cs0-002 practice test

CompTIA Cybersecurity Analyst CS0-002 Exam Dumps

You can take your CompTIA Cybersecurity Analyst exam by studying the latest CS0-002 exam dumps.
Choose to get CS0-002 exam dumps to complete your CompTIA CySA+ certification exam.
It is recommended to choose Lead4Pass CS0-002 exam dumps https://www.lead4pass.com/cs0-002.html online for reading. All the exam questions and answers in CS0-002 exam dumps are required to be read and memorized well to make sure you can pass the CompTIA CySA+ exam successfully.

Check CompTIA CS0-002 free dumps before taking the CS0-002 exam


An organization is attempting to harden its web servers and reduce the information that might be disclosed by potential attackers. A security analyst is reviewing vulnerability scan results from a recent web server scan.
Portions of the scan results are shown below:

Which of the following lines indicates information disclosure about the host that needs to be remediated?

A. Response: :\Documents\MarySmith\mailingList.pdf
B. Finding#5144322
C. First Time Detected 10 Nov 2015 09:00 GMT-0600
D. Access Path: http://myOrg.com/mailingList.htm
E. Request: GET http://myOrg.com/mailingList.aspx?content=volunteer

Correct Answer: A


A company has a popular shopping cart website hosted in geographically diverse locations. The company has started hosting static content on a content delivery network (CDN) to improve performance. The CDN provider has reported the company is occasionally sending attack traffic to other CDN-hosted targets.
Which of the following has MOST likely occurred?

A. The CDN provider has mistakenly performed a GeoIP mapping to the company.
B. The CDN provider has misclassified the network traffic as hostile.
C. A vulnerability scan has been tuned to exclude web assets hosted by the CDN.
D. The company has been breached, and customer PII is being exfiltrated to the CDN.

Correct Answer: D


A security analyst is assisting with a computer crime investigation and has been asked to secure a PC and deliver it to the forensic lab. Which of the following items would be MOST helpful to secure the PC? (Choose three.)

A. Tamper-proof seals
B. Faraday cage
C. Chain of custody form
D. Drive eraser
E. Write blockers
F. Network tap
G. Multimeter

Correct Answer: ABC


Which of the following stakeholders would need to be aware of an e-discovery notice received by the security office about an ongoing case within the manufacturing department?

A. Board of trustees
B. Human resources
C. Legal D. Marketing

Correct Answer: C


An analyst was investigating the attack that took place on the network. A user was able to access the system without proper authentication. Which of the following will the analyst recommend, related to management approaches, in order to control access? (Choose three.)


Correct Answer: ACE


A company\’s IDP/DLP solution triggered the following alerts:

Which of the following alerts should a security analyst investigate FIRST?

A. A
B. B
C. C
D. D
E. E

Correct Answer: D


A software assurance lab is performing a dynamic assessment on an application by automatically generating and inputting different, random data sets to attempt to cause an error/failure condition. Which of the following software assessment capabilities is the lab performing AND during which phase of the SDLC should this occur? (Select two.)

A. Fuzzing
B. Behavior modeling
C. Static code analysis
D. Prototyping phase
E. Requirements phase
F. Planning phase

Correct Answer: AD
Reference: http://www.brighthub.com/computing/smb-security/articles/9956.aspx


A company has implemented WPA2, a 20-character minimum for the WiFi passphrase, and a new WiFi passphrase every 30 days, and has disabled SSID broadcast on all wireless access points. Which of the following is the company trying to mitigate?

A. Downgrade attacks
B. Rainbow tables
C. SSL pinning
D. Forced deauthentication

Correct Answer: A


A security operations team was alerted to abnormal DNS activity coming from a user\’s machine. The team performed a forensic investigation and discovered a host had been compromised. Malicious code was using DNS as a tunnel to extract data from the client machine, which had been leaked and transferred to an unsecured public Internet site. Which of the following BEST describes the attack?

