CS0-002 EXAM QUESTIONS PART 2 VERIFIED 100% CORRECT

CS0-002 EXAM QUESTIONS PART 2 VERIFIED 100% CORRECT A financial institution's business unit plans to deploy a new technology in a manner that violates existing information security standards. Which of the following actions should the Chief Information Security Officer (CISO) take to manage any type of violation? A. Enforce the existing security standards and controls B. Perform a risk analysis and qualify the risk with legal C. Perform research and propose a better technology D. Enforce the standard permits -Answer-B. Perform a risk analysis and qualify the risk with legal A security analyst wants to capture large amounts of network data that will be analyzed at a later time. The packet capture does not need to be in a format that is readable by humans, since it will be put into a binary file called ג€packetCaptureג€. The capture must be as efficient as possible, and the analyst wants to minimize the likelihood that packets will be missed. Which of the following commands will BEST accomplish the analyst's objectives? A. tcpdump ג€"w packetCapture B. tcpdump ג€"a packetCapture C. tcpdump ג€"n packetCapture D. nmap ג€"v packetCapture E. nmap ג€"oA packetCapture -Answer-A. tcpdump ג€"w packetCapture Question #203Topic 1 An organization is upgrading its network and all of its workstations. The project will occur in phases, with infrastructure upgrades each month and workstation installs every other week. The schedule should accommodate the enterprise-wide changes, while minimizing the impact to the network. Which of the following schedules BEST addresses these requirements? A. Monthly vulnerability scans, biweekly topology scans, daily host discovery scans B. Monthly topology scans, biweekly host discovery scans, monthly vulnerability scans C. Monthly host discovery scans, biweekly vulnerability scans, monthly topology scans D. Monthly topology scans, biweekly host discovery scans, weekly vulnerability scans -Answer-B. Monthly topology scans, biweekly host discovery scans, monthly vulnerability scans While investigating an incident in a company's SIEM console, a security analyst found hundreds of failed SSH login attempts, which all occurred in rapid succession. The failed attempts were followed by a successful login on the root user. Company policy allows systems administrators to manage their systems only from the company's internal network using their assigned corporate logins. Which of the following are the BEST actions the analyst can take to stop any further compromise? (Choose two.) A. Add a rule on the affected system to block access to port TCP/22. B. Reset the passwords for all accounts on the affected system. C. Add a rule on the perimeter firewall to block the source IP address. D. Configure /etc/sshd_config to deny root logins and restart the SSHD service. E. Configure /etc/passwd to deny root logins and restart the SSHD service. F. Add a rule on the network IPS to block SSH user sessions. Hide Sol -Answer-B. Reset the passwords for all accounts on the affected system. D. Configure /etc/sshd_config to deny root logins and restart the SSHD service. A company's change management team has asked a security analyst to review a potential change to the email server before it is released into production. The analyst reviews the following change request:Which of the following is the MOST likely reason for the change? A. To reject email from servers that are not listed in the SPF record To reject email from email addresses that are not digitally signed. C. To accept email to the company's domain. D. To reject email from users who are not authenticated to the network. -Answer-A. To reject email from servers that are not listed in the SPF record An analyst has received a notification about potential malicious activity against a web server. The analyst logs in to a central log collection server and runs the following command: ג€cat .1 | grep ג€unionג€. The output shown below appears:68.71.54.117 ג€" ג€" [31/Jan/2020:10:02:31 ג€"0400] ג€Get /cgi-bin/?id=%20union%20select%20192.168.60.50 HTTP/1.1ג€Which of the following attacks has occurred on the server? A. Cross-site request forgery B. SQL injection C. Cross-site scripting D. Directory traversal -Answer-B. SQL injection A security analyst has discovered malware is spreading across multiple critical systems and is originating from a single workstations, which belongs to a member of the cyber-infrastructure team who has legitimate administrator credentials. An analysis of the traffic indicates the workstation swept the networking looking for vulnerable hosts to infect. Which of the following would have worked BEST to prevent the spread of this infection? A. Vulnerability scans of the network and proper patching. B. A properly configured and updated EDR solution. C. A honeypot used to catalog the anomalous behavior and update the IPS. D. Logical network segmentation and the use of jump boxes -Answer-D. Logical network segmentation and the use of jump boxes A Chief Executive Officer (CEO) is concerned about the company's intellectual property being leaked to competitors. The security team performed an extensive review but did not find any indication of an outside breach. The data sets are currently encrypted using the Triple Data Encryption Algorithm. Which of the following courses of action is appropriate? A. Limit