Comptia Cysa+ (Cs0-002) Practice Exam 1| Questions & Answers (Verified) | Latest Update | Graded A+

Page 1 of 21 COMPTIA CYSA+ (CS0-002) PRACTICE EXAM 1| QUESTIONS & ANSWERS (VERIFIED) | LATEST UPDATE | GRADED A+ A cybersecurity analyst reviews the logs of a proxy server and saw the following URL, about the results of this search? A. Returns no useful results for an attacker B. Returns all web pages containing an email address affiliated with C.Returns all web pages hosted at D. Returns all web pages containing the text Correct Answer: B. Returns all web pages containing an email address affiliated with Google interprets this statement as anything@ and understands that the user is searching for email addresses since %40 is the hex code for the @ symbol. The * is a wild card character meaning that any text could be substituted for the * in the query. This type of search would provide an attacker with a list of email addresses Page 2 of 21 associated with , which could be used as part of a spear phishing campaign. To return all web pages hosted at , you should use the "site:" modifier in the query. To return all web pages with the text , enter "" into the Google search bar with no modifiers to return those results. Protected health information (PHI) Correct Answer: is defined as any information that identifies someone as the subject of medical and insurance records, plus their associated hospital and laboratory test results. This type of data is protected by the Health Insurance Portability and Accountability Act (HIPAA). Which of the following types of data breaches would require that the US Department of Health and Human Services and the media be notified if more than 500 individuals are affected by a data breach? A. Trade secret information B. Protected health information C. Credit card information D. Personally identifiable information Correct Answer: B. Protected health information OBJ-5.1: Protected health information (PHI) is defined as any information that identifies someone as the subject of medical and insurance records, plus their associated hospital and laboratory test results. This type of data is protected by the Health Insurance Page 3 of 21 Portability and Accountability Act (HIPAA). It requires notification of the individual, the Secretary of the US Department of Health and Human Services (HHS), and the media (if more than 500 individuals are affected) in the case of a data breach. Personally identifiable information (PII) is any data that can be used to identify, contact, or impersonate an individual. Credit card information is protected under the PCI DSS information security standard. Trade secret information is protected by the organization that owns those secrets. Personally identifiable information (PII) is Correct Answer: any data that can be used to identify, contact, or impersonate an individual. Credit card information is Correct Answer: protected under the PCI DSS information security standard. Trade secret information is Correct Answer: protected by the organization that owns those secrets. Fail to Pass Systems has suffered a data breach. Your analysis of suspicious log activity traced the source of the data breach to an employee in the accounting department's personally-owned smartphone connected to the company's wireless network. The smartphone has been isolated from the network now, but the employee refuses to allow you to image their smartphone to complete your investigation Page 4 of 21 forensically. According to the employee, the company's BYOD policy does not require her to give you her device, and it is an invasion of their privacy. Which of the following phases of the incident response process is at fault for creating this situation? A. Detection and analysis phase B . Containment phase C .Preparation Phase D. Eradication and recovery phase Correct Answer: C .Preparation Phase OBJ-5.1: As part of the preparation phase, obtaining authorization to seize devices (including personally owned electronics) should have been made clear and consented to by all employees. If the proper requirements were placed into the BYOD policy before the incident occurred, this would have prevented this situation. Either the employee would be willing to hand over their device for imaging following the BYOD policy, or they would never have connected their device to the company wireless network in the first place if they were concerned with their privacy and understood the BYOD policy. Based on the scenario provided, the detection and analysis phase was conducted properly since the analyst was able to identify the breach and detect the source. The containment phase would be responsible for the segmentation and isolation of the device which has occurred. Eradication and recovery would involve patching, restoring, mitigating, and remediating the vulnerability, which was the employee's smartphone. Evidence retention is conducted in post-incident activities, but this cannot be done due to the lack of proper preparation concerning the BYOD policy. Page 5 of 21 Which of the following techniques would be the most appropriate solution to implementing a multi-factor authentication system? A.Fingerprint and retinal scan B.smartcard and PIN C.Username and password D.Password and security question Correct Answer: B.smartcard and PIN Multi-factor authentication (MFA) creates multiple security layers to help increase the confidence that the user requesting access is who they claim to be by requiring two distinct factors for authentication. These factors can be something you know (knowledge factor), something you have (possession factor), something you are (inheritance factor), something you do (action factor), or somewhere you are (location factor). By selecting a smartcard (something you have) and a PIN (something you know), you have implemented multi-factor authentication. Choosing a fingerprint and retinal scan would instead use only one factor (inheritance). Choosing a username, password, and security question would also be only using one factor (knowledge). For something to be considered multi-factor, you need items from at least two different authentication factor categories: knowledge, possession, inheritance, location, or action. Multi-factor authentication (MFA) creates Page 6 of 21 Correct Answer: multiple security layers to help