[2024] CS0-002 All-in-One Exam Guide Practice To your CS0-002 Exam! [Q42-Q63]

QUESTION 42
During a routine security review, anomalous traffic from 9.9.9.9 was observed accessing a web server in the corporate perimeter network. The server is mission critical and must remain accessible around the world to serve web content. The Chief Information Security Officer has directed that improper traffic must be restricted. The following output is from the web server:

Which of the following is the best method to accomplish this task?

QUESTION 43
A security analyst is reviewing the following server statistics:

Which of the following Is MOST likely occurring?

QUESTION 44
Which of the following command line utilities would an analyst use on an end-user PC to determine the ports it is listening on?

QUESTION 45
After reviewing security logs, it is noticed that sensitive data is being transferred over an insecure network. Which of the following would a cybersecurity analyst BEST recommend that the organization implement?

QUESTION 46
A security analyst needs to reduce the overall attack surface.
Which of the following infrastructure changes should the analyst recommend?

QUESTION 47
A technician receives a report that a user’s workstation is experiencing no network connectivity.
The technician investigates and notices the patch cable running from the back of the user’s VoIP phone is routed directly under the rolling chair and has been smashes flat over time.
Which of the following is the most likely cause of this issue?

QUESTION 48
A forensic examiner is investigating possible malware compromise on an active endpoint device. Which of the following steps should the examiner perform first?

QUESTION 49
While a threat intelligence analyst was researching an indicator of compromise on a search engine, the web proxy generated an alert regarding the same indicator.
The threat intelligence analyst states that related sites were not visited but were searched for in a search engine.
Which of the following MOST likely happened in this situation?

QUESTION 50
A security analyst is providing a risk assessment for a medical device that will be installed on the corporate network. During the assessment, the analyst discovers the device has an embedded operating system that will be at the end of its life in two years. Due to the criticality of the device, the security committee makes a risk- based policy decision to review and enforce the vendor upgrade before the end of life is reached.
Which of the following risk actions has the security committee taken?

QUESTION 51
A cybersecurity analyst has received a report that multiple systems are experiencing slowness as a result of a DDoS attack.
Which of the following would be the BEST action for the cybersecurity analyst to perform?

QUESTION 52
An incident responder successfully acquired application binaries off a mobile device for later forensic analysis.
Which of the following should the analyst do NEXT?

QUESTION 53
An organization suspects it has had a breach, and it is trying to determine the potential impact. The organization knows the following:
* The source of the breach is linked to an IP located in a foreign country.
* The breach is isolated to the research and development servers.
* The hash values of the data before and after the breach are unchanged.
* The affected servers were regularly patched, and a recent scan showed no vulnerabilities.
Which of the following conclusions can be drawn with respect to the threat and impact? (Choose two.)

QUESTION 54
Which of the following is the MOST important objective of a post-incident review?

QUESTION 55
An organization discovers motherboards within the environment that appear to have been physically altered during the manufacturing process. Which of the following is the BEST course of action to mitigate the risk of this reoccurring?

QUESTION 56
A small business does not have enough staff in the accounting department to segregate duties. The controller writes the checks for the business and reconciles them against the ledger. To ensure there is no fraud occurring, the business conducts quarterly reviews in which a different officer in the business compares all the cleared checks against the ledger. Which of the following BEST describes this type of control?

QUESTION 57
Which of the following is a technology used to provide Internet access to internal associates without exposing the Internet directly to the associates?

QUESTION 58
An analyst has received unusual alerts on the SIEM dashboard. The analyst wants to get payloads that the hackers are sending toward the target systems without impacting the business operation. Which of the following should the analyst implement?

QUESTION 59
A company allows employees to work remotely. The security administration is configuring services that will allow remote help desk personnel to work secure outside the company’s headquarters. Which of the following presents the BEST solution to meet this goal?

QUESTION 60
A security analyst performs various types of vulnerability scans. Review the vulnerability scan results to determine the type of scan that was executed and if a false positive occurred for each device.
Instructions:
Select the Results Generated drop-down option to determine if the results were generated from a credentialed scan, non-credentialed scan, or a compliance scan.
For ONLY the credentialed and non-credentialed scans, evaluate the results for false positives and check the findings that display false positives. NOTE: If you would like to uncheck an option that is currently selected, click on the option a second time.
Lastly, based on the vulnerability scan results, identify the type of Server by dragging the Server to the results.
The Linux Web Server, File-Print Server and Directory Server are draggable.
If at any time you would like to bring back the initial state of the simulation, please select the Reset All button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

QUESTION 61
A company has a cluster of web servers that is critical to the business. A systems administrator installed a utility to troubleshoot an issue, and the utility caused the entire cluster to 90 offline. Which of the following solutions would work BEST prevent to this from happening again?

QUESTION 62
Which of the following BEST explains the function of trusted firmware updates as they relate to hardware assurance?

QUESTION 63
industry partners from critical infrastructure organizations were victims of attacks on their SCADA devices.
The attacks used privilege escalation to gain access to SCADA administration and access management solutions would help to mitigate this risk?