CompTIA CS0-002 Exam Practice Questions (P. 1)
- Full Access (422 questions)
- Six months of Premium Access
- Access to one million comments
- Seamless ChatGPT Integration
- Ability to download PDF files
- Anki Flashcard files for revision
- No Captcha & No AdSense
- Advanced Exam Configuration
Question #1
Which of the following is the software development process by which function, usability, and scenarios are tested against a known set of base requirements?
- ASecurity regression testing
- BCode review
- CUser acceptance testingMost Voted
- DStress testing
Correct Answer:
D
D

Stress testing, as depicted by the correct choice 'D', is a crucial method in software development to check if the application performs well under intense or abnormal workloads. This process aims to evaluate the robustness and stability of the software when subjected to conditions beyond typical operational capacity. It ensures that software can handle high traffic and data processing demands, maintaining functionality during critical times without collapsing under stress. It’s a vital step for verifying software infrastructure's resilience before it goes live, which aligns seamlessly with the definition of testing against a known set of requirements under demanding scenarios.
send
light_mode
delete
Question #2
A security analyst discovers the following firewall log entries during an incident:

Which of the following is MOST likely occurring?

Which of the following is MOST likely occurring?
- ABanner grabbing
- BPort scanningMost Voted
- CBeaconing
- DData exfiltration
Correct Answer:
C
C
send
light_mode
delete
Question #3
A security analyst is revising a company's MFA policy to prohibit the use of short message service (SMS) tokens. The Chief Information Officer has questioned this decision and asked for justification. Which of the following should the analyst provide as justification for the new policy?
- ASMS relies on untrusted, third-party carrier networks.
- BSMS tokens are limited to eight numerical characters.
- CSMS is not supported on all handheld devices in use.
- DSMS is a cleartext protocol and does not support encryption.Most Voted
Correct Answer:
D
D

It’s essential to recognize that SMS as a method in multi-factor authentication (MFA) can be less secure primarily due to its transmission in plaintext. This characteristic of SMS makes it susceptible to eavesdropping and man-in-the-middle (MITM) attacks, since adversaries can intercept these messages and gain unauthorized access to secure systems. Thus, shifting away from SMS tokens toward more secure methods can substantially enhance an organization's security posture. This justification aligns with contemporary best practices in cybersecurity, advocating for more secure and encrypted alternatives.
send
light_mode
delete
Question #4
During an incident response procedure, a security analyst collects a hard drive to analyze a possible vector of compromise. There is a Linux swap partition on the hard drive that needs to be checked. Which of the following should the analyst use to extract human-readable content from the partition?
- AstringsMost Voted
- Bhead
- Cfsstat
- Ddd
Correct Answer:
D
D

The correct tool to extract human-readable content from a Linux swap partition is indeed the 'strings' utility. This command scans the partition looking for sequences of printable characters, which are typically more interpretable for analysis purposes. Such sequences can provide insights into what was stored in RAM, potentially including sensitive or operational data, highlighting its utility in digital forensic investigations. Therefore, while 'dd' is fundamental for creating a complete image of the disk for a secure analysis, 'strings' is directly used for human-readable data extraction from such images.
send
light_mode
delete
Question #5
A consultant is evaluating multiple threat intelligence feeds to assess potential risks for a client. Which of the following is the BEST approach for the consultant to consider when modeling the client's attack surface?
- AAsk for external scans from industry peers, look at the open ports, and compare information with the client.
- BDiscuss potential tools the client can purchase to reduce the likelihood of an attack.
- CLook at attacks against similar industry peers and assess the probability of the same attacks happening.Most Voted
- DMeet with the senior management team to determine if funding is available for recommended solutions.
Correct Answer:
A
A

While some users argue that asking for external scans from industry peers is implausible, this approach, when executed correctly with mutual agreements and confidentiality in place, can indeed provide valuable insights. It allows the consultant to understand exposed vulnerabilities in similar setups and apply this intelligence to protect the client. This method is particularly effective in industries where companies share common threats and can agree on collaborative security measures to benefit the broader sector. Therefore, assessing external scans from peers emerges as a practical strategy in the context of modeling a client's attack surface.
send
light_mode
delete
Question #6
SIMULATION -
You are a penetration tester who is reviewing the system hardening guidelines for a company's distribution center. The company's hardening guidelines indicate the following:
✑ There must be one primary server or service per device.
✑ Only default ports should be used.
✑ Non-secure protocols should be disabled.
✑ The corporate Internet presence should be placed in a protected subnet.
INSTRUCTIONS -
Using the tools available, discover devices on the corporate network and the services that are running on these devices.
You must determine:
✑ The IP address of each device.
✑ The primary server or service of each device.
✑ The protocols that should be disabled based on the hardening guidelines.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.