A. Phishing
B. Pharming
C. Cache poisoning
D. Data exfiltration

Correct Answer: D


During a routine log review, a security analyst has found the following commands that cannot be identified from the Bash history log on the root user:

Which of the following commands should the analyst investigate FIRST?

A. Line 1
B. Line 2
C. Line 3
D. Line 4
E. Line 5
F. Line 6

Correct Answer: B


CompTIA CS0-002 free dumps online download:https://drive.google.com/file/d/1pYQrY9hcvHs-jTwz3Dr3uXpwVRDdVUFW/view?usp=sharing

Get 769 newly updated CS0-002 exam questions and answers to complete the CompTIA Cybersecurity Analyst certification exam with Lead4Pass CS0-002 dumps https://www.lead4pass.com/cs0-002.html.

[2021.8] Free CompTIA CS0-002 exam practice test and latest updates CS0-002 dumps from Lead4pass

Newly shared CompTIA CS0-002 exam learning preparation program! Get the latest CS0-002 exam exercise questions and exam dumps pdf for free! 100% pass the exam to select
the full CompTIA CS0-002 dumps https://www.lead4pass.com/cs0-002.html the link to get VCE or PDF. All exam questions are updated!

Lead4pass offers the latest CompTIA CS0-002 PDF Google Drive

[Latest updates] Free CompTIA CS0-002 dumps pdf download from Google Drive: https://drive.google.com/file/d/1uuA0o5lXyhqcgxZ6FBSG-TJcag_BDYX5/

Latest updated CompTIA CS0-002 exam questions and answers

A pharmaceutical company\\’s marketing team wants to send out notifications about new products to alert users of
recalls and newly discovered adverse drug reactions. The team plans to use the names and mailing addresses that
users have
Which of the following data privacy standards does this violate?
A. Purpose limitation
B. Sovereignty
C. Data minimization
D. Retention
Correct Answer: A
Reference: http://www.isitethical.eu/portfolio-item/purpose-limitation/


An organization suspects it has had a breach, and it is trying to determine the potential impact. The organization knows
the following:
The source of the breach is linked to an IP located in a foreign country. The breach is isolated to the research and
development servers. The hash values of the data before and after the breach are unchanged. The affected servers
regularly patched, and a recent scan showed no vulnerabilities.
Which of the following conclusions can be drawn with respect to the threat and impact? (Choose two.)
A. The confidentiality of the data is unaffected.
B. The threat is an APT.
C. The source IP of the threat has been spoofed.
D. The integrity of the data is unaffected.
E. The threat is an insider.
Correct Answer: BD


A security analyst has a sample of malicious software and needs to know what the sample does? The analyst runs the
sample in a carefully controlled and monitored virtual machine to observe the software behavior. Which of the following
malware analysis approaches is this?
A. White box testing
B. Fuzzing
C. Sandboxing
D. Static code analysis
Correct Answer: C


An analyst is searching a log for potential credit card leaks. The log stores all data encoded in hexadecimal. Which of
the following commands will allow the security analyst to confirm the incident?
A. cat log xxd -r -p | egrep \\’ [0-9] {16}
B. egrep \\'(3(0-9)) (16) \\’ log
C. cat log | xxd -r -p egrep \\'(0-9) (16)\\’
D. egrep \\’ (0-9) (16) \\’ log | xxdc
Correct Answer: C


The threat intelligence department recently learned of an advanced persistent threat that is leveraging a new strain of
malware, exploiting a system router. The company currently uses the same device mentioned in the threat report. Which
of the following configuration changes would BEST improve the organization\\’s security posture?
A. Implement an IPS rule that contains content for the malware variant and patch the routers to protect against the
B. Implement an IDS rule that contains the IP addresses from the advanced persistent threat and patch the routers to
protect against the vulnerability
C. Implement an IPS rule that contains the IP addresses from the advanced persistent threat and patch the routers to
protect against the vulnerability
D. Implement an IDS rule that contains content for the malware variant and patch the routers to protect against the
Correct Answer: A


A security analyst is reviewing the following log from an email security service.comptia cs0-002 exam questions q6

