[Aug 13, 2023] Exam4Tests CS0-001 Exam Practice Test Questions (Updated 458 Questions)
Pass CompTIA CS0-001 Exam Info and Free Practice Test
CompTIA Cybersecurity Analyst (CySA+) certification is a globally recognized certification that validates an individual’s proficiency in the area of cybersecurity analysis. CompTIA Cybersecurity Analyst (CySA+) Certification Exam certification is designed to equip professionals with the necessary skills and knowledge required to identify and prevent cyber threats and attacks, as well as to respond to security incidents. The CompTIA CySA+ certification exam, coded CS0-001, is a computer-based exam that tests the candidate’s ability to apply their knowledge and skills in real-world situations.
NEW QUESTION # 209
An organization wants to remediate vulnerabilities associated with its web servers. An initial vulnerability scan has been performed, and analysts are reviewing the results. Before starting any remediation, the analysts want to remove false positives to avoid spending time on issues that are not actual vulnerabilities.
Which of the following would be an indicator of a likely false positive?
- A. Any items labeled 'low' are considered informational only.
- B. 'HTTPS' entries indicate the web page is encrypted securely.
- C. The scan result version is different from the automated asset inventory.
- D. Reports show the scanner compliance plug-in is out-of-date.
Answer: A
Explanation:
Section: (none)
Explanation/Reference:
Explanation:
NEW QUESTION # 210
An organization has recently recovered from an incident where a managed switch had been accessed and reconfigured without authorization by an insider. The incident response team is working on developing a lessons learned report with recommendations. Which of the following recommendations will BEST prevent the same attack from occurring in the future?
- A. Install and configure NAC services to allow only authorized devices to connect to the network.
- B. Analyze normal behavior on the network and configure the IDS to alert on deviations from normal.
- C. Remove and replace the managed switch with an unmanaged one.
- D. Implement a separate logical network segment for management interfaces.
Answer: D
NEW QUESTION # 211
A security analyst determines that several workstations are reporting traffic usage on port 3389. All
workstations are running the latest OS patches according to patch reporting. The help desk manager
reports some users are getting logged off of their workstations, and network access is running slower than
normal. The analyst believes a zero-day threat has allowed remote attackers to gain access to the
workstations. Which of the following are the BEST steps to stop the threat without impacting all services?
(Choose two.)
- A. Change the public NAT IP address since APTs are common.
- B. Configure a group policy to disable RDP access.
- C. Disconnect public Internet access and review the logs on the workstations.
- D. Enforce a password change for users on the network.
- E. Reapply the latest OS patches to workstations.
- F. Route internal traffic through a proxy server.
Answer: B,D
NEW QUESTION # 212
Policy allows scanning of vulnerabilities during production hours, but production servers have been
crashing lately due to unauthorized scans performed by junior technicians. Which of the following is the
BEST solution to avoid production server downtime due to these types of scans?
- A. Transition from centralized to agent-based scans.
- B. Implement sandboxing to analyze the results of each scan.
- C. Require vulnerability scans be performed by trained personnel.
- D. Configure daily-automated detailed vulnerability reports.
Answer: C
NEW QUESTION # 213
During a web application vulnerability scan, it was discovered that the application would display inappropriate data after certain key phrases were entered into a webform connected to a SQL database server. Which of the following should be used to reduce the likelihood of this type of attack returning sensitive data?
- A. Input validation
- B. Application fuzzing
- C. Static code analysis
- D. Peer review code
Answer: A
NEW QUESTION # 214
A staff member reported that a laptop has degraded performance. The security analyst has investigated the issue and discovered that CPU utilization, memory utilization, and outbound network traffic are consuming the laptop resources. Which of the following is the BEST course of actions to resolve the problem?
- A. Identify and remove malicious processes.
- B. Disable scheduled tasks.
- C. Ensure the laptop OS is properly patched.
- D. Increase laptop memory.
- E. Suspend virus scan.
Answer: A
Explanation:
Explanation
NEW QUESTION # 215
A cybersecurity analyst has received the laptop of a user who recently left the company.
The analyst types 'history' into the prompt, and sees this line of code in the latest bash history:
This concerns the analyst because this subnet should not be known to users within the company. Which of the following describes what this code has done on the network?
- A. Sent 255 ping packets to each host on the network.
- B. Performed a half open SYB scan on the network.