all access to the sensitive data based on geographic access requirements with strict role-based access controls. B. Enable data masking and reencrypt the data sets using AES-256. C. Ensure the data is correctly classified and labeled, and that DLP rules are appropriate to prevent disclosure. D. Use data tokenization on sensitive fields, reencrypt the data sets using AES-256, and then create an MD5 hash. -Answer-C. Ensure the data is correctly classified and labeled, and that DLP rules are appropriate to prevent disclosure. Question #226Topic 1 A security analyst is auditing firewall rules with the goal of scanning some known ports to check the firewall's behavior and responses. The analyst executes the following commands:The analyst then compares the following results for port 22: nmap returns ג€Closedג€ hping3 returns ג€flags=RAג€Which of the following BEST describes the firewall rule? A. DNAT ג€"-to-destination 1.1.1.1:3000 B. REJECT with ג€"-tcp-reset C. LOG ג€"-log-tcp-sequence D. DROP -Answer-B. REJECT with ג€"-tcp-reset Question #227Topic 1 An organization's Chief Information Security Officer (CISO) has asked department leaders to coordinate on communication plans that can be enacted in response to different cybersecurity incident triggers. Which of the following is a benefit of having these communication plans? A. They can help to prevent the inadvertent release of damaging information outside the organization. B. They can help to limit the spread of worms by coordinating with help desk personnel earlier in the recovery phase. C. They can quickly inform the public relations team to begin coordinating with the media as soon as a breach is detected. D. They can help to keep the organization's senior leadership informed about the status of patching during the recovery phase. -Answer-A. They can help to prevent the inadvertent release of damaging information outside the organization. To validate local system-hardening requirements, which of the following types of vulnerability scans would work BEST to verify the scanned device meets security policies? A. SCAP B. SAST C. DAST D. DACS -Answer-A. SCAP A company wants to outsource a key human-resources application service to remote employees as a SaaS-based cloud solution. The company's GREATEST concern should be the SaaS provider's: A. SLA for system uptime. B. DLP procedures. C. logging and monitoring capabilities. D. data protection capabilities. -Answer-D. data protection capabilities. An organization's network administrator uncovered a rogue device on the network that is emulating the characteristics of a switch. The device is trunking protocols and inserting tagging values to control the flow of traffic at the data link layer. Which of the following BEST describes the attack? A. DNS pharming B. VLAN hopping C. Spoofing D. Injection attack -Answer-B. VLAN hopping Which of the following is the BEST way to gather patch information on a specific server? A. Event Viewer B. Custom script C. SCAP software D. CI/CD -Answer-C. SCAP software A security analyst is concerned that a third-party application may have access to user passwords during authentication. Which of the following protocols should the application use to alleviate the analyst's concern? A. LDAPS B. MFA C. SAML D. SHA-1 -Answer-C. SAML A company's Chief Information Security Officer (CISO) published an Internet usage policy that prohibits employees from accessing unauthorized websites. The IT department whitelisted websites used for business needs. The CISO wants the security analyst to recommend a solution that would improve security and support employee morale. Which of the following security recommendations would allow employees to browse non-business-related websites? A. Implement a virtual machine alternative. B. Develop a new secured browser. C. Configure a personal business VLAN. D. Install kiosks throughout the building. -Answer-C. Configure a personal business VLAN. A security analyst is handling an incident in which ransomware has encrypted the disks of several company workstations. Which of the following would work BEST to prevent this type of incident in the future? A. Implement a UTM instead of a stateful firewall and enable gateway antivirus. B. Back up the workstations to facilitate recovery and create a gold image. C. Establish a ransomware awareness program and implement secure and verifiable backups. D. Virtualize all the endpoints with daily snapshots of the virtual machines. -Answer-C. Establish a ransomware awareness program and implement secure and verifiable backups. A security analyst receives a CVE bulletin, which lists several products that are used in the enterprise. The analyst immediately deploys a critical security patch.Which of the following BEST describes the reason for the analyst's immediate action? A. Nation-state hackers are targeting the region. B. A new vulnerability was discovered by a vendor. C. A known exploit was discovered. D. A new zero-day threat needs to be addressed. E. There is an insider threat. -Answer-C. A known exploit was discovered. Portions of a legacy application are being refactored to discontinue the use of dynamic SQL. Which of the following would be BEST to implement in the legacy application? A. Input validation B. SQL injection C. Parameterized queries D. Web-application firewall E. Multifactor authentication -Answer-C. Parameterized queries