2021 CompTIA CySA+ CS0-002 Real Dumps

CS0-002 Free Dumps
CompTIA Cybersecurity Analyst

(CySA+) Certification Exam
https://www.passcert.com/CS0-002.html
1. As part of a merger with another organization, a Chief Information
Security Officer (CISO) is working with an assessor to perform a risk
assessment focused on data privacy compliance. The CISO is primarily
concerned with the potential legal liability and fines associated with
data privacy.
Based on the CISO's concerns, the assessor will MOST likely focus on:
A. qualitative probabilities.
B. quantitative probabilities.
C. qualitative magnitude.
D. quantitative magnitude.
Answer: D
Download Passcert Latest & Valid CS0-002 Free Dumps To Ensure Your Success
2. A new on-premises application server was recently installed on the
network. Remote access to the server was enabled for vendor support
on required ports, but recent security reports show large amounts of
data are being sent to various unauthorized networks through those
ports.
Which of the following configuration changes must be implemented to
resolve this security issue while still allowing remote vendor access?
A. Apply a firewall application server rule.
B. Whitelist the application server.
C. Sandbox the application server.
D. Enable port security.
E. Block the unauthorized networks.
Answer: B
3.A SIEM solution alerts a security analyst of a high number of login
attempts against the company's webmail portal. The analyst
determines the login attempts used credentials from a past data
breach.
Which of the following is the BEST mitigation to prevent unauthorized
access?
A. Single sign-on
B. Mandatory access control
C. Multifactor authentication
D. Federation
E. Privileged access management
Answer: C
4. A security analyst received a series of antivirus alerts from a workstation
segment, and users reported ransomware messages. During lessons- learned
activities, the analyst determines the antivirus was able to alert to abnormal
behavior but did not stop this newest variant of ransomware.
Which of the following actions should be taken to BEST mitigate the effects of
this type of threat in the future?
A. Enabling application blacklisting
B. Enabling sandboxing technology
C. Purchasing cyber insurance
D. Installing a firewall between the workstations and Internet
Answer: B
5. A Chief Security Officer (CSO) is working on the communication requirements
(or an organization's incident response plan.
In addition to technical response activities, which of the following is the main
reason why communication must be addressed in an effective incident response
program?
A. Public relations must receive information promptly in order to notify the
community.
B. Improper communications can create unnecessary complexity and delay
response actions.
C. Organizational personnel must only interact with trusted members of the law
enforcement community.
D. Senior leadership should act as the only voice for the incident response team
when working with forensics teams.
Answer: B
6. A security analyst reviews SIEM logs and detects a well-known
malicious executable running in a Windows machine. The up-to-date
antivirus cannot detect the malicious executable.
Which of the following is the MOST likely cause of this issue?
A. The malware is being executed with administrative privileges.
B. The antivirus does not have the mltware's signature.
C. The malware detects and prevents its own execution in a virtual
environment.
D. The malware is fileless and exists only in physical memory.
Answer: D
7. An analyst needs to provide a recommendation that will allow a
custom-developed application to have full access to the system's
processors and peripherals but still be contained securely from other
applications that will be developed.
Which of the following is the BEST technology for the analyst to
recommend?
A. Software-based drive encryption
B. Hardware security module
C. Unified Extensible Firmware Interface
D. Trusted execution environment
Answer: D
8. A security analyst is researching an incident and uncovers
several details that may link to other incidents. The security
analyst wants to determine if other incidents are related to
the current incident.
Which of the following threat research methodoloqies would
be MOST appropriate for the analyst to use?
A. Reputation data
B. CVSS score
C. Risk assessment
D. Behavioral analysis
Answer: D
9. A security analyst discovered a specific series of IP addresses that
are targeting an organization. None of the attacks have been
successful.
Which of the following should the security analyst perform NEXT?
A. Begin blocking all IP addresses within that subnet.
B. Determine the attack vector and total attack surface.
C. Begin a kill chain analysis to determine the impact.
D. Conduct threat research on the IP addresses
Answer: D
10. A security analyst is investigating malicious traffic from an
internal system that attempted to download proxy avoidance software
as identified from the firewall logs but the destination IP is blocked
and not captured.
Which of the following should the analyst do?
A. Shut down the computer
B. Capture live data using Wireshark
C. Take a snapshot
D. Determine if DNS logging is enabled.
E. Review the network logs.
Answer: B

2021 CompTIA CySA+ CS0-002 Real Dumps

Uploaded by

Copyright:

Available Formats

2021 CompTIA CySA+ CS0-002 Real Dumps

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2021 CompTIA CySA+ CS0-002 Real Dumps

Uploaded by

Copyright:

Available Formats

CS0-002 Free Dumps

CompTIA Cybersecurity Analyst

You might also like