2024 Valid CS0-002 Real Exam Questions, practice CompTIA CySA+ [Q202-Q221]

QUESTION 202
A security analyst discovers accounts in sensitive SaaS-based systems are not being removed in a timely manner when an employee leaves the organization To BEST resolve the issue, the organization should implement

federated authentication

role-based access control.

manual account reviews

multifactor authentication.

QUESTION 203
A security analyst is reviewing the following DNS logs as part of security-monitoring activities:

Which of the following MOST likely occurred?

The attack used an algorithm to generate command and control information dynamically.

The attack used encryption to obfuscate the payload and bypass detection by an IDS.

The attack caused an internal host to connect to a command and control server.

The attack attempted to contact www.gooqle com to verify Internet connectivity.

QUESTION 204
A system’s authority to operate (ATO) is set to expire in four days. Because of other activities and limited staffing, the organization has neglected to start reauthentication activities until now. The cybersecurity group just performed a vulnerability scan with the partial set of results shown below:

Based on the scenario and the output from the vulnerability scan, which of the following should the security team do with this finding?

Remediate by going to the web config file, searching for the enforce HTTP validation setting, and manually updating to the correct setting.

Accept this risk for now because this is a “high” severity, but testing will require more than the four days available, and the system ATO needs to be competed.

Ignore it. This is false positive, and the organization needs to focus its efforts on other findings.

Ensure HTTP validation is enabled by rebooting the server.

QUESTION 205
A security analyst is investigating a malware infection that occurred on a Windows system. The system was not connected to a network and had no wireless capability Company policy prohibits using portable media or mobile storage The security analyst is trying to determine which user caused the malware to get onto the system Which of the following registry keys would MOST likely have this information?
A)

B)

C)

D)

Option A

Option B

Option C

Option D

QUESTION 206
A cybersecurity analyst is currently checking a newly deployed server that has an access control list applied. When conducting the scan, the analyst received the following code snippet of results:

Which of the following describes the output of this scan?

The analyst has discovered a False Positive, and the status code is incorrect providing an OK message.

The analyst has discovered a True Positive, and the status code is correct providing a file not found error message.

The analyst has discovered a True Positive, and the status code is incorrect providing a forbidden message.

The analyst has discovered a False Positive, and the status code is incorrect providing a server error message.

QUESTION 207
Which of the following assessment methods should be used to analyze how specialized software performs during heavy loads?

Stress test

API compatibility lest

Code review

User acceptance test

Input validation

QUESTION 208
A security analyst is reviewing a report from the networking department that describes an increase in network utilization, which is causing network performance issues on some systems.
A top talkers report over a five-minute sample is included.

Given the above output of the sample, which of the following should the security analyst accomplish FIRST to help track down the performance issues?

Perform reverse lookups on each of the IP addresses listed to help determine if the traffic is necessary.

Recommend that networking block the unneeded protocols such as Quicktime to clear up some of the congestion.

Put ACLs in place to restrict traffic destined for random or non-default application ports.

Quarantine the top talker on the network and begin to investigate any potential threats caused by the excessive traffic.

QUESTION 209
An organization wants to implement a privileged access management solution to belter manage the use of emergency and privileged service accounts Which of the following would BEST satisfy the organization’s goal?

Access control lists

Discretionary access controls

Policy-based access controls

Credential vaulting

QUESTION 210
A security analyst is conducting a post-incident log analysis to determine which indicators can be used to detect further occurrences of a data exfiltration incident. The analyst determines backups were not performed during this time and reviews the following:

Which of the following should the analyst review to find out how the data was exfiltrated?

Monday’s logs

Tuesday’s logs

Wednesday’s logs

Thursday’s logs

QUESTION 211
A monthly job to install approved vendor software updates and hot fixes recently stopped working. The security team performed a vulnerability scan, which identified several hosts as having some critical OS vulnerabilities, as referenced in the common vulnerabilities and exposures (CVE) database.
Which of the following should the security team do NEXT to resolve the critical findings in the most effective manner? (Choose two.)

Patch the required hosts with the correct updates and hot fixes, and rescan them for vulnerabilities.

Remove the servers reported to have high and medium vulnerabilities.

Tag the computers with critical findings as a business risk acceptance.

Manually patch the computers on the network, as recommended on the CVE website.

Harden the hosts on the network, as recommended by the NIST framework.

Resolve the monthly job issues and test them before applying them to the production network.

QUESTION 212
Which of the following is the MOST important objective of a post-incident review?

Capture lessons learned and improve incident response processes

Develop a process for containment and continue improvement efforts

Identify new technologies and strategies to remediate

Identify a new management strategy

QUESTION 213
A security analyst is analyzing the following output from the Spider tab of OWASP ZAP after a vulnerability scan was completed:

Which of the following options can the analyst conclude based on the provided output?

The scanning vendor used robots to make the scanning job faster

The scanning job was successfully completed, and no vulnerabilities were detected

The scanning job did not successfully complete due to an out of scope error

The scanner executed a crawl process to discover pages to be assessed

QUESTION 214
A security analyst is reviewing the logs from an internal chat server. The chat.log file is too large to review manually, so the analyst wants to create a shorter log file that only includes lines associated with a user demonstrating anomalous activity. Below is a snippet of the log:

Which of the following commands would work BEST to achieve the desired result?

grep -v chatter14 chat.log

grep -i pythonfun chat.log

grep -i javashark chat.log

grep -v javashark chat.log

grep -v pythonfun chat.log

grep -i chatter14 chat.log

QUESTION 215
A security analyst is assisting in the redesign of a network to make it more secure. The solution should be low cost, and access to the secure segments should be easily monitored, secured, and controlled. Which of the following should be implemented?

