CS0-002 EXAM STUDY QUESTIONS WITH ALL CORRECT A GRADED SOLUTIONS

CS0-002 EXAM STUDY QUESTIONS WITH ALL CORRECT A GRADED SOLUTIONS Which of the following attack types is occurring? -Answer-Directory traversal A web-based front end for a business intelligence application uses pass-through authentication to authenticate users. The application then uses a service account to perform queries and look up data in a database. A security analyst discovers employees are accessing data sets they have not been authorized to use. Which of the following will fix the cause of the issue? -Answer-Change the security model to force the users to access the database as themselves A companyגTM€s Chief Information Security Officer (CISO) is concerned about the integrity of some highly confidential files. Any changes to these files must be tied back to a specific authorized userגTM€s activity session. Which of the following is the BEST technique to address the CISOגTM€s concerns? -Answer-Configure DLP to reject all changes to the files without pre-authorization. Monitor the files for unauthorized changes. Which of the following secure coding techniques can be used to prevent cross-site request forgery attacks? -Answer-Tokenization A security analyst scanned an internal company subnet and discovered a host with the following Nmap output. Image Based on the output of this Nmap scan, which of the following should the analyst investigate FIRST? -Answer-Port 135 Which of the following technologies can be used to store digital certificates and is typically used in high-security implementations where integrity is paramount? -Answer-HSM A security analyst is investigating a malware infection that occurred on a Windows system. The system was not connected to a network and had no wireless capability. Company policy prohibits using portable media or mobile storage. The security analyst is trying to determine which user caused the malware to get onto the system. Which of the following registry keys would MOST likely have this information? -Answer-HKEY_LOCAL_MACHINESYSTEMControlSet001serviceseventlogSystemiusb3hub Clients are unable to access a companyגTM€s API to obtain pricing data. An analyst discovers sources other than clients are scraping the API for data, which is causing the servers to exceed available resources. Which of the following would be BEST to protect the availability of the APIs? -Answer-Web application firewall A security analyst recently discovered two unauthorized hosts on the campusגTM€s wireless network segment from a man-in-the-middle attack. The security analyst also verified that privileges were not escalated, and the two devices did not gain access to other network devices. Which of the following would BEST mitigate and improve the security posture of the wireless network for this type of attack? -Answer-Change the SSID, strengthen the passcode, and implement MAC filtering on the wireless router Given the Nmap request below: Image Which of the following actions will an attacker be able to initiate directly against this host? -Answer-A brute-force attack As part of an organizationגTM€s information security governance process, a Chief Information Security Officer (CISO) is working with the compliance officer to update policies to include statements related to new regulatory and legal requirements. Which of the following should be done to BEST ensure all employees are appropriately aware of changes to the policies? -Answer-Require all employees to attend updated security awareness training and sign an acknowledgement During an investigation, an analyst discovers the following rule in an executiveגTM€s email client: IF * TO THEN mailto: SELECT FROM ג˜€sentג TM€THEN DELETE FROM The executive is not aware of this rule. Which of the following should the analyst do FIRST to evaluate the potential impact of this security incident? -Answer-Check the server logs to evaluate which emails were sent to A critical server was compromised by malware, and all functionality was lost. Backups of this server were taken; however, management believes a logic bomb may have been injected by a rootkit. Which of the following should a security analyst perform to restore functionality quickly? -Answer-Stand up a new server and restore critical data from backups An analyst wants to identify hosts that are connecting to the external FTP servers and what, if any, passwords are being used. Which of the following commands should the analyst use? -Answer-tcpdump ג"€X dst port 21 An incident response team is responding to a breach of multiple systems that contain PII and PHI. Disclosing the incident to external entities should be based on: -Answer-the communication plan A security is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS. Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise? -Answer-Isolate the system on the network to ensure it cannot access other systems while evaluation is underway A security analyst needs to assess the web server versions on a list of hosts to determine which are running a vulnerable version of the software and output that list into an XML file named . The host list is provided in a file named . Which of the following Nmap commands would BEST accomplish this goal? -Answer-nmap -iL -sV -p 443 -oX Which of the following session management techniques will help to prevent a session identifier from being stolen via an XSS attack? -Answer-Creating proper session identifier entropy The Chief Executive Officer (CEO) of a large insurance company has reported phishing emails that contain malicious links are targeting the entire organization. Which of the following actions would work BEST to prevent against this type of attack? -Answer-Implement an EDR mail module that will rewrite and analyze email links. Which of the following sources would a security analyst rely on to provide relevant and timely threat information concerning the financial services industry? -Answer-Information sharing and analysis membership The Chief Information Officer (CIO) for a large manufacturing organization has noticed a significant number of unknown devices with possible malware infections are on the organization's corporate network. Which of the following would work BEST to prevent the issue? -Answer-Reconfigure the NAC solution to prevent access based on a full device profile and ensure antivirus is installed. A security analyst recently used Arachni to perform a vulnerability assessment of a newly developed web application. The analyst is concerned about the following output: Image Which of the following is the MOST likely reason for this vulnerability? -Answer-The developer set input validation protection on the specific field of A Chief Security Officer (CSO) is working on the communication requirements for an organization's incident response plan. In addition to technical response activities, which of the following is the main reason why communication must be addressed in an effective incident response program? -Answer-Improper communications can create unnecessary complexity and delay response actions. An information security analyst discovered a virtual machine server was compromised by an attacker. Which of the following should be the FIRST step to confirm and respond to the incident? -Answer-Take a snapshot of the virtual machine. A custom script currently monitors real-time logs of a SAMIL authentication server to mitigate brute-force attacks. Which of the following is a concern when moving authentication to a cloud service? -Answer-Log data may be visible to other customers. During a review of vulnerability scan results, an analyst determines the results may be flawed because a control-baseline system, which is used to evaluate a scanning toolגTM€s effectiveness, was reported as not vulnerable. Consequently, the analyst verifies the scope of the scan included the control-baseline host, which was available on the network during the scan. The use of a control-baseline endpoint in this scenario assists the analyst in confirming: -Answer-verification of mitigation. An analyst is reviewing the following code output of a vulnerability scan: Image Which of the following types of vulnerabilities does this MOST likely represent? -Answer-A credential bypass vulnerability The threat intelligence department recently learned of an advanced persistent threat that is leveraging a new strain of malware, exploiting a system router. The company currently uses the same device mentioned in the threat report. Which of the following configuration changes would BEST improve the organizationגTM€s security posture? -Answer-Implement an IPS rule that contains content for the malware variant and patch the routers to protect against the vulnerability An analyst is searching a log for potential credit card leaks. The log stores all data encoded in hexadecimal. Which of the following commands will allow the security analyst to confirm the incident? -Answer-cat log |xxd ג"€r ג"€p | egrep ג{16{]0-9[˜€גT SIMULATION - Malware is suspected on a server in the environment. The analyst is provided with the output of commands from servers in the environment and needs to review all output files in order to determine which process running on one of the servers may be malware. INSTRUCTIONS - Servers 1, 2, and 4 are clickable. Select the Server and the process that host the malware. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. -Answer-check exam topic