signature for the malware and update the blacklisting for the associated domains and IPs
• B. Implement an IPS signature for the malware and another signature request to Nock all the associated domains and IPs
• C. Implement a change request to the firewall setting to not allow traffic to and from the IPs and domains
• D. Implement an IPS signature for the malware and a change request to the firewall setting to not allow traffic to and from the IPs and domains

Answer: C

NEW QUESTION 16
Which of the following types of policies is used to regulate data storage on the network?

• A. Password
• B. Acceptable use
• C. Account management
• D. Retention

Answer: D

NEW QUESTION 17
During an investigation, a security analyst identified machines that are infected with malware the antivirus was unable to detect.
Which of the following is the BEST place to acquire evidence to perform data carving?

• A. The system memory
• B. The hard drive
• C. Network packets
• D. The Windows Registry

Answer: A

NEW QUESTION 18
As part of a review of modern response plans, which of the following is MOST important for an organization lo understand when establishing the breach notification period?

• A. Organizational policies
• B. Vendor requirements and contracts
• C. Service-level agreements
• D. Legal requirements

Answer: D

NEW QUESTION 19
A cybersecurity analyst has access to several threat feeds and wants to organize them while simultaneously comparing intelligence against network traffic.
Which of the following would BEST accomplish this goal?

• A. Continuous integration and deployment
• B. Automation and orchestration
• C. Static and dynamic analysis
• D. Information sharing and analysis

Answer: B

NEW QUESTION 20
Which of the following technologies can be used to store digital certificates and is typically used in high-security implementations where integrity is paramount?

• A. HSM
• B. eFuse
• C. UEFI
• D. Self-encrypting drive

Answer: A

NEW QUESTION 21
......