2024 Updated CS0-001 PDF for the CS0-001 Tests Free Updated Today!
Fully Updated Dumps PDF - Latest CS0-001 Exam Questions and Answers
CompTIA CS0-001 exam consists of 85 multiple-choice and performance-based questions that must be completed within a time limit of 165 minutes. CS0-001 exam is computer-based and is administered at Pearson VUE testing centers located worldwide. CS0-001 exam is intended for individuals with at least four years of experience in information security or related fields, and it is recommended that candidates have completed the CompTIA Security+ certification or have equivalent knowledge and skills.
NEW QUESTION # 211
File integrity monitoring states the following files have been changed without a written request or approved change. The following change has been made:
chmod 777 -Rv /usr
Which of the following may be occurring?
- A. Administrative functions have been locked from users.
- B. The ownership pf /usr has been changed to the current user.
- C. Administrative commands have been made world readable/writable.
- D. The ownership of/usr has been changed to the root user.
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION # 212
A cybersecurity analyst is conducting a security test to ensure that information regarding the web server is protected from disclosure. The cybersecurity analyst requested an HTML file from the web server, and the response came back as follows:
Which of the following actions should be taken to remediate this security issue?
- A. Set "Removeserverheader" to 1 in the URLScan.ini configuration file.
- B. Set "Enablelogging" to 0 in the URLScan.ini configuration file.
- C. Set "Perprocesslogging" to 1 in the URLScan.ini configuration file.
- D. Set "Allowlatescanning" to 1 in the URLScan.ini configuration file.
Answer: A,B,C,D
NEW QUESTION # 213
A security analyst is reviewing packet captures for a specific server that is suspected of containing malware and discovers the following packets:
Which of the following traffic patterns or data would be MOST concerning to the security analyst?
- A. Anonymous access granted by 103.34.243.12
- B. Ports used for HTTP traffic from 202.53.245.78
- C. Port used for SMTP traffic from 73.252.34.101
- D. Unencrypted password sent from 103.34.243.12
Answer: A
NEW QUESTION # 214
A cybersecurity analyst is conducting packet analysis on the following:
Which of the following Is occurring in the given packet?
- A. IP spoofing
- B. Ping reply
- C. MAC filtering
- D. ARP reply
- E. ARP request
- F. Ping request
Answer: E
NEW QUESTION # 215
A company wants to update its acceptable use policy (AUP) to ensure it relates to the newly implemented password standard, which requires sponsored authentication of guest wireless devices.
Which of the following is MOST likely to be incorporated in the AUP?
- A. Guests using the wireless network should provide valid identification when registering their wireless devices.
- B. The corporate network should have a wireless infrastructure that uses open authentication standards.
- C. Sponsored guest passwords must be at least ten characters in length and contain a symbol.
- D. The network should authenticate all guest users using 802.1x backed by a RADIUS or LDAP server.
Answer: A
NEW QUESTION # 216
Various devices are connecting and authenticating to a single evil twin within the network. Which of the following are MOST likely being targeted?
- A. Wired SCADA devices
- B. VPNs
- C. All endpoints
- D. Network infrastructure
- E. Mobile devices
Answer: E
Explanation:
Explanation/Reference: http://www.corecom.com/external/livesecurity/eviltwin1.htm
NEW QUESTION # 217
A security analyst performs various types of vulnerability scans.
Review the vulnerability scan results to determine the type of scan that was executed and if a false positive occurred for each device.
Instructions:
Select the Results Generated drop-down option to determine if the results were generated from a credentialed scan, non-credentialed scan, or a compliance scan.
For ONLY the credentialed and non-credentialed scans, evaluate the results for false positives and check the findings that display false positives. NOTE: If you would like to uncheck an option that is currently selected, click on the option a second time.
Lastly, based on the vulnerability scan results, identify the type of Server by dragging the Server to the results.
The Linux Web Server, File-Print Server and Directory Server are draggable.
If at any time you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
- A. 1. non-credentialed scan- File Print Server: False positive is first bullet point.
2. credentialed scan - Linux Web
3. Compliance scan- Directory Server - B. 1. non-credentialed scan- File Print Server: False positive is first bullet point.
2. credentialed scan - Linux Web Server: No False positives.
3. Compliance scan- Directory Server
Answer: B
NEW QUESTION # 218
A cybersecurity analyst is retained by a firm for an open investigation. Upon arrival, the cybersecurity analyst reviews several security logs.
Given the following snippet of code:
Which of the following combinations BEST describes the situation and recommendations to be made for this situation?
- A. The cybersecurity analyst has discovered host 192.168.0.101 is beaconing every day at 13:30 using thenc.exe file; recommend proceeding with the next step of removing the host from the network.
- B. The security analyst has discovered host 192.168.0.101 is a rogue device on the network, recommend proceeding with the next step of removing the host from the network.