You are a penetration tester who is reviewing the system hardening guidelines for a company's distribution center. The company's hardening guidelines indicate the following:
✑ There must be one primary server or service per device.
✑ Only default ports should be used.
✑ Non-secure protocols should be disabled.
✑ The corporate Internet presence should be placed in a protected subnet.
INSTRUCTIONS -
Using the tools available, discover devices on the corporate network and the services that are running on these devices.
You must determine:
✑ The IP address of each device.
✑ The primary server or service of each device.
✑ The protocols that should be disabled based on the hardening guidelines.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.


send
light_mode
delete
Question #7
A development team has asked users to conduct testing to ensure an application meets the needs of the business. Which of the following types of testing does this describe?
- AAcceptance testingMost Voted
- BStress testing
- CRegression testing
- DPenetration testing
Correct Answer:
A
A

When development teams involve actual users to test and verify that an application aligns effectively with business needs, this process is termed as acceptance testing. This is because the primary goal here is to ascertain that the application is ready and satisfactory for its intended use, focusing mainly on the users' perspective and real-world usability rather than technical compliance or debugging. Incorporating user feedback at this stage is crucial for the success of the software in meeting its intended purposes.
send
light_mode
delete
Question #8
An analyst receives artifacts from a recent intrusion and is able to pull a domain, IP address, email address, and software version. Which of the following points of the Diamond Model of Intrusion Analysis does this intelligence represent?
- AInfrastructureMost Voted
- BCapabilities
- CAdversary
- DVictims
Correct Answer:
C
C

The provided artifacts, namely a domain, IP address, email address, and software version, actually align more with the "Infrastructure" component of the Diamond Model of Intrusion Analysis. This model segmentizes artifacts based on their usage by adversaries, not just the identity or tactics of the adversaries themselves. The confusion arises partly from a common misunderstanding of the distinction between information typifying the "Adversary" versus their operational tools or "Infrastructure." Thus, taking the artifacts' operational nature into account, "Infrastructure" would be the most accurate classification.
send
light_mode
delete
Question #9
While conducting a network infrastructure review, a security analyst discovers a laptop that is plugged into a core switch and hidden behind a desk. The analyst sees the following on the laptop's screen:
[*] [NBT-NS] Poisoned answer sent to 192.169.23.115 for name FILE-SHARE-A (service: File Server)
[*] [LLMNR] Poisoned answer sent to 192.168.23.115 for name FILE-SHARE-A
[*] [LLMNR] Poisoned answer sent to 192.168.23.115 for name FILE-SHARE-A
[SMBv2] NTLMv2-SSP Client : 192.168.23.115
[SMBv2] NTLMv2-SSP Username : CORP\jsmith
[SMBv2] NTLMv2-SSP Hash : F5DBF769CFEA7...
[*] [NBT-NS] Poisoned answer sent to 192.169.23.24 for name FILE-SHARE-A (service: File Server)
[*] [LLMNR] Poisoned answer sent to 192.168.23.24 for name FILE-SHARE-A
[*] [LLMNR] Poisoned answer sent to 192.168.23.24 for name FILE-SHARE-A
[SMBv2] NTLMv2-SSP Client : 192.168.23.24
[SMBv2] NTLMv2-SSP Username : CORP\progers
[SMBv2] NTLMv2-SSP Hash : 6D093BE2FDD70A...
Which of the following is the BEST action for the security analyst to take?
[*] [NBT-NS] Poisoned answer sent to 192.169.23.115 for name FILE-SHARE-A (service: File Server)
[*] [LLMNR] Poisoned answer sent to 192.168.23.115 for name FILE-SHARE-A
[*] [LLMNR] Poisoned answer sent to 192.168.23.115 for name FILE-SHARE-A
[SMBv2] NTLMv2-SSP Client : 192.168.23.115
[SMBv2] NTLMv2-SSP Username : CORP\jsmith
[SMBv2] NTLMv2-SSP Hash : F5DBF769CFEA7...
[*] [NBT-NS] Poisoned answer sent to 192.169.23.24 for name FILE-SHARE-A (service: File Server)
[*] [LLMNR] Poisoned answer sent to 192.168.23.24 for name FILE-SHARE-A
[*] [LLMNR] Poisoned answer sent to 192.168.23.24 for name FILE-SHARE-A
[SMBv2] NTLMv2-SSP Client : 192.168.23.24
[SMBv2] NTLMv2-SSP Username : CORP\progers
[SMBv2] NTLMv2-SSP Hash : 6D093BE2FDD70A...
Which of the following is the BEST action for the security analyst to take?
- AForce all users in the domain to change their passwords at the next login.
- BDisconnect the laptop and ask the users jsmith and progers to log out.Most Voted
- CTake the FILE-SHARE-A server offline and scan it for viruses.
- DInitiate a scan of devices on the network to find password-cracking tools.
Correct Answer:
C
C

When encountering malicious devices on the network, specifically ones involved in spoofing network communication protocols like NBT-NS and LLMNR, immediate isolation is crucial. The discovered laptop is performing a man-in-the-middle attack to intercept and manipulate network traffic, leading to credential theft, evidenced by the acquisition of NTLMv2-SSP hashes. Therefore, swiftly disconnecting the laptop halts further data compromise and prevents the attacker from leveraging stolen credentials, subsequently reducing the immediate threat to network security. Immediate action, focusing on containment, helps mitigate potential damage while further investigation and remediation can be planned.
send
light_mode
delete
Question #10
A Chief Executive Officer (CEO) is concerned the company will be exposed to data sovereignty issues as a result of some new privacy regulations. To help mitigate this risk, the Chief Information Security Officer (CISO) wants to implement an appropriate technical control. Which of the following would meet the requirement?
- AData masking procedures
- BEnhanced encryption functions
- CRegular business impact analysis functions
- DGeographic access requirementsMost Voted
Correct Answer:
B
B

Enhanced encryption functions are a robust technical control in addressing data sovereignty issues related to new privacy regulations. Encryption secures data at rest and in transit, ensuring that it remains protected and compliant with differing regional laws, even if physically stored in another country. This method supports confidentiality and can serve as an effective tool to mitigate potential legal and privacy risks across jurisdictions. Thus, implementing enhanced encryption can assist in aligning with global data protection standards while maintaining the security and sovereignty of the data.
send
light_mode
delete
All Pages