System isolation

Honeyport

Jump box

Mandatory access control

QUESTION 216
A security analyst is performing a review of Active Directory and discovers two new user accounts in the accounting department. Neither of the users has elevated permissions, but accounts in the group are given access to the company’s sensitive financial management application by default.
Which of the following is the BEST course of action?

Follow the incident response plan for the introduction of new accounts

Disable the user accounts

Remove the accounts’ access privileges to the sensitive application

Monitor the outbound traffic from the application for signs of data exfiltration

Confirm the accounts are valid and ensure role-based permissions are appropriate

QUESTION 217
The help desk noticed a security analyst that emails from a new email server are not being sent out. The new email server was recently added to the existing ones. The analyst runs the following command on the new server.

Given the output, which of the following should the security analyst check NEXT?

The DNS name of the new email server

The version of SPF that is being used

The IP address of the new email server

The DMARC policy

QUESTION 218
An organization is performing a risk assessment to prioritize resources for mitigation and remediation based on impact. Which of the following metrics, in addition to the CVSS for each CVE, would best enable the organization to prioritize its efforts?

OS type

OS or application versions

Patch availability

System architecture

Mission criticality

A risk assessment is a process of identifying, analyzing, and evaluating the potential threats and vulnerabilities that may affect an organization’s assets, operations, or objectives. A risk assessment matrix is a tool that can help prioritize the risks based on their likelihood and impact1.
The CVSS (Common Vulnerability Scoring System) is a standard framework for rating the severity of vulnerabilities in software systems. The CVSS provides a numerical score from 0 to 10, as well as a qualitative rating from Low to Critical, based on the characteristics and consequences of the vulnerability2.
However, the CVSS score alone may not be sufficient to determine the priority of mitigation and remediation actions for each vulnerability. Other factors that may influence the decision include:
Patch availability: This metric indicates whether there is a fix or update available for the vulnerability from the vendor or developer. Patch availability can affect the urgency and feasibility of remediation, as well as the risk exposure and potential damage of exploitation. For example, a vulnerability with a high CVSS score but with a readily available patch may be less critical than a vulnerability with a lower CVSS score but with no patch available3.
Mission criticality: This metric reflects the importance and value of the asset or system affected by the vulnerability to the organization’s mission, goals, or functions. Mission criticality can affect the impact and priority of remediation, as well as the risk tolerance and acceptance level of the organization. For example, a vulnerability with a high CVSS score but affecting a non-essential system may be less critical than a vulnerability with a lower CVSS score but affecting a core system4.
OS type: This metric indicates the operating system (OS) of the asset or system affected by the vulnerability. OS type can affect the likelihood and complexity of exploitation, as well as the availability and compatibility of patches or mitigations. For example, a vulnerability with a high CVSS score but affecting an uncommon or unsupported OS may be less critical than a vulnerability with a lower CVSS score but affecting a widely used or supported OS3.
OS or application versions: This metric indicates the specific version of the OS or application affected by the vulnerability. OS or application versions can affect the applicability and relevance of the vulnerability, as well as the availability and compatibility of patches or mitigations. For example, a vulnerability with a high CVSS score but affecting an outdated or obsolete version may be less critical than a vulnerability with a lower CVSS score but affecting a current or popular version3.
System architecture: This metric indicates the design and configuration of the asset or system affected by the vulnerability. System architecture can affect the exposure and accessibility of the vulnerability, as well as the effectiveness and efficiency of patches or mitigations. For example, a vulnerability with a high CVSS score but affecting an isolated or segmented system may be less critical than a vulnerability with a lower CVSS score but affecting an interconnected or integrated system3.
Therefore, to best enable the organization to prioritize its efforts based on impact, patch availability is one of the most important metrics to consider in addition to the CVSS score for each CVE (Common Vulnerabilities and Exposures). Patch availability can directly influence the risk level and remediation strategy for each vulnerability.

QUESTION 219
An organization was alerted to a possible compromise after its proprietary data was found for sale on the Internet. An analyst is reviewing the logs from the next-generation UTM in an attempt to find evidence of this breach. Given the following output:

Which of the following should be the focus of the investigation?

webserver.org-dmz.org

sftp.org-dmz.org

83hht23.org-int.org

ftps.bluemed.net

QUESTION 220
The board of directors made the decision to adopt a cloud-first strategy. The current security infrastructure was designed for on-premise implementation. A critical application that is subject to the Federal Information Security Management Act (FISMA) of 2002 compliance has been identified as a candidate for a hybrid cloud deployment model. Which of the following should be conducted FIRST?

Develop a request for proposal.

Perform a risk assessment.

Review current security controls.

Review the SLA for FISMA compliance.

QUESTION 221
In SIEM software, a security analysis selected some changes to hash signatures from monitored files during the night followed by SMB brute-force attacks against the file servers Based on this behavior, which of the following actions should be taken FIRST to prevent a more serious compromise?

Fully segregate the affected servers physically in a network segment, apart from the production network.

Collect the network traffic during the day to understand if the same activity is also occurring during business hours

Check the hash signatures, comparing them with malware databases to verify if the files are infected.

Collect all the files that have changed and compare them with the previous baseline

2024 Valid CS0-002 Real Exam Questions, practice CompTIA CySA+ [Q202-Q221]

Be the first to reply

Leave a Reply Cancel reply