Download Free CompTIA CySA CS0-002 Questions and Answers

1. CS0-002 Free Questions CS0-002 Free Questions CompTIA Cybersecurity Analyst (CySA+) CompTIA Cybersecurity Analyst (CySA+) Certification Exam Certification Exam https://www.passquestion.com/ https://www.passquestion.com/CS0-002 CS0-002.html .html

2. Question 1 Question 1 As part of a merger with another organization, a Chief Information Security Officer As part of a merger with another organization, a Chief Information Security Officer (CISO) is working with an assessor to perform a risk assessment focused on data privacy (CISO) is working with an assessor to perform a risk assessment focused on data privacy compliance. The CISO is primarily concerned with the potential legal liability and fines compliance. The CISO is primarily concerned with the potential legal liability and fines associated with data privacy. associated with data privacy. Based on the CISO's concerns, the assessor will MOST likely focus on: Based on the CISO's concerns, the assessor will MOST likely focus on: A. qualitative probabilities. A. qualitative probabilities. B. quantitative probabilities. B. quantitative probabilities. C. qualitative magnitude. C. qualitative magnitude. D. quantitative magnitude. D. quantitative magnitude. Answer: D Answer: D

3. Question 2 Question 2 An employee in the billing department accidentally sent a spreadsheet containing payment card data An employee in the billing department accidentally sent a spreadsheet containing payment card data to a recipient outside the organization. The employee intended to send the spreadsheet to an internal to a recipient outside the organization. The employee intended to send the spreadsheet to an internal staff member with a similar name and was unaware of the mistake until the recipient replied to the staff member with a similar name and was unaware of the mistake until the recipient replied to the message. message. In addition to retraining the employee, which of the following would prevent this from happening in In addition to retraining the employee, which of the following would prevent this from happening in the future? the future? A. Implement outgoing filter rules to quarantine messages that contain card data A. Implement outgoing filter rules to quarantine messages that contain card data B. Configure the outgoing mail filter to allow attachments only to addresses on the whitelist B. Configure the outgoing mail filter to allow attachments only to addresses on the whitelist C. Remove all external recipients from the employee's address book C. Remove all external recipients from the employee's address book D. Set the outgoing mail filter to strip spreadsheet attachments from all messages. D. Set the outgoing mail filter to strip spreadsheet attachments from all messages. Answer: B Answer: B

4. Question 3 Question 3 A new on-premises application server was recently installed on the network. Remote access to the A new on-premises application server was recently installed on the network. Remote access to the server was enabled for vendor support on required ports, but recent security reports show large server was enabled for vendor support on required ports, but recent security reports show large amounts of data are being sent to various unauthorized networks through those ports. amounts of data are being sent to various unauthorized networks through those ports. Which of the following configuration changes must be implemented to resolve this security issue Which of the following configuration changes must be implemented to resolve this security issue while still allowing remote vendor access? while still allowing remote vendor access? A. Apply a firewall application server rule. A. Apply a firewall application server rule. B. Whitelist the application server. B. Whitelist the application server. C. Sandbox the application server. C. Sandbox the application server. D. Enable port security. D. Enable port security. E. Block the unauthorized networks. E. Block the unauthorized networks. Answer: B Answer: B

5. Question 4 Question 4 A SIEM solution alerts a security analyst of a high number of login attempts against the company's A SIEM solution alerts a security analyst of a high number of login attempts against the company's webmail portal. The analyst determines the login attempts used credentials from a past data breach. webmail portal. The analyst determines the login attempts used credentials from a past data breach. Which of the following is the BEST mitigation to prevent unauthorized access? Which of the following is the BEST mitigation to prevent unauthorized access? A. Single sign-on A. Single sign-on B. Mandatory access control B. Mandatory access control C. Multifactor authentication C. Multifactor authentication D. Federation D. Federation E. Privileged access management E. Privileged access management Answer: C Answer: C

6. Question 5 Question 5 A company’s Chief Information Security Officer (CISO) is concerned about the integrity of some A company’s Chief Information Security Officer (CISO) is concerned about the integrity of some highly confidential files. Any changes to these files must be tied back to a specific authorized user’s highly confidential files. Any changes to these files must be tied back to a specific authorized user’s activity session. activity session. Which of the following is the BEST technique to address the CISO’s concerns? Which of the following is the BEST technique to address the CISO’s concerns? A. Configure DLP to reject all changes to the files without pre-authorization. Monitor the files for A. Configure DLP to reject all changes to the files without pre-authorization. Monitor the files for unauthorized changes. unauthorized changes. B. Regularly use SHA-256 to hash the directory containing the sensitive information. B. Regularly use SHA-256 to hash the directory containing the sensitive information. Monitor the files for unauthorized changes. Monitor the files for unauthorized changes. C. Place a legal hold on the files. Require authorized users to abide by a strict time context access C. Place a legal hold on the files. Require authorized users to abide by a strict time context access policy. policy. Monitor the files for unauthorized changes. Monitor the files for unauthorized changes. D. Use Wireshark to scan all traffic to and from the directory. Monitor the files for unauthorized D. Use Wireshark to scan all traffic to and from the directory. Monitor the files for unauthorized changes. changes. Answer: A,C Answer: A,C