increase the confidence that the user requesting access is who they claim to be by requiring two distinct factors for authentication. These factors can be something you know (knowledge factor), something you have (possession factor), something you are (inheritance factor), something you do (action factor), or somewhere you are (location factor). By selecting a smartcard (something you have) and a PIN (something you know), you have implemented multi-factor authentication. Choosing a fingerprint and retinal scan would Correct Answer: instead use only one factor (inheritance). Choosing a username, password, and security question would Correct Answer: also be only using one factor (knowledge). Which of the following tools is useful for capturing Windows memory data for forensic analysis? A.Nessus B.Memdump C.dd D.Wireshark Correct Answer: B.Memdump Page 7 of 21 The Memdump, Volatility framework, DumpIt, and EnCase are examples of Windows memory capture tools for forensic use. The dd tool is used to conduct forensic disk images. Wireshark is used for packet capture and analysis. Nessus is a commonly used vulnerability scanner. You are attempting to prioritize your vulnerability scans based on the data's criticality. This will be determined by the asset value of the data contained in each system. Which of the following would be the most appropriate metric to use in this prioritization? A.The type of data processed by the system B.The depreciated hardware cost of the system C.The cost of acquisition of the system D.The cost of hardware replacement of the system Correct Answer: A.The type of data processed by the system The data's asset value is a metric or classification that an organization places on data stored, processed, and transmitted by an asset. Different data types, such as regulated data, intellectual property, and personally identifiable information, can determine its value. The cost of acquisition, cost of hardware replacement, and depreciated costs refer to the financial value of the hardware or system itself. This can be significantly different from the value of the information and data that the system stores and processes. The data's asset value is Page 8 of 21 Correct Answer: a metric or classification that an organization places on data stored, processed, and transmitted by an asset. Different data types, such as regulated data, intellectual property, and personally identifiable information, can determine its value. Which of the following tools could be used to detect unexpected output from an application being managed or monitored? A.A signature-based detection tool B.A log analysis tool C.A behavior-based analysis tool D.Manual analysis Correct Answer: C.A behavior-based analysis tool A behavior-based analysis tool can capture/analyze normal behavior and then alert when an anomaly occurs. Configuring a behavior-based analysis tool requires more effort to set up properly, but it requires less work and manual monitoring once it is running. Signature-based detection is a process where a unique identifier is established about a known threat so that the threat can be identified in the future. Manual analysis requires a person to read all the output and determine if it is erroneous. A log analysis tool would only be useful to analyze the logs, but it would not detect unexpected output by itself. Instead, the log analysis tool would need to use a behavior-based or signaturebased detection system. A behavior-based analysis tool can Page 9 of 21 Correct Answer: capture/analyze normal behavior and then alert when an anomaly occurs. Configuring a behavior-based analysis tool requires more effort to set up properly, but it requires less work and manual monitoring once it is running. Signature-based detection is Correct Answer: a process where a unique identifier is established about a known threat so that the threat can be identified in the future. Manual analysis requires Correct Answer: a person to read all the output and determine if it is erroneous. A log analysis tool would only be useful to Correct Answer: analyze the logs, but it would not detect unexpected output by itself. Instead, the log analysis tool would need to use a behavior-based or signature-based detection system. An organization has hired a cybersecurity analyst to conduct an assessment of its current security posture. The analyst begins by conducting an external assessment against the organization's network to determine what information is exposed to a potential external attacker. What technique should the analyst perform first? A.Intranet portal reviews B.Enumeration Page 10 of 21 C.DNS query log reviews D.Technical control audits Correct Answer: B.Enumeration Scanning and enumeration are used to determine open ports and identify the software and firmware/device types running on the host. This is also referred to as footprinting or fingerprinting. This technique is used to create a security profile of an organization by using a methodological manner to conduct the scanning. If this scan is conducted from outside of the organization's network, it can be used to determine the network devices and information available to an unauthorized and external attacker. A DNS query log review, intranet portal review, or technical control audit would require internal access to the network, which is typically not accessible directly to an external attacker. An analyst suspects that a trojan has victimized a Linux system. Which command should be run to determine where the current bash shell is being executed from on the system? A.ls -l bash B.which bash C.printenv bash D.dir bash Correct Answer: By executing the "which bash" command, the system will report the file structure path to where the bash command is being run. If the directory where bash is running is different from the default directory for this Linux distribution, this would Page 11 of 21 indicate a compromised machine. The ls command will list the current directory and show any files or folders named bash. The printenv command would print the value of the specified environment variable specified, bash in this example. The dir command is used to list the contents of a directory, much like ls does. A new security appliance was installed on a network as part of a managed service deployment. The vendor controls the appliance, and