CS0-002 Online Practice Questions and Answers

A user's computer has been running slowly when the user tries to access web pages. A security analyst runs the command netstat -aon from the command line and receives the following output:

Which of the following lines indicates the computer may be compromised?

A. Line 1

B. Line 2

C. Line 3

D. Line 4

E. Line 5

F. Line 6

A security analyst is reviewing vulnerability scan results and notices new workstations are being flagged as having outdated antivirus signatures. The analyst observes the following plugin output:

Antivirus is installed on the remote host:

Installation path: C:\Program Files\AVProduct\Win32\

Product Engine: 14.12.101

Engine Version: 3.5.71

Scanner does not currently have information about AVProduct version 3.5.71. It may no longer be supported.

The engine version is out of date. The oldest supported version from the vendor is 4.2.11.

The analyst uses the vendor's website to confirm the oldest supported version is correct.

Which of the following BEST describes the situation?

A. This is a false positive, and the scanning plugin needs to be updated by the vendor.

B. This is a true negative, and the new computers have the correct version of the software.

C. This is a true positive, and the new computers were imaged with an old version of the software.

D. This is a false negative, and the new computers need to be updated by the desktop team.

An analyst performs a routine scan of a host using Nmap and receives the following output:

Which of the following should the analyst investigate FIRST?

A. Port 21

B. Port 22

C. Port 23

D. Port 80

During a forensic investigation, a security analyst reviews some Session Initiation Protocol packets that came from a suspicious IP address. Law enforcement requires access to a VoIP call that originated from the suspicious IP address. Which of the following should the analyst use to accomplish this task?

A. Wireshark

B. iptables

C. Tcpdump

D. Netflow

A security analyst at exampte.com receives a SIEM alert for an IDS signature and reviews the associated packet capture and TCP stream: Winch of the following actions should the security analyst lake NEXT?

A. Review the known Apache vulnerabilities to determine if a compromise actually occurred

B. Contact the application owner for connect example local tor additional information

C. Mark the alert as a false positive scan coming from an approved source.

D. Raise a request to the firewall team to block 203.0.113.15.

A security team has begun updating the risk management plan, incident response plan, and system security plan to ensure compliance with security review guidelines. Which of the following can be executed by internal managers to simulate and validate the proposed changes?

A. Internal management review

B. Control assessment

C. Tabletop exercise

D. Peer review

An organization's Cruel Information Security Officer is concerned the proper control are not in place to identify a malicious insider.

Which of the following techniques would be BEST to identify employees who attempt to steal data or do harm to the organization?

A. Place a text file named Passwords txt on the local file server and create a SIEM alert when the file is accessed

B. Segment the network so workstations are segregated from servers and implement detailed logging on the jumpbox

C. Perform a review of all users with privileged access and monitor web activity logs from the organization's pfoxy

D. Analyze logs to determine if a user is consuming large amounts of bandwidth at odd hours ol the day

A reverse engineer was analyzing malware found on a retailer's network and found code extracting track data in memory. Which of the following threats did the engineer MOST likely uncover?

A. POS malware

B. Rootkit

C. Key logger

D. Ransomware

As part of an upcoming engagement for a client, an analyst is configuring a penetration testing application to ensure the scan complies with information defined in the SOW. Which of the following types of information should be considered based on information traditionally found in the SOW? (Select two.)

A. Timing of the scan

B. Contents of the executive summary report

C. Excluded hosts

D. Maintenance windows

E. IPS configuration

F. Incident response policies

A web application has a newly discovered vulnerability in the authentication method used to validate known company users. The user ID of Admin with a password of "password" grants elevated access to the application over the Internet. Which of the following is the BEST method to discover the vulnerability before a production deployment?

A. Manual peer review

B. User acceptance testing

C. Input validation

D. Stress test the application

A SIEM analyst noticed a spike in activities from the guest wireless network to several electronic health record (EHR) systems. After further analysis, the analyst discovered that a large volume of data has been uploaded to a cloud provider in the last six months. Which of the following actions should the analyst do FIRST?

A. Contact the Office of Civil Rights (OCR) to report the breach

B. Notify the Chief Privacy Officer (CPO)

C. Activate the incident response plan

D. Put an ACL on the gateway router

The Chief Information Security Officer (CISO) asked for a topology discovery to be conducted and verified against the asset inventory. The discovery is failing and not providing reliable or complete data. The syslog shows the following information:

Which of the following describes the reason why the discovery is failing?

A. The scanning tool lacks valid LDAP credentials.

B. The scan is returning LDAP error code 52255a.

C. The server running LDAP has antivirus deployed.

D. The connection to the LDAP server is timing out.

E. The LDAP server is configured on the wrong port.

During a recent audit, there were a lot of findings similar to and including the following:

Which of the following would be the BEST way to remediate these findings and minimize similar findings in the future?

A. Use an automated patch management solution.

B. Remove the affected software programs from the servers.

C. Run Microsoft Baseline Security Analyzer on all of the servers.

D. Schedule regular vulnerability scans for all servers on the network.

An analyst is preparing for a technical security compliance check on all Apache servers. Which of the following will be the BEST to use?

A. CIS benchmark

B. Nagios

C. OWASP

D. Untidy

E. Cain and Abel

While analyzing network traffic, a security analyst discovers several computers on the network are connecting to a malicious domain that was blocked by a DNS sinkhole. A new private IP range is now visible, but no change requests were made to add it.

Which of the following is the BEST solution for the security analyst to implement?

A. Block the domain IP at the firewall.

B. Blacklist the new subnet

C. Create an IPS rule.

D. Apply network access control.