CS0-002 Online Practice Questions and Answers

A company was recently awarded several large government contracts and wants to determine its current risk from one specific APT. Which of the following threat modeling methodologies would be the MOST appropriate to use during this analysis?

A. Attack vectors

B. Adversary capability

C. Diamond Model of Intrusion Analysis

D. Kill chain

E. Total attack surface

A code review reveals a web application is using lime-based cookies for session management. This is a security concern because lime-based cookies are easy to:

A. parameterize.

B. decode.

C. guess.

D. decrypt.

Which of the following is a reason to take a DevSecOps approach to a software assurance program?

A. To find and fix security vulnerabilities earlier in the development process

B. To speed up user acceptance testing in order to deliver the code to production faster

C. To separate continuous integration from continuous development in the SDLC

D. To increase the number of security-related bug fixes worked on by developers

Industry partners from critical infrastructure organizations were victims of attacks on their SCADA devices. The attacker was able to gain access to the SCADA by logging in to an account with weak credentials. Which of the following identity and access management solutions would help to mitigate this risk?

A. Multifactor authentication

B. Manual access reviews

C. Endpoint detection and response

D. Role-based access control

A security analyst is deploying a new application in the environment. The application needs to be integrated with several existing applications that contain SPI Pnor to the deployment, the analyst should conduct:

A. a tabletop exercise

B. a business impact analysis

C. a PCI assessment

D. an application stress test.

After reviewing the following packet, a cybersecurity analyst has discovered an unauthorized service is running on a company's computer.

Which of the following ACLs, if implemented, will prevent further access ONLY to the unauthorized service and will not impact other services?

A. DENY TCP ANY HOST 10.38.219.20 EQ 3389

B. DENY IP HOST 10.38.219.20 ANY EQ 25

C. DENY IP HOST192.168.1.10 HOST 10.38.219.20 EQ 3389

D. DENY TCP ANY HOST 192.168.1.10 EQ 25

A red team actor observes it is common practice to allow cell phones to charge on company computers, but access to the memory storage is blocked. Which of the following are common attack techniques that take advantage of this practice? (Choose two.)

A. A USB attack that tricks the computer into thinking the connected device is a keyboard, and then sends characters one at a time as a keyboard to launch the attack (a prerecorded series of keystrokes)

B. A USB attack that turns the connected device into a rogue access point that spoofs the configured wireless SSIDs

C. A Bluetooth attack that modifies the device registry (Windows PCs only) to allow the flash drive to mount, and then launches a Java applet attack

D. A Bluetooth peering attack called "Snarfing" that allows Bluetooth connections on blocked device types if physically connected to a USB port

E. A USB attack that tricks the system into thinking it is a network adapter, then runs a user password hash gathering utility for offline password cracking

Company A suspects an employee has been exfiltrating PII via a USB thumb drive. An analyst is tasked with attempting to locate the information on the drive. The PII in question includes the following:

Which of the following would BEST accomplish the task assigned to the analyst?

A. 3 [0-9]\d-2[0-9]\d-4[0-9]\d

B. \d(3)-d(2)-\d(4)

C. ?[3]-?[2]-?[3]

D. \d[9] `XXX-XX-XX'

A security analyst is assisting with a computer crime investigation and has been asked to secure a PC and deliver it to the forensic lab. Which of the following items would be MOST helpful to secure the PC? (Choose three.)

A. Tamper-proof seals

B. Faraday cage

C. Chain of custody form

D. Drive eraser

E. Write blockers

F. Network tap

G. Multimeter

A security analyst is reviewing the following requirements (or new time clocks that will be installed in a shipping warehouse:

1.

The clocks must be configured so they do not respond to ARP broadcasts.

2.

The server must be configured with static ARP entries for each clock.

Which of the following types of attacks will this configuration mitigate?

A. Spoofing

B. Overflows

C. Rootkits

D. Sniffing