New 2023 Latest Questions CS0-001 Dumps – Use Updated CompTIA Exam [Q202-Q217]

QUESTION 202
Alerts have been received from the SIEM, indicating infections on multiple computers.
Based on threat characteristic, these files were quarantined by the host-based antivirus program. At the same time, additional alerts in the SIEM show multiple blocked URLs from the address of the infected computers; the URLs were clashed as uncategorized. The domain location of the IP address of the URLs that were blocked is checked, and it is registered to an ISP in Russia. Which of the following steps should be taken NEXT?

Remove those computers from the network and replace the hard drives Send the Infected hard drives out lot investigation.

Run a full antivirus scan on all computers and use Splunk to search for any suspicious activity that happened just before the alerts were received in the SIEM.

Run a vulnerability scan and patch discovered vulnerabilities on the next patching cycle Have the users restart their computer Create a use case in the SIEM to monitor farted logins on infected computers.

Install a computer with the same settings as the infected computers in the DM^ to use as a honeypot Permit the URLs classified as uncategorized to and from that host.

QUESTION 203
When reviewing network traffic, a security analyst detects suspicious activity:

Based on the log above, which of the following vulnerability attacks is occurring?

ShellShock

DROWN

Zeus

Heartbleed

POODLE

QUESTION 204
An analyst has informed the Chief Executive Officer (CEO) of a company that a security breach has Just occurred The risk manager was unaware and caught off-guard when the CEO asked for further information. Which of the following should be Implemented to ensure the risk manager Is knowledgeable of any future breaches?

Incident management

Lessons learned report

Chain of custody management

Change control process

QUESTION 205
A cybersecurity professional typed in a URL and discovered the admin panel for the e- commerce application is accessible over the open web with the default password. Which of the following is the MOST secure solution to remediate this vulnerability?

Rename the URL to a more obscure name, whitelist all corporate IP blocks, and require two-factor authentication.

Change the default password, whitelist specific source IP addresses, and require two- factor authentication.

Whitelist all corporate IP blocks, require an alphanumeric passphrase for the default password, and require two-factor authentication.

Change the username and default password, whitelist specific source IP addresses, and require two-factor authentication.

QUESTION 206
A security analyst reserved several service tickets reporting that a company storefront website is not accessible by internal domain users. However, external users ate accessing the website without issue. Which of the following is the MOST likely reason for this behavior?

The FQDN is incorrect.

The DNS server is corrupted.

The time synchronization server is corrupted.

The certificate is expired.

QUESTION 207
File integrity monitoring states the following files have been changed without a written request or approved
change. The following change has been made:
chmod 777 -Rv /usr
Which of the following may be occurring?

The ownership pf /usr has been changed to the current user.

Administrative functions have been locked from users.

Administrative commands have been made world readable/writable.

The ownership of/usr has been changed to the root user.

QUESTION 208
Three similar production servers underwent a vulnerability scan. The scan results revealed that the three servers had two different vulnerabilities rated “Critical”.
The administrator observed the following about the three servers:
The servers are not accessible by the Internet

AV programs indicate the servers have had malware as recently as two weeks ago

The SIEM shows unusual traffic in the last 20 days

Integrity validation of system files indicates unauthorized modifications

Which of the following assessments is valid and what is the most appropriate NEXT step? (Select TWO).

Servers may have been built inconsistently

Servers may be generating false positives via the SIEM

Servers may have been tampered with

Activate the incident response plan

Immediately rebuild servers from known good configurations

Schedule recurring vulnerability scans on the servers

QUESTION 209
A system administrator recently deployed and verified the installation of a critical patch issued by the company’s primary OS vendor. This patch was supposed to remedy a vulnerability that would allow an adversary to remotely execute code from over the network. However, the administrator just ran a vulnerability assessment of networked systems, and each of them still reported having the same vulnerability. Which of the following is the MOST likely explanation for this?

The administrator entered the wrong IP range for the assessment.

The administrator did not wait long enough after applying the patch to run the assessment.

The patch did not remediate the vulnerability.

The vulnerability assessment returned false positives.

QUESTION 210
A security analyst is reviewing IDS logs and notices the following entry:

Which of the following attacks is occurring?

Cross-site scripting

Header manipulation

SQL injection

XML injection

QUESTION 211
A security analyst is attempting to configure a vulnerability scan for a new segment on the network. Given the requirement to prevent credentials from traversing the network while still conducting a credentialed scan, which of the following is the BEST choice?

Install agents on the endpoints to perform the scan

Provide each endpoint with vulnerability scanner credentials

Encrypt all of the traffic between the scanner and the endpoint

Deploy scanners with administrator privileges on each endpoint

QUESTION 212
A datacenter manager just received an SMS alert that a server cage was accessed using an authorized code. The manager does not recall receiving a notification by email for any scheduled maintenance on servers In the cage. Which of the following Is the FIRST step the manager should take?

Check the change management logs at the earliest convenience to determine if the change was authorized.

Remote access the server and change the password to prevent the Intruder from accessing the system.

Request a firewall administrator to Implement an ACL to contain any potential damage.

Call the security guard to investigate the situation.

QUESTION 213
A security analyst is performing a forensic analysis on a machine that was the subject of some historic SIEM alerts. The analyst noticed some network connections utilizing SSL on non-common ports, copies of svchost.exe and cmd.exe in %TEMP% folder, and RDP files that had connected to external IPs. Which of the following threats has the security analyst uncovered?

DDoS

APT

Ransomware

Software vulnerability

QUESTION 214
An analyst wants to use a command line tool to identify open ports and running services on a host along with the application that is associated with those services and port. Which of the following should the analyst use?

Wireshark

Qualys

netstat

nmap

ping

QUESTION 215
A cybersecurity analyst is completing an organization’s vulnerability report and wants it to reflect assets accurately. Which of the following items should be in the report?

Processor utilization

Virtual hosts

Organizational governance

Log disposition

Asset isolation

QUESTION 216
A security analyst begins to notice the CPU utilization from a sinkhole has begun to spike Which of the following describes what may be occurring?

Someone has logged on to the sinkhole and is using the device

The sinkhole has begun blocking suspect or malicious traffic

The sinkhole has begun rerouting unauthorized traffic

Something is controlling the sinkhole and causing CPU spikes due to malicious utilization.

QUESTION 217
During a review of security controls, an analyst was able to connect to an external, unsecured FTP server from a workstation. The analyst was troubleshooting and reviewed the ACLs of the segment firewall the workstation is connected to:

Based on the ACLs above, which of the following explains why the analyst was able to connect to the FTP server?

FTP was explicitly allowed in Seq 8 of the ACL.

FTP was allowed in Seq 10 of the ACL.

FTP was allowed as being included in Seq 3 and Seq 4 of the ACL.

FTP was allowed as being outbound from Seq 9 of the ACL.

New 2023 Latest Questions CS0-001 Dumps – Use Updated CompTIA Exam [Q202-Q217]

Be the first to reply

Leave a Reply Cancel reply