[Sep 19, 2023] Genuine CS0-001 Exam Dumps Free Demo
Printable & Easy to Use CSA+ CS0-001 Dumps 100% Same Q&A In Your Real Exam
NEW QUESTION # 210
Which of the following tools should an analyst use to scan for web server vulnerabilities?
- A. Quslys
- B. SolarWinds
- C. ArcSight
- D. Wireshark
Answer: A
NEW QUESTION # 211
A security analyst has been asked to remediate a server vulnerability. Once the analyst has located a
patch for the vulnerability, which of the following should happen NEXT?
- A. Rescan to ensure the vulnerability still exists.
- B. Begin the incident response process.
- C. Start the change control process.
- D. Implement continuous monitoring.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
NEW QUESTION # 212
A security analyst determines that several workstations ate reporting traffic usage on port
3389 Al workstations are running the latest OS patches according to patch reporting: The help desk manager reports some use's are getting togged off of these workstations, and network access is running slower than normal The analyst believes a zero-day threat has allowed remote attackers to gain access to the workstakons. Which of the following are the BEST steps to stop the threat without impacting at services? (Select TWO)
- A. Change the pubic lP address since APTs are common.
- B. Disconnect public Internet access and review the logs on the workstations.
- C. Enforce a password change for users on the network.
- D. Route internal traffic through a proxy server.
- E. Configure a group policy to disable RDP access.
- F. Reapply the latest OS patches to workstations.
Answer: A,B
NEW QUESTION # 213
The primary difference in concern between remediating identified vulnerabilities found in general-purpose IT network servers and that of SCADA systems is that:
- A. patch installation on SCADA systems cannot be verified.
- B. SCADA systems cannot be rebooted to have changes to take effect.
- C. change and configuration management processes do not address SCADA systems.
- D. doing so has a greater chance of causing operational impact in SCADA systems.
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION # 214
An analyst has initiated an assessment of an organization's security posture. As a part of this review, the analyst would like to determine how much information about the organization is exposed externally. Which of the following techniques would BEST help the analyst accomplish this goal? (Select two.)
- A. DNS query log reviews
- B. Technical control audits
- C. Banner grabbing
- D. Sourcing social network sites
- E. Internet searches
- F. Intranet portal reviews
- G. Fingerprinting
Answer: D,G
NEW QUESTION # 215
A newly discovered malware has a known behavior of connecting outbound to an external destination on port 27500 for the purpose of exfiltrating data. The following are four snippets taken from running netstat -an on separate Windows workstations:
Based on the above information, which of the following is MOST likely to be exposed to this malware?
- A. Workstation B
- B. Workstation D
- C. Workstation C
- D. Workstation A
Answer: D
NEW QUESTION # 216
A vulnerability analyst needs to identity all systems with unauthorized web servers on the
10 1 1 0/24 network. The analyst uses the following default Nmap scan:
Which of the following would be the result of running the above command?
- A. This scan checks all TCP ports and returns versions
- B. This scan checks all TCP ports
- C. This scan identities unauthorized serves
- D. This scan probes all ports and returns open ones
Answer: A
NEW QUESTION # 217
A technician receives the following security alert from the firewall's automated system:
After reviewing the alert, which of the following is the BEST analysis?
- A. This alert indicates an endpoint may be infected and is potentially contacting a suspect host.
- B. This alert was generated by the SIEM because the user attempted too many invalid login attempts.
- C. This alert indicates a user was attempting to bypass security measures using dynamic DNS.
- D. This alert is a false positive because DNS is a normal network function.
Answer: A
NEW QUESTION # 218
An analyst finds that unpatched servers have undetected vulnerabilities because the vulnerability scanner does not have the latest set of signatures. Management directed the security team to have personnel update the scanners with the latest signatures at least 24 hours before conducting any scans, but the outcome is unchanged. Which of the following is the BEST logical control to address the failure?
- A. Configure a script to automatically update the scanning tool.
- B. Manually validate that the existing update is being performed.
- C. Configure vulnerability scans to run in credentialed mode.
- D. Test vulnerability remediation in a sandbox before deploying.
Answer: A
Explanation:
Explanation/Reference:
NEW QUESTION # 219
A recent audit included a vulnerability scan that found critical patches released GO days prior were not applied to servers in the environment The infrastructure team was able to isolate the issue and determined it was due to a service disabled on the server running the automated patch management application Which of the following would Be the MOST efficient way to avoid similar audit findings in the future?
- A. Create a patch management policy that requires all servers to be patched within 30 days of patch release.
- B. Implement service monitoring to validate that tools are functioning properly.
- C. Implement a manual patch management application package to regain greater control over the process
- D. Set service on the patch management server to automatically run on start-up.
Answer: B
NEW QUESTION # 220
A company has recently launched a new billing invoice website for a few key vendors. The cybersecurity analyst is receiving calls that the website is performing slowly and the pages sometimes time out. The analyst notices the website is receiving millions of requests, causing the service to become unavailable.
Which of the following can be implemented to maintain the availability of the website?
- A. VPN
- B. Whitelisting
- C. Honeypot
- D. MAC filtering
- E. DMZ
Answer: B
Explanation:
Explanation/Reference:
Explanation:
NEW QUESTION # 221
While reviewing firewall logs, a security analyst at a military contractor notices a sharp rise in activity from a foreign domain known to have well-funded groups that specifically target the company's R&D department. Historical data reveals other corporate assets were previously targeted. This evidence MOST likely describes:
- A. DNS harvesting.
