CS0-002 CompTIA Exam Questions and Free Practice Test

Question 31

An organization was alerted to a possible compromise after its proprietary data was found for sale on the Internet. An analyst is reviewing the logs from the next-generation UTM in an attempt to find evidence of this breach. Given the following output:
CS0-002 dumps exhibit
Which of the following should be the focus of the investigation?

A. webserver.org-dmz.org

B. sftp.org-dmz.org

C. 83hht23.org-int.org

D. ftps.bluemed.net

Correct Answer:A

Question 32

A security analyst is responding to an incident on a web server on the company network that is making a large number of outbound requests over DNS Which of the following is the FIRST step the analyst should take to evaluate this potential indicator of compromise'?

A. Run an anti-malware scan on the system to detect and eradicate the current threat

B. Start a network capture on the system to look into the DNS requests to validate command and control traffic.

C. Shut down the system to prevent further degradation of the company network

D. Reimage the machine to remove the threat completely and get back to a normal running state.

E. Isolate the system on the network to ensure it cannot access other systems while evaluation is underway.

Correct Answer:A

Question 33

A security analyst received an alert from the SIEM indicating numerous login attempts from users outside their usual geographic zones, all of which were initiated through the web-based mail server. The logs indicate all domain accounts experienced two login attempts during the same time frame.
Which of the following is the MOST likely cause of this issue?

A. A password-spraying attack was performed against the organization.

B. A DDoS attack was performed against the organization.

C. This was normal shift work activity; the SIEM's AI is learning.

D. A credentialed external vulnerability scan was performed.

Correct Answer:A

Question 34

A cybersecurity analyst has access to several threat feeds and wants to organize them while simultaneously comparing intelligence against network traffic.
Which of the following would BEST accomplish this goal?

A. Continuous integration and deployment

B. Automation and orchestration

C. Static and dynamic analysis

D. Information sharing and analysis

Correct Answer:B

Question 35

A cybersecurity analyst needs to rearchitect the network using a firewall and a VPN server to achieve the highest level of security To BEST complete this task, the analyst should place the:

A. firewall behind the VPN server

B. VPN server parallel to the firewall

C. VPN server behind the firewall

D. VPN on the firewall

Correct Answer:B

Question 36

The help desk noticed a security analyst that emails from a new email server are not being sent out. The new email server was recently to the existing ones. The analyst runs the following command on the new server.
CS0-002 dumps exhibit
Given the output, which of the following should the security analyst check NEXT?

A. The DNS name of the new email server

B. The version of SPF that is being used

C. The IP address of the new email server

D. The DMARC policy

Correct Answer:B

START CS0-002 EXAM