7. Question 6 Question 6 A security analyst needs to perform a search for connections with a suspicious IP on the network A security analyst needs to perform a search for connections with a suspicious IP on the network traffic. The company collects full packet captures at the Internet gateway and retains them for one traffic. The company collects full packet captures at the Internet gateway and retains them for one week. week. Which of the following will enable the analyst to obtain the BEST results? Which of the following will enable the analyst to obtain the BEST results? A. grep -a <suspicious ip> internet.pcap A. grep -a <suspicious ip> internet.pcap B. tcpdump-n-rinternet.pcaphost<suspicious ip> B. tcpdump-n-rinternet.pcaphost<suspicious ip> C. strings internet.pcap | grep <suspicious ip> C. strings internet.pcap | grep <suspicious ip> D. npcapd internet.pcap | grep <suspicious ip> D. npcapd internet.pcap | grep <suspicious ip> Answer: B Answer: B

8. Question 7 Question 7 A security analyst received a series of antivirus alerts from a workstation segment, and users reported A security analyst received a series of antivirus alerts from a workstation segment, and users reported ransomware messages. During lessons- learned activities, the analyst determines the antivirus was able ransomware messages. During lessons- learned activities, the analyst determines the antivirus was able to alert to abnormal behavior but did not stop this newest variant of ransomware. to alert to abnormal behavior but did not stop this newest variant of ransomware. Which of the following actions should be taken to BEST mitigate the effects of this type of threat in Which of the following actions should be taken to BEST mitigate the effects of this type of threat in the future? the future? A. Enabling application blacklisting A. Enabling application blacklisting B. Enabling sandboxing technology B. Enabling sandboxing technology C. Purchasing cyber insurance C. Purchasing cyber insurance D. Installing a firewall between the workstations and Internet D. Installing a firewall between the workstations and Internet Answer: B Answer: B

9. Question 8 Question 8 A Chief Security Officer (CSO) is working on the communication requirements (or an organization's A Chief Security Officer (CSO) is working on the communication requirements (or an organization's incident response plan. incident response plan. In addition to technical response activities, which of the following is the main reason why In addition to technical response activities, which of the following is the main reason why communication must be addressed in an effective incident response program? communication must be addressed in an effective incident response program? A. Public relations must receive information promptly in order to notify the community. A. Public relations must receive information promptly in order to notify the community. B. Improper communications can create unnecessary complexity and delay response actions. B. Improper communications can create unnecessary complexity and delay response actions. C. Organizational personnel must only interact with trusted members of the law enforcement C. Organizational personnel must only interact with trusted members of the law enforcement community. community. D. Senior leadership should act as the only voice for the incident response team when working with D. Senior leadership should act as the only voice for the incident response team when working with forensics teams. forensics teams. Answer: B Answer: B

10. Question 9 Question 9 A security analyst reviews SIEM logs and detects a well-known malicious executable running in a A security analyst reviews SIEM logs and detects a well-known malicious executable running in a Windows machine. The up-to-date antivirus cannot detect the malicious executable. Windows machine. The up-to-date antivirus cannot detect the malicious executable. Which of the following is the MOST likely cause of this issue? Which of the following is the MOST likely cause of this issue? A. The malware is being executed with administrative privileges. A. The malware is being executed with administrative privileges. B. The antivirus does not have the mltware's signature. B. The antivirus does not have the mltware's signature. C. The malware detects and prevents its own execution in a virtual environment. C. The malware detects and prevents its own execution in a virtual environment. D. The malware is fileless and exists only in physical memory. D. The malware is fileless and exists only in physical memory. Answer: D Answer: D

11. Question 10 Question 10 A company wants to establish a threat-hunting team. A company wants to establish a threat-hunting team. Which of the following BEST describes the rationale for integration intelligence into hunt operations? Which of the following BEST describes the rationale for integration intelligence into hunt operations? A. It enables the team to prioritize the focus area and tactics within the company’s environment. A. It enables the team to prioritize the focus area and tactics within the company’s environment. B. It provide critically analyses for key enterprise servers and services. B. It provide critically analyses for key enterprise servers and services. C. It allow analysis to receive updates on newly discovered software vulnerabilities. C. It allow analysis to receive updates on newly discovered software vulnerabilities. D. It supports rapid response and recovery during and followed an incident. D. It supports rapid response and recovery during and followed an incident. Answer: A Answer: A