- C. The cybersecurity analyst has discovered host 192.168.0.101 using Windows Task Scheduler at 13:30 to runnc.exe; recommend proceeding with the next step of removing the host from the network.
- D. The cybersecurity analyst has discovered host 192.168.0.101 to be running thenc.exe file at 13:30 using the auto cron job remotely, there are no recommendations since this is not a threat currently.
Answer: C
Explanation:
Section: (none)
Explanation/Reference:
Explanation:
NEW QUESTION # 219
An organization has two environments: development and production. Development is where applications are developed with unit testing. The development environment has many configuration differences from the production environment. All applications are hosted on virtual machines. Vulnerability scans are performed against all systems before and after any application or configuration changes to any environment. Lately, vulnerability remediation activity has caused production applications to crash and behave unpredictably. Which of the following changes should be made to the current vulnerability management process?
- A. Refine testing in the production environment to include more exhaustive application stability testing while continuing to maintain the robust vulnerability remediation activities
- B. Create a third environment between development and production that mirrors production and tests all changes before deployment to the users
- C. Refine testing in the development environment to include fuzzing and user acceptance testing so applications are more stable before they migrate to production
- D. Create a second production environment by cloning the virtual machines, and if any stability problems occur, migrate users to the alternate production environment
Answer: B
NEW QUESTION # 220
A cybersecurity analyst is conducting a security test to ensure that information regarding the web server is protected from disclosure. The cybersecurity analyst requested an HTML file from the web server, and the response came back as follows:
Which of the following actions should be taken to remediate this security issue?
- A. Set "Removeserverheader" to 1 in the URLScan.ini configuration file.
- B. Set "Allowlatescanning" to 1 in the URLScan.ini configuration file.
- C. Set "Perprocesslogging" to 1 in the URLScan.ini configuration file.
- D. Set "Enablelogging" to 0 in the URLScan.ini configuration file.
Answer: A
NEW QUESTION # 221
A security analyst has performed various scans and found vulnerabilities in several applications that affect production data. Remediation of all exploits may cause certain applications to no longer work. Which of the following activities would need to be conducted BEFORE remediation?
- A. Input validation
- B. Sandboxing
- C. Fuzzing
- D. Change control
Answer: D
NEW QUESTION # 222
Employees at a manufacturing plant have been victims of spear phishing, but security solutions prevented further intrusions into the network. Which of the following is the MOST appropriate solution in this scenario?
- A. Update antivirus and malware definitions
- B. Continue to monitor security devices
- C. Provide security awareness training
- D. Migrate email services to a hosted environment
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION # 223
A software patch has been released to remove vulnerabilities from company's software. A security analyst has been tasked with testing the software to ensure the vulnerabilities have been remediated and the application is still functioning properly. Which of the following tests should be performed NEXT?
- A. Penetration testing
- B. Regression testing
- C. User acceptance testing
- D. Fuzzing
Answer: B
Explanation:
Explanation: References:
NEW QUESTION # 224
A security analyst is performing a review of Active Directory and discovers two new user accounts in the accounting department. Neither of the users has elevated permissions, but accounts in the group are given access to the company's sensitive financial management application by default. Which of the following is the BEST course of action?
- A. Follow the incident response plan for the introduction of new accounts
- B. Disable the user accounts
- C. Monitor the outbound traffic from the application for signs of data exfiltration
- D. Remove the accounts' access privileges to the sensitive application
- E. Confirm the accounts are valid and ensure role-based permissions are appropriate
Answer: E
NEW QUESTION # 225
A threat intelligence analyst who works for a financial services firm received this report:
"There has been an effective waterhole campaign residing at
www.bankfinancecompsoftware.com. This domain is delivering ransomware. This ransomware variant has been called "LockMaster" by researchers due to its ability to overwrite the MBR, but this term is not a malware signature. Please execute a defensive operation regarding this attack vector." The analyst ran a query and has assessed that this traffic has been seen on the network.
Which of the following actions should the analyst do NEXT? (Select TWO).
- A. Advise the security analysts to add an alert in the SIEM on the string "LockMaster"
- B. Produce a threat intelligence message to be disseminated to the company
- C. Advise the firewall engineer to implement a block on the domain
- D. Format the MBR as a precaution
- E. Visit the domain and begin a threat assessment
- F. Advise the security architects to enable full-disk encryption to protect the MBR
Answer: E,F
NEW QUESTION # 226
On which of the following organizational resources is the lack of an enabled password or PIN a common vulnerability?
- A. VDI systems
- B. VoIP phones
- C. VPNs
- D. Mobile devices
- E. Enterprise server Oss
Answer: D
NEW QUESTION # 227
......
Free CS0-001 Exam Questions CS0-001 Actual Free Exam Questions: https://www.lead1pass.com/CompTIA/CS0-001-practice-exam-dumps.html
100% Free CS0-001 Exam Dumps to Pass Exam Easily: https://drive.google.com/open?id=1xq2EYTtHg9t1X83sRX1LdlvnobLhtqp8