CS0-002 Online Practice Questions and Answers

A developer wrote a script to make names and other Pll data unidentifiable before loading a database export into the testing system Which of the following describes the type of control that is being used?

A. Data encoding

B. Data masking

C. Data loss prevention

D. Data classification

While implementing a PKI for a company, a security analyst plans to utilize a dedicated server as the certAcate authority that is only used to sign intermediate certificates. Which of the following are the MOST secure states for the certificate authority server when it is not in use? (Select TWO)

A. On a private VLAN

B. Full disk encrypted

C. Powered off

D. Backed up hourly

E. VPN accessible only

F. Air gapped

A security analyst is deploying a new application in the environment. The application needs to be integrated with several existing applications that contain SPI Pnor to the deployment, the analyst should conduct:

A. a tabletop exercise

B. a business impact analysis

C. a PCI assessment

D. an application stress test.

A security analyst observes a large amount of scanning activity coming from an IP address outside the organization's environment. Which of the following should the analyst do to block this activity?

A. Create an IPS rule to block the subnet.

B. Sinkhole the IP address.

C. Create a firewall rule to block the IP address.

D. Close all unnecessary open ports.

An organization wants to harden its web servers. As part of this goal, leadership has directed that vulnerability scans be performed, and the security team should remediate the servers according to industry best practices. The team has already chosen a vulnerability scanner and performed the necessary scans, and now the team needs to prioritize the fixes. Which of the following would help to prioritize the vulnerabilities for remediation in accordance with industry best practices?

A. CVSS

B. SLA

C. ITIL

D. OpenVAS

E. Qualys

A cybersecurity analyst has several log files to review. Instead of using grep and cat commands, the analyst decides to find a better approach to analyze the logs. Given a list of tools, which of the following would provide a more efficient way for the analyst to conduct a timeline analysis, do keyword searches, and output a report?

A. Kali

B. Splunk

C. Syslog

D. OSSIM

A company has established an ongoing vulnerability management program and procured the latest technology to support it. However, the program is failing because several vulnerabilities have not been detected. Which of the following will reduce the number of false negatives?

A. Increase scan frequency.

B. Perform credentialed scans.

C. Update the security incident response plan.

D. Reconfigure scanner to brute force mechanisms.

A security incident has been created after noticing unusual behavior from a Windows domain controller. The server administrator has discovered that a user logged in to the server with elevated permissions, but the user's account does not follow the standard corporate naming scheme. There are also several other accounts in the administrators group that do not follow this naming scheme. Which of the following is the possible cause for this behavior and the BEST remediation step?

A. The Windows Active Directory domain controller has not completed synchronization, and should force the domain controller to sync.

B. The server has been compromised and should be removed from the network and cleaned before reintroducing it to the network.

C. The server administrator created user accounts cloning the wrong user ID, and the accounts should be removed from administrators and placed in an employee group.

D. The naming scheme allows for too many variations, and the account naming convention should be updates to enforce organizational policies.

An analyst was investigating the attack that took place on the network. A user was able to access the system without proper authentication. Which of the following will the analyst recommend, related to management approaches, in order to control access? (Choose three.)

A. RBAC

B. LEAP

C. DAC

D. PEAP

E. MAC

F. SCAP

G. BCP

To prioritize the morning's work, an analyst is reviewing security alerts that have not yet been investigated. Which of the following assets should be investigated FIRST?

A. The workstation of a developer who is installing software on a web server.

B. A new test web server that is in the process of initial installation.

C. An accounting supervisor's laptop that is connected to the VPN

D. The laptop of the vice president that is on the corporate LAN