Free CompTIA CS0-002 Exam Questions & Answer from Training Expert PracticeMaterial [Q144-Q164]

27Apr 2023 by admin No Comments

5/5 - (3 votes)

Free CompTIA CS0-002 Exam Questions and Answer from Training Expert PracticeMaterial

Top CompTIA CS0-002 Courses Online

NEW QUESTION 144
Because some clients have reported unauthorized activity on their accounts, a security analyst is reviewing network packet captures from the company’s API server. A portion of a capture file is shown below:
POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s=”http://schemas.s/soap/envelope/”><s:Body><GetIPLocation+xmlns=”http://tempuri.org/”>
<request+xmlns:a=”http://schemas.somesite.org”+xmlns:i=”http://www.w3.org/2001/XMLSchema-instance”></s:Body></s:Envelope> 192.168.1.22 – – api.somesite.com 200 0 1006 1001 0 192.168.1.22 POST /services/v1_0/Public/Members.svc/soap <<a:Password>Password123</a:Password><a:ResetPasswordToken+i:nil=”true”/> <a:ShouldImpersonatedAuthenticationBePopulated+i:nil=”true”/><a:Username>[email protected]</a:Username></request></Login></s:Body></s:Envelope> 192.168.5.66 – – api.somesite.com 200 0 11558 1712 2024 192.168.4.89 POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s=”http://schemas.xmlsoap.org/soap/envelope/”><s:Body><GetIPLocation+xmlns=”http://tempuri.org/”> <a:IPAddress>516.7.446.605</a:IPAddress><a:ZipCode+i:nil=”true”/></request></GetIPLocation></s:Body></s:Envelope> 192.168.1.22 – – api.somesite.com 200 0 1003 1011 307 192.168.1.22 POST /services/v1_0/Public/Members.svc/soap <s:Envelope+xmlns:s=”http://schemas.xmlsoap.org/soap/envelope/”><s:Body><IsLoggedIn+xmlns=”http://tempuri.org/”> <request+xmlns:a=”http://schemas.datacontract.org/2004/07/somesite.web+xmlns:i=”http://www.w3.org/2001/XMLSchema-instance”><a:Authentication> <a:ApiToken>kmL4krg2CwwWBan5BReGv5Djb7syxXTNKcWFuSjd</a:ApiToken><a:ImpersonateUserId>0</a:ImpersonateUserId><a:LocationId>161222</a:LocationId> <a:NetworkId>4</a:NetworkId><a:ProviderId>”1=1</a:ProviderId><a:UserId>13026046</a:UserId></a:Authentication></request></IsLoggedIn></s:Body></s:Envelope> 192.168.5.66 – – api.somesite.com 200 0 1378 1209 48 192.168.4.89 Which of the following MOST likely explains how the clients’ accounts were compromised?

The clients’ authentication tokens were impersonated and replayed.

The clients’ usernames and passwords were transmitted in cleartext.

An XSS scripting attack was carried out on the server.

A SQL injection attack was carried out on the server.

NEW QUESTION 145
A code review reveals a web application is using lime-based cookies for session management. This is a security concern because lime-based cookies are easy to:

parameterize.

decode.

guess.

decrypt.

NEW QUESTION 146
A security analyst is evaluating two vulnerability management tools for possible use in an organization. The analyst set up each of the tools according to the respective vendor’s instructions and generated a report of vulnerabilities that ran against the same target server.
Tool A reported the following:

Tool B reported the following:

Which of the following BEST describes the method used by each tool? (Choose two.)

Tool A is agent based.

Tool A used fuzzing logic to test vulnerabilities.

Tool A is unauthenticated.

Tool B utilized machine learning technology.

Tool B is agent based.

Tool B is unauthenticated.

NEW QUESTION 147
The help desk has reported that users are reusing previous passwords when prompted to change them.
Which of the following would be the MOST appropriate control for the security analyst to configure to prevent password reuse? (Choose two.)

Implement mandatory access control on all workstations.

Implement role-based access control within directory services.

Deploy Group Policy Objects to domain resources.

Implement scripts to automate the configuration of PAM on Linux hosts.

Deploy a single-sing-on solution for both Windows and Linux hosts.

NEW QUESTION 148
A company is experiencing a malware attack within its network. A security engineer notices many of the impacted assets are connecting outbound to a number of remote destinations and exfiltrating dat a. The security engineer also see that deployed, up-to-date antivirus signatures are ineffective. Which of the following is the BEST approach to prevent any impact to the company from similar attacks in the future?

IDS signatures

Data loss prevention

Port security

Sinkholing

NEW QUESTION 149
Joe, an analyst, has received notice that a vendor who is coming in for a presentation will require access to a server outside the network. Currently, users are only able to access remote sites through a VPN connection. Which of the following should Joe use to BEST accommodate the vendor?

Allow incoming IPSec traffic into the vendor’s IP address.

Set up a VPN account for the vendor, allowing access to the remote site.

Turn off the firewall while the vendor is in the office, allowing access to the remote site.

Write a firewall rule to allow the vendor to have access to the remote site.

NEW QUESTION 150
Which of the following is a switch attack?