- B. an APT.
- C. corporate espionage.
- D. a zero-day exploit.
Answer: B
NEW QUESTION # 222
After running a packet analyzer on the network, a security analyst has noticed the following output:
Which of the following is occurring?
- A. A ping sweep
- B. A service discovery
- C. A network map
- D. A port scan
Answer: D
NEW QUESTION # 223
A cybersecurity analyst is completing an organization's vulnerability report and wants it to reflect assets accurately. Which of the following items should be in the report?
- A. Processor utilization
- B. Organizational governance
- C. Virtual hosts
- D. Asset isolation
- E. Log disposition
Answer: C
NEW QUESTION # 224
During a routine network scan, a security administrator discovered an unidentified service running on a new embedded and unmanaged HVAC controller, which is used to monitor the company's datacenter:
The enterprise monitoring service requires SNMP and SNMPTRAP connectivity to operate.
Which of the following should the security administrator implement to harden the system?
- A. Segment and firewall the controller's network.
- B. Implement SNMPv3 to secure communication.
- C. Disable TCP/UDP ports 161 through 163.
- D. Disable the unidentified service on the controller.
- E. Patch and restart the unknown service.
Answer: E
NEW QUESTION # 225
Weeks before a proposed merger is scheduled for completion, a security analyst has noticed unusual
traffic patterns on a file server that contains financial information. Routine scans are not detecting the
signature of any known exploits or malware. The following entry is seen in the ftp server logs:
tftp -I 10.1.1.1 GET fourthquarterreport.xls
Which of the following is the BEST course of action?
- A. Determine if any credit card information is contained on the server containing the financials.
- B. Implement an ACL on the perimeter firewall to prevent data exfiltration.
- C. Follow the incident response procedure associate with the loss of business critical data.
- D. Continue to monitor the situation using tools to scan for known exploits.
Answer: C
NEW QUESTION # 226
A security analyst Is reviewing the overnight authentication activity and sees the following set of logs from last evening:
Which of the following should the analyst do NEXT?
- A. Fallow up with the Chief Financial Officer (CFO) regarding his login issues
- B. Check lays for activities by the dmeyfair account
- C. Contact Doug Smith lo set up an account in the system.
- D. Ask the help desk to contact Diane Mayfair for a password reset.
Answer: D
NEW QUESTION # 227
A cybersecurity analyst has received an alert that well-known "call home" messages are continuously observed by network sensors at the network boundary. The proxy firewall successfully drops the messages. After determining the alert was a true positive, which of the following represents the MOST likely cause?
- A. Malware is running on a company system.
- B. An insider is trying to exfiltrate information to a remote network.
- C. Attackers are running reconnaissance on company resources.
- D. Commands are attempting to reach a system infected with a botnet trojan.
Answer: D
NEW QUESTION # 228
Following a data compromise, a cybersecurity analyst noticed the following executed query:
SELECT * from Users WHERE name = rick OR 1=1
Which of the following attacks occurred, and which of the following technical security controls would BEST reduce the risk of future impact from this attack? (Select TWO).
- A. Cookie encryption
- B. Character blacklist
- C. Malicious code execution
- D. Parameter validation
- E. XSS attack
- F. SQL injection
Answer: D,F
Explanation:
Explanation/Reference:
Reference https://lwn.net/Articles/177037/
NEW QUESTION # 229
After a recent security breach, it was discovered that a developer had promoted code that had been written
to the production environment as a hotfix to resolve a user navigation issue that was causing issues for
several customers. The code had inadvertently granted administrative privileges to all users, allowing
inappropriate access to sensitive data and reports. Which of the following could have prevented this code
from being released into the production environment?
- A. Cross training
- B. Separation of duties
- C. Automated reporting
- D. Succession planning
Answer: B
NEW QUESTION # 230
During the forensic phase of a security investigation, it was discovered that an attacker was able to find private keys on a poorly secured team shared drive. The attacker used those keys to intercept and decrypt sensitive traffic on a web server. Which of the following describes this type of exploit and the potential remediation?
- A. Session tracking, network intrusion detection sensors
- B. Cross-site scripting; increased encryption key sizes
- C. Rootkit, controlled storage of public keys
- D. Man-in-the-middle; well-controlled storage of private keys
Answer: D
NEW QUESTION # 231
While preparing for a third-party audit, the vice president of risk management and the vice president of information technology have stipulated that the vendor may not use offensive software during the audit.
This is an example of:
- A. organizational control.
- B. risk appetite
- C. rules of engagement.
- D. service-level agreement.
Answer: C
NEW QUESTION # 232
......
CompTIA CySA+ certification validates the knowledge and skills of individuals in the cybersecurity industry, and is recognized by employers and peers as a verification of an individual’s advanced skills in cybersecurity. CS0-001 exam is designed for professionals who possess at least three to four years of experience in IT administration, with a focus on cybersecurity issues. However, candidates who have less experience in cybersecurity can also take the exam and obtain the certification by passing the required exam.
CS0-001 Practice Test Give You First Time Success with 100% Money Back Guarantee!: https://www.itcertmagic.com/CompTIA/real-CS0-001-exam-prep-dumps.html
All Obstacles During CS0-001 Exam Preparation with CS0-001 Real Test Questions: https://drive.google.com/open?id=1EKxLikhjgn3hLY8ctzZWZfTXYUpISE_F