The Replace Guide To CS0-002 Test Preparation

NEW QUESTION 1
A cybersecurity analyst is reading a daily intelligence digest of new vulnerabilities The type of vulnerability that should be disseminated FIRST is one that:

• A. enables remote code execution that is being exploited in the wild.
• B. enables data leakage but is not known to be m the environment
• C. enables lateral movement and was reported as a proof of concept
• D. affected the organization in the past but was probably contained and eradicated

Answer: C

NEW QUESTION 2
A security analyst on the threat-hunting team has developed a list of unneeded, benign services that are currently running as part of the standard OS deployment for workstations. The analyst will provide this list to the operations team to create a policy that will automatically disable the services for all workstations in the organization.
Which of the following BEST describes the security analyst's goal?

• A. To create a system baseline
• B. To reduce the attack surface
• C. To optimize system performance
• D. To improve malware detection

Answer: B

NEW QUESTION 3
A network attack that is exploiting a vulnerability in the SNMP is detected. Which of the following should the cybersecurity analyst do FIRST?

• A. Apply the required patches to remediate the vulnerability.
• B. Escalate the incident to senior management for guidance.
• C. Disable all privileged user accounts on the network.
• D. Temporarily block the attacking IP address.

Answer: A

NEW QUESTION 4
The inability to do remote updates of certificates, keys, software, and firmware is a security issue commonly associated with:

• A. web servers on private networks
• B. HVAC control systems
• C. smartphones
• D. firewalls and UTM devices

Answer: D

NEW QUESTION 5
A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geographic zones, all of which were initiated through the web-based mail server. The logs indicate all domain accounts experienced two login attempts during the same time frame.
Which of the following is the MOST likely cause of this issue?

• A. A password-spraying attack was performed against the organization.
• B. A DDoS attack was performed against the organization.
• C. This was normal shift work activity; the SIEM's AI is learning.
• D. A credentialed external vulnerability scan was performed.

Answer: A

NEW QUESTION 6
A security administrator needs to create an IDS rule to alert on FTP login attempts by root. Which of the following rules is the BEST solution?

• A. Option A
• B. Option B
• C. Option C
• D. Option D

Answer: B

NEW QUESTION 7
A security analyst for a large financial institution is creating a threat model for a specific threat actor that is likely targeting an organization's financial assets.
Which of the following is the BEST example of the level of sophistication this threat actor is using?

• A. Social media accounts attributed to the threat actor
• B. Custom malware attributed to the threat actor from prior attacks
• C. Email addresses and phone numbers tied to the threat actor
• D. Network assets used in previous attacks attributed to the threat actor
• E. IP addresses used by the threat actor for command and control

Answer: D

NEW QUESTION 8
A security analyst gathered forensics from a recent intrusion in preparation for legal proceedings. The analyst used EnCase to gather the digital forensics. cloned the hard drive, and took the hard drive home for further analysis. Which of the following of the security analyst violate?

• A. Cloning procedures
• B. Chain of custody
• C. Hashing procedures
• D. Virtualization

Answer: B

NEW QUESTION 9
A security analyst recently discovered two unauthorized hosts on the campus's wireless network segment from a man-m-the-middle attack .The security analyst also verified that privileges were not escalated, and the two devices did not gain access to other network devices Which of the following would BEST mitigate and improve the security posture of the wireless network for this type of attack?

• A. Enable MAC filtering on the wireless router and suggest a stronger encryption for the wireless network,
• B. Change the SSID, strengthen the passcode, and implement MAC filtering on the wireless router.
• C. Enable MAC filtering on the wireless router and create a whitelist that allows devices on the network
• D. Conduct a wireless survey to determine if the wireless strength needs to be reduced.

Answer: A

NEW QUESTION 10
An organization that handles sensitive financial information wants to perform tokenization of data to enable the execution of recurring transactions. The organization is most interested m a secure, built-in device to support its solution. Which of the following would MOST likely be required to perform the desired function?

• A. TPM
• B. eFuse
• C. FPGA
• D. HSM
• E. UEFI

Answer: D

NEW QUESTION 11
As a proactive threat-hunting technique, hunters must develop situational cases based on likely attack scenarios derived from the available threat intelligence information. After forming the basis of the scenario, which of the following may the threat hunter construct to establish a framework for threat assessment?

• A. Critical asset list
• B. Threat vector
• C. Attack profile
• D. Hypothesis

Answer: A

NEW QUESTION 12
A large software company wants to move «s source control and deployment pipelines into a cloud-computing environment. Due to the nature of the business management determines the recovery time objective needs to be within one hour. Which of the following strategies would put the company in the BEST position to achieve the desired recovery time?

• A. Establish an alternate site with active replication to other regions
• B. Configure a duplicate environment in the same region and load balance between both instances
• C. Set up every cloud component with duplicated copies and auto scaling turned on
• D. Create a duplicate copy on premises that can be used for failover in a disaster situation

Answer: A

NEW QUESTION 13
A development team is testing a new application release. The team needs to import existing client PHI data records from the production environment to the test environment to test accuracy and functionality.
Which of the following would BEST protect the sensitivity of this data while still allowing the team to perform the testing?

• A. Deidentification
• B. Encoding
• C. Encryption
• D. Watermarking

Answer: A

NEW QUESTION 14
A security analyst is reviewing the logs from an internal chat server. The chat.log file is too large to review manually, so the analyst wants to create a shorter log file that only includes lines associated with a user demonstrating anomalous activity. Below is a snippet of the log:

Which of the following commands would work BEST to achieve the desired result?

• A. grep -v chatter14 chat.log
• B. grep -i pythonfun chat.log
• C. grep -i javashark chat.log
• D. grep -v javashark chat.log
• E. grep -v pythonfun chat.log
• F. grep -i chatter14 chat.log

Answer: D

NEW QUESTION 15
A security analyst is reviewing the following web server log:

Which of the following BEST describes the issue?

• A. Directory traversal exploit
• B. Cross-site scripting
• C. SQL injection
• D. Cross-site request forgery

Answer: A

NEW QUESTION 16
A finance department employee has received a message that appears to have been sent from the Chief Financial Officer (CFO) asking the employee to perform a wife transfer Analysis of the email shows the message came from an external source and is fraudulent. Which of the following would work BEST to improve the likelihood of employees quickly recognizing fraudulent emails?

• A. Implementing a sandboxing solution for viewing emails and attachments
• B. Limiting email from the finance department to recipients on a pre-approved whitelist
• C. Configuring email client settings to display all messages in plaintext when read
• D. Adding a banner to incoming messages that identifies the messages as external

Answer: D

NEW QUESTION 17
......