It is more faster and easier to pass the CS0-001 Braindumps by using CS0-001 Exam Questions and Answers. Immediate access to the CS0-001 Dumps and find the same core area CS0-001 Free Practice Questions with professionally verified answers, then PASS your exam with a high score now.
Also have CS0-001 free dumps questions for you:
NEW QUESTION 1
Which of the following countermeasures should the security administrate apply to MOST effectively mitigate Rootkit level infections of the organization's workstation devices?
- A. Remove local administrator privileges.
- B. Configure a BIOS-level password on the device.
- C. Install a secondary virus protection application.
- D. Enforce a system state recovery after each device reboot.
Answer: A
NEW QUESTION 2
A new policy requires the security team to perform web application and OS vulnerability scans. All of the company’s web applications use federated authentication and are accessible via a central portal. Which of the following should be implemented to ensure a more thorough scan of the company’s web application, while at the same time reducing false positives?
- A. The vulnerability scanner should be configured to perform authenticated scans.
- B. The vulnerability scanner should be installed on the web server.
- C. The vulnerability scanner should implement OS and network service detection.
- D. The vulnerability scanner should scan for known and unknown vulnerabilities.
Answer: A
NEW QUESTION 3
A security analyst is reviewing a report from the networking department that describes an increase in network utilization, which is causing network performance issues on some systems. A top talkers report over a
five-minute sample is included.
Given the above output of the sample, which of the following should the security analyst accomplish FIRST to help track down the performance issues?
- A. Perform reverse lookups on each of the IP addresses listed to help determine if the traffic necessary.
- B. Recommend that networking block the unneeded protocols such as Quicklime lo clear up some of the congestion
- C. Put ACLs in place to restrict traffic destined for random or non-default application ports
- D. Quarantine the top talker on the network and begin to investigate any potential threats caused by the excessive traffic
Answer: A
NEW QUESTION 4
A pharmacy gives its clients online access to their records and the ability to review bills and make payments. A new SSL vulnerability on a special platform was discovered, allowing an attacker to capture the data between the end user and the web server providing these services. After investigating the platform vulnerability, it was determined that the web services provided are being impacted by this new threat.
Which of the following data types are MOST likely at risk of exposure based on this new threat? (Choose two.)
- A. Cardholder data
- B. Intellectual property
- C. Personal health information
- D. Employee records
- E. Corporate financial data
Answer: AC
NEW QUESTION 5
After an internal audit, it was determined that administrative logins need to use multifactor authentication or a 15-character key with complexity enabled. Which of the following policies should be updates to reflect this change? (Choose two.)
- A. Data ownership policy
- B. Password policy
- C. Data classification policy
- D. Data retention policy
- E. Acceptable use policy
- F. Account management policy
Answer: BF
NEW QUESTION 6
A cybersecurity analyst has several SIEM event logs to review for possible APT activity. The analyst was given several items that include lists of indicators for both IP addresses and domains. Which of the following actions is the BEST approach for the analyst to perform?
- A. Use the IP addresses to search through the event logs.
- B. Analyze the trends of the events while manually reviewing to see if any of the indicators match.
- C. Create an advanced query that includes all of the indicators, and review any of the matches.
- D. Scan for vulnerabilities with exploits known to have been used by an APT.
Answer: B
NEW QUESTION 7
A cybersecurity professional wants to determine if a web server is running on a remote host with the IP address 192.168.1.100. Which of the following can be used to perform this task?
- A. nc 192.168.1.100 -1 80
- B. ps aux 192.168.1.100
- C. nmap 192.168.1.100 –p 80 –A
- D. dig www 192.168.1.100
- E. ping –p 80 192.168.1.100
Answer: C
NEW QUESTION 8
A threat intelligence analyst who works for a financial services firm received this report:
“There has been an effective waterhole campaign residing at www.bankfinancecompsoftware.com. This domain is delivering ransomware. This ransomware variant has been called “LockMaster” by researchers due to its ability to overwrite the MBR, but this term is not a malware signature. Please execute a defensive
operation regarding this attack vector.”
The analyst ran a query and has assessed that this traffic has been seen on the network. Which of the following actions should the analyst do NEXT? (Select TWO).
- A. Advise the firewall engineer to implement a block on the domain
- B. Visit the domain and begin a threat assessment
- C. Produce a threat intelligence message to be disseminated to the company
- D. Advise the security architects to enable full-disk encryption to protect the MBR
- E. Advise the security analysts to add an alert in the SIEM on the string “LockMaster”
- F. Format the MBR as a precaution
Answer: BD
NEW QUESTION 9
A business-critical application is unable to support the requirements in the current password policy because it does not allow the use of special characters. Management does not want to accept the risk of a possible security incident due to weak password standards. Which of the following is an appropriate means to limit the risks related to the application?