MAC overflow

XSS

CSRF

Inference

NEW QUESTION 151
It is important to parameterize queries to prevent __________.

the execution of unauthorized actions against a database.

a memory overflow that executes code with elevated privileges.

the establishment of a web shell that would allow unauthorized access.

the queries from using an outdated library with security vulnerabilities.

NEW QUESTION 152
A security analyst is monitoring authentication exchanges over the company’s wireless network.
A sample of the Wireshark output is shown below:

Which of the following would improve the security posture of the wireless network?

Using PEAP instead of LEAP

Using SSL 2.0 instead of TLSv1.1

using aspx instead of .jsp

Using UDP instead of TCP

NEW QUESTION 153
A Chief Information Security Officer has asked for a list of hosts that have critical and high-severity findings as referenced in the CVE database. Which of the following tools would produce the assessment output needed to satisfy this request?

Nessus

Nikto

Fuzzer

Wireshark

Prowler

NEW QUESTION 154
A web developer wants to create a new web part within the company website that aggregates sales from individual team sites. A cybersecurity analyst wants to ensure security measurements are implemented during this process. Which of the following remediation actions should the analyst take to implement a vulnerability management process?

Personnel training

Vulnerability scan

Change management

Sandboxing

NEW QUESTION 155
A security professional is analyzing the results of a network utilization report. The report includes the following information:

Which of the following servers needs further investigation?

hr.dbprod.01

R&D.file.srvr.01

mrktg.file.srvr.02

web.srvr.03

NEW QUESTION 156
An organization is upgrading its network and all of its workstations The project will occur in phases, with infrastructure upgrades each month and workstation installs every other week. The schedule should accommodate the enterprise-wide changes, while minimizing the impact to the network. Which of the following schedules BEST addresses these requirements?

Monthly topology scans, biweekly host discovery scans, weekly vulnerability scans

Monthly vulnerability scans, biweekly topology scans, daily host discovery scans

Monthly host discovery scans; biweekly vulnerability scans, monthly topology scans

Monthly topology scans, biweekly host discovery scans, monthly vulnerability scans

NEW QUESTION 157
Given the Nmap request below:

Which of the following actions will an attacker be able to initiate directly against this host?

Password sniffing

ARP spoofing

A brute-force attack

An SQL injection

NEW QUESTION 158
A company has several internal-only, web-based applications on the internal network. Remote employees are allowed to connect to the internal corporate network with a company-supplied VPN client. During a project to upgrade the internal application, contractors were hired to work on a database server and were given copies of the VPN client so they could work remotely. A week later, a security analyst discovered an internal web-server had been compromised by malware that originated from one of the contractor’s laptops. Which of the following changes should be made to BEST counter the threat presented in this scenario?

Create a restricted network segment for contractors, and set up a jump box for the contractors to use to access internal resources.

Deploy a web application firewall in the DMZ to stop Internet-based attacks on the web server.

Deploy an application layer firewall with network access control lists at the perimeter, and then create alerts for suspicious Layer 7 traffic.

Require the contractors to bring their laptops on site when accessing the internal network instead of using the VPN from a remote location.

Implement NAC to check for updated anti-malware signatures and location-based rules for PCs connecting to the internal network.

NEW QUESTION 159
A cybersecurity analyst is currently checking a newly deployed server that has an access control list applied.
When conducting the scan, the analyst received the following code snippet of results:

Which of the following describes the output of this scan?

The analyst has discovered a False Positive, and the status code is incorrect providing an OK message.

The analyst has discovered a True Positive, and the status code is correct providing a file not found error message.

The analyst has discovered a True Positive, and the status code is incorrect providing a forbidden message.

The analyst has discovered a False Positive, and the status code is incorrect providing a server error message.

NEW QUESTION 160
A security administrator needs to create an IDS rule to alert on FTP login attempts by root. Which of the following rules is the BEST solution?

Option A

Option B

Option C

Option D

NEW QUESTION 161
An analyst is participating in the solution analysis process for a cloud-hosted SIEM platform to centralize log monitoring and alerting capabilities in the SOC.
Which of the following is the BEST approach for supply chain assessment when selecting a vendor?

Gather information from providers, including datacenter specifications and copies of audit reports.

Identify SLA requirements for monitoring and logging.

Consult with senior management for recommendations.

Perform a proof of concept to identify possible solutions.

NEW QUESTION 162
Understanding attack vectors and integrating intelligence sources are important components of:

proactive threat hunting

risk management compliance.

a vulnerability management plan.

an incident response plan.

NEW QUESTION 163
Which of the following solutions is the BEST method to prevent unauthorized use of an API?

HTTPS

Geofencing

Rate liming

Authentication

NEW QUESTION 164
A retail corporation with widely distributed store locations and IP space must meet PCI requirements relating to vulnerability scanning. The organization plans to outsource this function to a third party to reduce costs.
Which of the following should be used to communicate expectations related to the execution of scans?

Vulnerability assessment report

Lessons learned documentation

SLA

MOU

New (2023) CompTIA CS0-002 Exam Dumps: https://www.practicematerial.com/CS0-002-exam-materials.html

Leave a Reply Cancel reply