- C. Sequentially sent an ICMP echo reply to the Class C network.
- D. Performed a ping sweep of the Class C network.
Answer: D
NEW QUESTION # 216
An analyst suspects a large database that contains customer information and credit card data was exfiltrated to a known hacker group in a foreign country. Which of the following incident response steps should the analyst take FIRST?
- A. Isolate the server, restore the database to a time before the vulnerability occurred, and ensure the database is encrypted.
- B. Document and verify all evidence and immediately notify the company's Chief Information Security Officer (CISO) to better understand the next steps.
- C. Draft and publish a notice on the company's website about the incident, as PCI regulations require immediate disclosure in the case of a breach of PII or card data.
- D. Immediately notify law enforcement, as they may be able to help track down the hacker group before customer information is disseminated.
Answer: B
NEW QUESTION # 217
A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website.
During the troubleshooting process, the network administrator notices that the web gateway proxy on the
local network has signed all of the certificates on the local machine.
Which of the following describes the type of attack the proxy has been legitimately programmed to
perform?
- A. Replay
- B. Transitive access
- C. Spoofing
- D. Man-in-the-middle
Answer: D
NEW QUESTION # 218
A technician at a company's retail store notifies an analyst that disk space is being consumed at a rapid
rate on several registers. The uplink back to the corporate office is also saturated frequently. The retail
location has no Internet access. An analyst then observes several occasional IPS alerts indicating a server
at corporate has been communicating with an address on a watchlist. Netflow data shows large quantities
of data transferred at those times.
Which of the following is MOST likely causing the issue?
- A. Malware on a register is scraping credit card data and staging it on a server at the corporate office
before uploading it to an attacker-controlled command and control server. - B. A credit card processing file was declined by the card processor and caused transaction logs on the
registers to accumulate longer than usual. - C. Ransomware on the corporate network has propagated from the corporate network to the registers and
has begun encrypting files there. - D. A penetration test is being run against the registers from the IP address indicated on the watchlist,
generating large amounts of traffic and data storage.
Answer: A
NEW QUESTION # 219
A corporation employs a number of small-form-factor workstations and mobile devices, and an incident
response team is therefore required to build a forensics kit with tools to support chip-off analysis. Which of
the following tools would BEST meet this requirement?
- A. Write-blockers
- B. Last-level cache readers
- C. ZIF adapters
- D. JTAG adapters
Answer: D
NEW QUESTION # 220
A cybersecurity analyst is conducting a security test to ensure that information regarding the web server is protected from disclosure. The cybersecurity analyst requested an HTML file from the web server, and the response came back as follows:
Which of the following actions should be taken to remediate this security issue?
- A. Set "Perprocesslogging" to 1 in the URLScan.ini configuration file.
- B. Set "Removeserverheader" to 1 in the URLScan.ini configuration file.
- C. Set "Allowlatescanning" to 1 in the URLScan.ini configuration file.
- D. Set "Enablelogging" to 0 in the URLScan.ini configuration file.
Answer: B
NEW QUESTION # 221
As part of the SDLC, software developers are testing the security of a new web application by inputting large amounts of random data. Which of the following types of testing is being performed?
- A. Fuzzing
- B. Input validation
- C. Stress testing
- D. Regression testing
Answer: A
NEW QUESTION # 222
A vulnerability scan returned the following results for a web server that hosts multiple wiki sites:
Apache-HTTPD-cve-2014-023: Apache HTTPD: mod_cgid denial of service CVE-2014-
0231
Due to a flaw found in mog_cgid, a server using mod_cgid to host CGI scripts could be vulnerable to a
DoS attack caused by a remote attacker who is exploiting a weakness in non-standard input, causing
processes to hang indefinitely.
The security analyst has confirmed the server hosts standard CGI scripts for the wiki sites, does not have
mod_cgid installed, is running Apache 2.2.22, and is not behind a WAF. The server is located in the DMZ,
and the purpose of the server is to allow customers to add entries into a publicly accessible database.
Which of the following would be the MOST efficient way to address this finding?
- A. Disable the HTTP service and use only HTTPS to access the server.
- B. Document the finding as a false positive.
- C. Upgrade to the newest version of Apache.
- D. Place the server behind a WAF to prevent DoS attacks from occurring.