- A. A compensating control
- B. Altering the password policy
- C. Creating new account management procedures
- D. Encrypting authentication traffic
Answer: D
NEW QUESTION 10
A computer al a company was used to commit a crime. The system was seized and removed for the further analysis. Which of the following »s the purpose of labeling cables and connections when seeing the computer system?
- A. To capture the system configuration as it was at the time it w3s removed
- B. To maintain the chain of custody
- C. To block any communication with the computer system from attack
- D. To document the model, manufacturer, and type of cables connected
Answer: A
NEW QUESTION 11
A cybersecurity analyst develops a regular expression to find data within traffic that will alarm on a hit.
The SIEM alarms on seeing this data in cleartext between the web server and the database server.
Which of the following types of data would the analyst MOST likely to be concerned with, and to which type of data classification does it belong?
- A. Credit card numbers that are PCI
- B. Social security numbers that are PHI
- C. Credit card numbers that are PII
- D. Social security numbers that are PII
Answer: A
NEW QUESTION 12
A software assurance lab is performing a dynamic assessment on an application by automatically generating and inputting different, random data sets to attempt to cause an error/failure condition. Which of the following software assessment capabilities is the lab performing AND during which phase of the SDLC should this occur? (Select two.)
- A. Fuzzing
- B. Behavior modeling
- C. Static code analysis
- D. Prototyping phase
- E. Requirements phase
- F. Planning phase
Answer: AC
NEW QUESTION 13
The following IDS log was discovered by a company’s cybersecurity analyst:
Which of the following was launched against the company based on the IDS log?
- A. SQL injection attack
- B. Cross-site scripting attack
- C. Buffer overflow attack
- D. Online password crack attack
Answer: C
NEW QUESTION 14
A cyber incident response team finds a vulnerability on a company website that allowed an attacker to inject malicious code into its web application. There have been numerous unsuspecting users visiting the infected page, and the malicious code executed on the victim’s browser has led to stolen cookies, hijacked sessions, malware execution, and bypassed access control. Which of the following exploits is the attacker conducting on the company’s website?
- A. Logic bomb
- B. Rootkit
- C. Privilege escalation
- D. Cross-site scripting
Answer: D
NEW QUESTION 15
A vulnerability scan returned the following results for a web server that hosts multiple wiki sites: Apache-HTTPD-cve-2014-023: Apache HTTPD: mod_cgid denial of service CVE-2014-0231
Due to a flaw found in mog_cgid, a server using mod_cgid to host CGI scripts could be vulnerable to a DoS attack caused by a remote attacker who is exploiting a weakness in non-standard input, causing processes to hang indefinitely.
The security analyst has confirmed the server hosts standard CGI scripts for the wiki sites, does not have mod_cgid installed, is running Apache 2.2.22, and is not behind a WAF. The server is located in the DMZ, and the purpose of the server is to allow customers to add entries into a publicly accessible database.
Which of the following would be the MOST efficient way to address this finding?
- A. Place the server behind a WAF to prevent DoS attacks from occurring.
- B. Document the finding as a false positive.
- C. Upgrade to the newest version of Apache.
- D. Disable the HTTP service and use only HTTPS to access the server.
Answer: B
NEW QUESTION 16
A security analyst is reviewing the following log after enabling key-based authentication.
Given the above information, which of the following steps should be performed NEXT to secure the system?
- A. Disable anonymous SSH logins.
- B. Disable password authentication for SSH.
- C. Disable SSHv1.
- D. Disable remote root SSH logins.
Answer: B
NEW QUESTION 17
An insurance company employs quick-response team drivers that can corporate issued mobile devices with the insurance company's app installed on them Devices are configuration hardened by an MOM and kept up to date. The employees use the app to collect insurance claim into formation and process payments Recently, a number of customers have filed complaints of credit card fraud against the insurance company, Which occurred shortly after their payments were processed via the mobile app. The cyber-incidence response team has been asked investigate. Which of the following is MOST likely the cause? ^
- A. The MDM server Is misconfigured.
- B. The app does not employ TLS.
- C. USB tethering is enabled.
- D. 3G and less secure cellular technologies ate not restricted.
Answer: B
NEW QUESTION 18
A corporation employs a number of small-form-factor workstations and mobile devices, and an incident response team is therefore required to build a forensics kit with tools to support chip-off analysis. Which of the following tools would BEST meet this requirement?
- A. JTAG adapters
- B. Last-level cache readers
- C. Write-blockers
- D. ZIF adapters
Answer: A
Recommend!! Get the Full CS0-001 dumps in VCE and PDF From Simply pass, Welcome to Download: https://www.simply-pass.com/CompTIA-exam/CS0-001-dumps.html (New 242 Q&As Version)