the IT team cannot log in or configure it. The IT team is concerned about the appliance receiving the necessary updates. Which of the following mitigations should be performed to minimize the concern for the appliance and updates? A.Configuration management B.Automatic updates C.Vulnerability scanning D.Scan and patch the device Correct Answer: C.Vulnerability scanning OBJ-1.3: The best option here is vulnerability scanning as this allows the IT team to know what risks their network is taking on and where subsequent mitigations may be possible. Configuration management, automatic updates, and patching could normally be possible solutions, but these are not viable options without gaining administrative access to the appliance. Therefore, the analyst should continue to conduct vulnerability scanning of the device to understand the risks associated with it and then make recommendations to add additional compensating controls like firewall configurations, Page 12 of 21 adding a WAF, providing segmentation, and other configurations outside the appliance that could minimize the vulnerabilities it presents. Which of the following sets of Linux permissions would have the least permissive to most permissive? A.111, 734, 747 B.777, 444, 111 C.711, 717, 117 D.544, 444, 545 Correct Answer: A.111, 734, 747 OBJ-4.2: From least to most permissive, the best answer is 111, 734, and 747. Linux permissions are read "owner, group, other." They also have numbers that are 4 (read), 2 (write), and 1 (execute). If a number shown is 7, that is 4+2+1 (read/write/execute) permissions. Therefore, the least permission is 000, and the most permissive is 777. The permission set of 111 is execute-execute-execute. The permission set of 734 is read/write/execute-write/execute-read. The permission set of 747 is read/write/executeread-read/write/execute. You are analyzing a Linux server that you suspect has been tampered with by an attacker. You went to the terminal and typed 'history' into the prompt and see the output: Which of the following best describes what actions were performed by this line of code? A.Added the website to the system's allow list in the hosts file B.Routed traffic destined for the localhost to the domain Page 13 of 21 C.Attempted to overwrite the host file and deleted all data except this entry D.Routed traffic destined for the domain to the localhost Correct Answer: D.Routed traffic destined for the domain to the localhost Based on the output provided, it appears that the attacker has attempted to route all traffic destined for to the IP address specified (127.0.0.1). This is typically done to prevent a system from communicating with a specific domain to redirect a host to a malicious site. In this example, the IP/domain name pair of 127.0.0.1 and are being written to the hosts file. Modifying your hosts file enables you to override the domain name system (DNS) for a domain on a specific machine. The command echo redirects the output of the content on the left of the to the end of the file on the right of the symbol. If the were used instead of , then this command would have overwritten the host file completely with this entry. The hosts file is not a system allow list file. You just received a notification that your company's email servers have been blocklisted due to reports of spam originating from your domain. What information do you need to start investigating the source of the spam emails? A.Network flows for the DMZ containing the email servers B.The SMTP audit log from his company's email server C.Firewall logs showing the SMTP connections D.The full email header from one of the spam messages Page 14 of 21 (Correct) Correct Answer: D.The full email header from one of the spam messages (Correct) You should first request a copy of one of the spam messages, including the full email header. By reading through the full headers of one of the messages, you can determine where the email originated from, whether it was from your email system or external, and if it was a spoofed email or a legitimate email. Once this information has been analyzed, you can then continue your analysis based on those findings, whether that be analyzing your email server, the firewalls, or other areas of concern. If enough information cannot be found by analyzing the email headers, you will need to conduct more research to determine the best method to solve the underlying problem. You received an incident response report indicating a piece of malware was introduced into the company's network through a remote workstation connected to the company's servers over a VPN connection. Which of the following controls should be applied to prevent this type of incident from occurring again? A.NAC B.MAC filtering C.ACL D.SPF Correct Answer: A.NAC Page 15 of 21 OBJ-2.1: Network Access Control (NAC) is an approach to computer security that attempts to unify endpoint security technology (such as anti-virus, host intrusion prevention, and vulnerability assessment), user or system authentication, and network security enforcement. When a remote workstation connects to the network, NAC will place it into a segmented portion of the network (sandbox), scan it for malware and validate its security controls, and then based on the results of those scans, either connect it to the company's networks or place the workstation into a separate quarantined portion of the network for further remediation. An access control list (ACL) is a network traffic filter that can control incoming or outgoing traffic. An ACL alone would not have prevented this issue. MAC Filtering refers to a security access control method whereby the MAC address assigned to each network card is used to determine access to the network. MAC filtering operates at layer 2 and is easy to bypass. Sender Policy Framework (SPF) is an email authentication method designed to detect forging sender addresses during email delivery. Network Access Control (NAC) is Correct Answer: an approach to computer security that attempts to unify endpoint security technology (such as anti-virus, host intrusion prevention, and vulnerability assessment), user or system authentication, and network security enforcement. When a remote workstation connects to the network, NAC will place it into a segmented portion of the network (sandbox), scan it for