Which of the following BEST describes the reason why the email was blocked?
A. The To address is invalid.
B. The email originated from the www.spamfilter.org URL.
C. The IP address and the remote server name are the same.
D. The IP address was blacklisted.
E. The From address is invalid.
Correct Answer: D
Reference: https://www.webopedia.com/TERM/R/RBL.html


A small electronics company decides to use a contractor to assist with the development of a new FPGA- based device.
Several of the development phases will occur off-site at the contractor\\’s labs. Which of the following is the main
concern a security analyst should have with this arrangement?
A. Making multiple trips between development sites increases the chance of physical damage to the FPGAs.
B. Moving the FPGAs between development sites will lessen the time that is available for security testing.
C. Development phases occurring at multiple sites may produce change management issues.
D. FPGA applications are easily cloned, increasing the possibility of intellectual property theft.
Correct Answer: B
Reference: https://www.eetimes.com/how-to-protect-intellectual-property-in-fpgas-devices-part-1/#


A security analyst suspects a malware infection was caused by a user who downloaded malware after clicking
http:///a.php in a phishing email. To prevent other computers from being infected by the same malware variation, the
analyst should create a rule on the __________.
A. email server that automatically deletes attached executables.
B. IDS to match the malware sample.
C. proxy to block all connections to .
D. firewall to block connection attempts to dynamic DNS hosts.
Correct Answer: C


An analyst is reviewing a list of vulnerabilities, which were reported from a recent vulnerability scan of a Linux server.
Which of the following is MOST likely to be a false positive?
A. OpenSSH/OpenSSL Package Random Number Generator Weakness
B. Apache HTTP Server Byte Range DoS
C. GDI+ Remote Code Execution Vulnerability (MS08-052)
D. HTTP TRACE / TRACK Methods Allowed (002-1208)
E. SSL Certificate Expiry
Correct Answer: E


A security analyst received a series of antivirus alerts from a workstation segment, and users reported ransomware
messages. During lessons-learned activities, the analyst determines the antivirus was able to alert to abnormal behavior
but did not stop this newest variant of ransomware. Which of the following actions should be taken to BEST mitigate the
effects of this type of threat in the future?
A. Enabling sandboxing technology
B. Purchasing cyber insurance
C. Enabling application blacklisting
D. Installing a firewall between the workstations and Internet
Correct Answer: A


A cybersecurity analyst is dissecting an intrusion down to the specific techniques and wants to organize them in a
logical manner. Which of the following frameworks would BEST apply in this situation?
A. Pyramid of Pain
C. Diamond Model of Intrusion Analysis
D. CVSS v3.0
Correct Answer: B


Joe, a penetration tester, used a professional directory to identify a network administrator and ID administrator for a
client\\’s company. Joe then emailed the network administrator, identifying himself as the ID administrator, and asked for
a current password as part of a security exercise. Which of the following techniques were used in this scenario?
A. Enumeration and OS fingerprinting
B. Email harvesting and host scanning
C. Social media profiling and phishing
D. Network and host scanning
Correct Answer: C


An organisation is assessing risks so it can prioritize its mitigation actions. Following are the risks and their probability
and impact:

comptia cs0-002 exam questions q13

Which of the following is the order of priority for risk mitigation from highest to lowest?
A. A, B, C, D
B. A, D, B, C
C. B, C, A, D
D. C, B, D, A
E. D, A, C, B
Correct Answer: A


Examscode free to share CompTIA CS0-002 exam exercise questions, CS0-002 pdf! Lead4pass updated exam questions and answers throughout the year!
Make sure you pass the exam successfully. Select lead4Pass CS0-002 Dumps to pass CompTIA CS0-002 exam “CompTIA Cybersecurity Analyst (CySA+)“.


Latest update Lead4pass CS0-002 exam dumps: https://www.lead4pass.com/cs0-002.html (260 Q&As)

[Latest updates] Free CompTIA CS0-002 Dumps pdf download from Google Drive: https://drive.google.com/file/d/1uuA0o5lXyhqcgxZ6FBSG-TJcag_BDYX5/