Answer: B
NEW QUESTION # 223
CORRECT TEXT
The developers recently deployed new code to three web servers. A daily automated external device scan report shows server vulnerabilities that are failing items according to PCI DSS. If the vulnerability is not valid, the analyst must take the proper steps to get the scan clean. If the vulnerability is valid, the analyst must remediate the finding. After reviewing the given information, select the STEP 2 tab in order to complete the simulation by selecting the correct "Validation Result" AND "Remediation Action" for each server listed using the drop down options.
Instructions:
If at any time you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
Answer:
Explanation:
see solution below
WEB_SERVER01: VALID - IMPLEMENT SSL/TLS
WEB_SERVER02: VALID - SET SECURE ATTRIBUTE WHEN COOKIE SHOULD SENT
VIA HTTPS ONLY
WEB_SERVER03: VALID - IMPLEMENT CA SIGNED CERTIFICATE
NEW QUESTION # 224
A cybersecurity analyst is reviewing the following outputs:
Which of the following can the analyst infer from the above output?
- A. The remote host is running a web server on port 80.
- B. The remote host is running a service on port 8080.
- C. The remote host is redirecting port 80 to port 8080.
- D. The remote host's firewall is dropping packets for port 80.
Answer: B
NEW QUESTION # 225
The Chief Information Security Officer (CISO) has asked the security analyst to examine abnormally high processor utilization on a key server. The output below is from the company's research and development (R&D) server.
Which of the following actions should the security analyst take FIRST?
- A. Reimage the server
- B. Isolate the R&D server
- C. Determine availability
- D. Initiate an investigation
Answer: B
NEW QUESTION # 226
A security analyst notices PII has been copied from the customer database to an anonymous FTP server
in the DMZ. Firewall logs indicate the customer database has not been accessed from anonymous FTP
server. Which of the following departments should make a decision about pursuing further investigation?
(Choose two.)
- A. Executive management
- B. Public relations
- C. Legal
- D. Human resources
- E. IT management
Answer: A
NEW QUESTION # 227
A cyber-incident response team is responding to a network intrusion incident on a hospital network. Which of the following must the team prepare to allow the data to be used in court as evidence?
- A. Computer forensics form
- B. Chain of custody form
- C. Incident form
- D. HIPAA response form
Answer: B
NEW QUESTION # 228
An analyst finds that unpatched servers have undetected vulnerabilities because the vulnerability scanner does not have the latest set of signatures. Management directed the security team to have personnel update the scanners with the latest signatures at least 24 hours before conducting any scans, but the outcome is unchanged. Which of the following is the BEST logical control to address the failure?
- A. Configure a script to automatically update the scanning tool.
- B. Manually validate that the existing update is being performed.
- C. Configure vulnerability scans to run in credentialed mode.
- D. Test vulnerability remediation in a sandbox before deploying.
Answer: A
NEW QUESTION # 229
An analyst is observing unusual network traffic from a workstation. The workstation is communicating with a known malicious site over an encrypted tunnel. A full antivirus scan with an updated antivirus signature file does not show any sign of infection. Which of the following has occurred on the workstation?
- A. Known malware attack
- B. Cookie stealing
- C. Session hijack
- D. Zero-day attack
Answer: D
Explanation:
Section: (none)
Explanation/Reference:
Explanation:
NEW QUESTION # 230
A company discovers an unauthorized device accessing network resources through one of many network
drops in a common area used by visitors.
The company decides that it wants to quickly prevent unauthorized devices from accessing the network
but policy prevents the company from making changes on every connecting client.
Which of the following should the company implement?
- A. Mandatory Access Control
- B. Network Intrusion Prevention
- C. Port security
- D. WPA2
Answer: C
NEW QUESTION # 231
Which of the following is a security concern found PRIMARILY in virtual infrastructure?
- A. User access to outside resources
- B. Two-factor authentication for network resources
- C. Airgapped systems that will not run on the hypervisor
- D. Physical hardware supporting mutlitenancy
Answer: D
NEW QUESTION # 232
......
Pass Your CompTIA Exam with CS0-001 Exam Dumps: https://www.exam4tests.com/CS0-001-valid-braindumps.html
CS0-001 Exam Dumps PDF Updated Dump from Exam4Tests Guaranteed Success: https://drive.google.com/open?id=10AEiCtQS8F_srohcmIUNpry7t1h9Jjs7