malware and validate its security controls, and then based on the results of those scans, either connect it to the company's networks or Page 16 of 21 place the workstation into a separate quarantined portion of the network for further remediation. An access control list (ACL) is Correct Answer: a network traffic filter that can control incoming or outgoing traffic. MAC Filtering refers to a security access control method whereby Correct Answer: the MAC address assigned to each network card is used to determine access to the network. MAC filtering operates at layer 2 and is easy to bypass. Sender Policy Framework (SPF) is Correct Answer: an email authentication method designed to detect forging sender addresses during email delivery. An organization is conducting a cybersecurity training exercise. What team is Jason assigned to if he has been asked to monitor and manage the defenders' and attackers' technical environment during the exercise? A.Blue team B.White team C.Purple team D.Red team Correct Answer: B.White team Page 17 of 21 OBJ-5.2: Jason is assigned to the white team. The white team acts as the judges, enforces the rules of the exercise, observes the exercise, scores teams, resolves any problems that may arise, handles all requests for information or questions, and ensures that the competition runs fairly and does not cause operational problems for the defender's mission. A red team is a group of people authorized and organized to emulate a potential adversary's attack or exploitation capabilities against an enterprise's security posture. A blue team is a group of people responsible for defending an enterprise's use of information systems by maintaining its security posture against a group of mock attackers. The purple team is made up of both the blue and red teams to work together to maximize their cyber capabilities through continuous feedback and knowledge transfer between attackers and defenders. Which of the following must be combined with a threat to create risk? A.Exploit B.Vulnerability C.Malicious actor D.Mitigation Correct Answer: B.Vulnerability OBJ-1.2: A risk results from the combination of a threat and a vulnerability. A vulnerability is a weakness in a device, system, application, or process that might allow an attack to take place. A threat is an outside force that may exploit a vulnerability. Page 18 of 21 Remember, a vulnerability is something internal to your organization's security goals. Therefore, you can control, mitigate, or remediate a vulnerability. A threat is external to your organization's security goals. A threat could be a malicious actor, a software exploit, a natural disaster, or other external factors. In the case of an insider threat, they are considered an external factor for threats and vulnerabilities since their goals lie outside your organization's security goals. A cybersecurity analyst is reviewing the logs of an authentication server and saw the following output: What type of attack was most likely being attempted by the attacker? A.Credential stuffing B.Password spraying C.Brute force D.Impersonation Correct Answer: C.Brute force OBJ-1.7: This is an example of a brute force attack. Unlike password spraying that focuses on attempting only one or two passwords per user, a brute force attack focuses on trying multiple passwords for a single user. The goal of this attack is to crack the user's password and gain access to their account. Password spraying, instead, refers to the attack method that takes a large number of usernames and loops them with a single password. We can use multiple iterations using several different passwords, but the number of passwords attempted is usually low compared to the number of users Page 19 of 21 attempted. This method avoids password lockouts, and it is often more effective at uncovering weak passwords than targeting specific users. In the scenario provided, only one or two attempts are being made to each username listed. This is indicative of a password spraying attack instead of a brute force attempt against a single user. Impersonation is the act of pretending to be another person for fraudulent purposes. Credential stuffing is the automated injection of breached username/password pairs to gain user accounts access fraudulently. This is a subset of the brute force attack category: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account. The attacker can then hijack the account for their purposes. A vulnerability is Correct Answer: a weakness in a device, system, application, or process that might allow an attack to take place. A threat is Correct Answer: an outside force that may exploit a vulnerability. Remember, a vulnerability is something internal to your organization's security goals. Therefore, you can control, mitigate, or remediate a vulnerability. A threat is external to your organization's security goals. A threat could be a malicious actor, a software exploit, a natural disaster, or other external factors. What document typically contains high-level statements of management intent? Page 20 of 21 A.Standard B.Procedure C.Policy D.Guideline Correct Answer: C.Policy Policies are high-level statements of management intent. Compliance with policies by employees should be mandatory. An information security policy will generally contain broad statements around the various cybersecurity objectives. Procedures describe exactly how to use the standards and guidelines to implement the countermeasures that support the policy. Standards and baselines describe specific products, configurations, or other mechanisms to secure the systems. A guideline is a recommendation that can specify the methodology that is to be used. Policies are Correct Answer: high-level statements of management intent. Compliance with policies by employees should be mandatory. An information security policy will Correct Answer: generally contain broad statements around the various cybersecurity objectives. Procedures describe exactly how Page 21 of 21 Correct Answer: to use the standards and guidelines to implement the countermeasures that support the policy. Standards and baselines describe Correct Answer: specific products, configurations, or other mechanisms to secure the systems. A guideline is Correct Answer: a recommendation that can specify the methodology that is to be used.