A Review Of Realistic CS0-002 Exam Prep

NEW QUESTION 1
A security analyst is providing a risk assessment for a medical device that will be installed on the corporate network. During the assessment, the analyst discovers the device has an embedded operating system that will be at the end of its life in two years. Due to the criticality of the device, the security committee makes a risk- based policy decision to review and enforce the vendor upgrade before the end of life is reached.
Which of the following risk actions has the security committee taken?

• A. Risk exception
• B. Risk avoidance
• C. Risk tolerance
• D. Risk acceptance

Answer: D

NEW QUESTION 2
Which of the following BEST describes the process by which code is developed, tested, and deployed in small batches?

• A. Agile
• B. Waterfall
• C. SDLC
• D. Dynamic code analysis

Answer: A

NEW QUESTION 3
A security analyst implemented a solution that would analyze the attacks that the organization’s firewalls failed to prevent. The analyst used the existing systems to enact the solution and executed the following command.
S sudo nc -1 -v -c maildemon . py 25 caplog, txt
Which of the following solutions did the analyst implement?

• A. Log collector
• B. Crontab mail script
• C. Snikhole
• D. Honeypot

Answer: A

NEW QUESTION 4
It is important to parameterize queries to prevent:

• A. the execution of unauthorized actions against a database.
• B. a memory overflow that executes code with elevated privileges.
• C. the establishment of a web shell that would allow unauthorized access.
• D. the queries from using an outdated library with security vulnerabilities.

Answer: A

NEW QUESTION 5
As part of a review of modern response plans, which of the following is MOST important for an organization lo understand when establishing the breach notification period?

• A. Organizational policies
• B. Vendor requirements and contracts
• C. Service-level agreements
• D. Legal requirements

Answer: D

NEW QUESTION 6
Which of the following roles is ultimately responsible for determining the classification levels assigned to specific data sets?

• A. Data custodian
• B. Data owner
• C. Data processor
• D. Senior management

Answer: B

NEW QUESTION 7
During a routine log review, a security analyst has found the following commands that cannot be identified from the Bash history log on the root user.

Which of the following commands should the analyst investigate FIRST?

• A. Line 1
• B. Line 2
• C. Line 3
• D. Line 4
• E. Line 5
• F. Line 6

Answer: B

NEW QUESTION 8
A Chief Information Security Officer (CISO) wants to upgrade an organization's security posture by improving proactive activities associated with attacks from internal and external threats.
Which of the following is the MOST proactive tool or technique that feeds incident response capabilities?

• A. Development of a hypothesis as part of threat hunting
• B. Log correlation, monitoring, and automated reporting through a SIEM platform
• C. Continuous compliance monitoring using SCAP dashboards
• D. Quarterly vulnerability scanning using credentialed scans

Answer: A

NEW QUESTION 9
A hybrid control is one that:

• A. is implemented differently on individual systems
• B. is implemented at the enterprise and system levels
• C. has operational and technical components
• D. authenticates using passwords and hardware tokens

Answer: B

NEW QUESTION 10
Because some clients have reported unauthorized activity on their accounts, a security analyst is reviewing network packet captures from the company's API server. A portion of a capture file is shown below:
POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s="http://schemas.s/soap/envelope/ "><s:Body><GetIPLocation+xmlns="http://tempuri.org/">
<request+xmlns:a="http://schemas.somesite.org"+xmlns:i="http://www.w3.org/2001/XMLSchema-instance "></s:Body></s:Envelope> 192.168.1.22 - - api.somesite.com 200 0 1006 1001 0 192.168.1.22
POST /services/v1_0/Public/Members.svc/soap
<<a:Password>Password123</a:Password><a:ResetPasswordToken+i:nil="true"/>
<a:ShouldImpersonatedAuthenticationBePopulated+i:nil="true"/><a:Username>somebody@companyname.com 192.168.5.66 - - api.somesite.com 200 0 11558 1712 2024 192.168.4.89
POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s="
http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetIPLocation+xmlns="http://tempuri.org/">
<a:IPAddress>516.7.446.605</a:IPAddress><a:ZipCode+i:nil="true"/></request></GetIPLocation></s:Body>< 192.168.1.22 - - api.somesite.com 200 0 1003 1011 307 192.168.1.22
POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s="
http://schemas.xmlsoap.org/soap/envelope/"><s:Body><IsLoggedIn+xmlns="http://tempuri.org/">
<request+xmlns:a="http://schemas.datacontract.org/2004/07/somesite.web+xmlns:i="
http://www.w3.org/2001/XMLSchema-instance"><a:Authentication>
<a:ApiToken>kmL4krg2CwwWBan5BReGv5Djb7syxXTNKcWFuSjd</a:ApiToken><a:ImpersonateUserId>0
<a:NetworkId>4</a:NetworkId><a:ProviderId>''1=1</a:ProviderId><a:UserId>13026046</a:UserId></a:Authe 192.168.5.66 - - api.somesite.com 200 0 1378 1209 48 192.168.4.89
Which of the following MOST likely explains how the clients' accounts were compromised?

• A. The clients' authentication tokens were impersonated and replayed.
• B. The clients' usernames and passwords were transmitted in cleartext.
• C. An XSS scripting attack was carried out on the server.
• D. A SQL injection attack was carried out on the server.

Answer: A

NEW QUESTION 11
A cyber-incident response analyst is investigating a suspected cryptocurrency miner on a company's server. Which of the following is the FIRST step the analyst should take?

• A. Create a full disk image of the server's hard drive to look for the file containing the malware.
• B. Run a manual antivirus scan on the machine to look for known malicious software.
• C. Take a memory snapshot of the machine to capture volatile information stored in memory.
• D. Start packet capturing to look for traffic that could be indicative of command and control from the miner.

Answer: D

NEW QUESTION 12
Which of the following will allow different cloud instances to share various types of data with a minimal amount of complexity?

• A. Reverse engineering
• B. Application log collectors
• C. Workflow orchestration
• D. API integration
• E. Scripting

Answer: D

NEW QUESTION 13
A cybersecurity analyst is supposing an incident response effort via threat intelligence. Which of the following is the analyst MOST likely executing?

• A. Requirements analysis and collection planning
• B. Containment and eradication
• C. Recovery and post-incident review
• D. Indicator enrichment and research pivoting

Answer: D

NEW QUESTION 14
A security team is implementing a new vulnerability management program in an environment that has a historically poor security posture. The team is aware of issues patch management in the environment and expects a large number of findings. Which of the following would be the MOST efficient way to increase the security posture of the organization in the shortest amount of time?

• A. Create an SLA stating that remediation actions must occur within 30 days of discovery for all levels of vulnerabilities.
• B. Incorporate prioritization levels into the remediation process and address critical findings first.
• C. Create classification criteria for data residing on different servers and provide remediation only for servers housing sensitive data.
• D. Implement a change control policy that allows the security team to quickly deploy patches in the production environment to reduce the risk of any vulnerabilities found.

Answer: B

NEW QUESTION 15
A security analyst is investigating a malware infection that occurred on a Windows system. The system was not connected to a network and had no wireless capability Company policy prohibits using portable media or mobile storage The security analyst is trying to determine which user caused the malware to get onto the system Which of the following registry keys would MOST likely have this information?
A)

B)

C)

D)

• A. Option A
• B. Option B
• C. Option C
• D. Option D

Answer: C

NEW QUESTION 16
An analyst has been asked to provide feedback regarding the control required by a revised regulatory framework At this time, the analyst only needs to focus on the technical controls. Which of the following should the analyst provide an assessment of?

• A. Tokenization of sensitive data
• B. Establishment o' data classifications
• C. Reporting on data retention and purging activities
• D. Formal identification of data ownership
• E. Execution of NDAs

Answer: A

NEW QUESTION 17
......