CS0-002 Online Practice Questions and Answers

A finance department employee has received a message that appears to have been sent from the Chief Financial Officer (CFO) asking the employee to perform a wife transfer Analysis of the email shows the message came from an external source and is fraudulent. Which of the following would work BEST to improve the likelihood of employees quickly recognizing fraudulent emails?

A. Implementing a sandboxing solution for viewing emails and attachments

B. Limiting email from the finance department to recipients on a pre-approved whitelist

C. Configuring email client settings to display all messages in plaintext when read

D. Adding a banner to incoming messages that identifies the messages as external

A routine vulnerability scan detected a known vulnerability in a critical enterprise web application. Which of the following would be the BEST next step?

A. Submit a change request to have the system patched

B. Evaluate the risk and criticality to determine it further action is necessary

C. Notify a manager of the breach and initiate emergency procedures.

D. Remove the application from production and Inform the users.

A security analyst is researching ways to improve the security of a company's email system to mitigate emails that are impersonating company executives. Which of the following would be BEST for the analyst to configure to achieve this objective?

A. A TXT record on the name server for SPF

B. DNSSEC keys to secure replication

C. Domain Keys identified Man

D. A sandbox to check incoming mad

An analyst is reviewing the following output as part of an incident: Which of the Wowing is MOST likely happening?

A. The hosts are part of a reflective denial -of -service attack.

B. Information is leaking from the memory of host 10.20 30.40

C. Sensitive data is being exfilltrated by host 192.168.1.10.

D. Host 291.168.1.10 is performing firewall port knocking.

A security analyst is reviewing the following log after enabling key-based authentication.

Given the above information, which of the following steps should be performed NEXT to secure the system?

A. Disable anonymous SSH logins.

B. Disable password authentication for SSH.

C. Disable SSHv1.

D. Disable remote root SSH logins.

A project lead is reviewing the statement of work for an upcoming project that is focused on identifying potential weaknesses in the organization's internal and external network infrastructure. As part of the project, a team of external

contractors will attempt to employ various attacks against the organization. The statement of work specifically addresses the utilization of an automated tool to probe network resources in an attempt to develop logical diagrams indication

weaknesses in the infrastructure.

The scope of activity as described in the statement of work is an example of:

A. session hijacking

B. vulnerability scanning

C. social engineering

D. penetration testing

E. friendly DoS

The Chief Executive Officer (CEO) instructed the new Chief Information Security Officer (CISO) to provide a list of enhancement to the company's cybersecurity operation. As a result, the CISO has identified the need to align security operations with industry best practices. Which of the following industry references is appropriate to accomplish this?

A. OSSIM

B. NIST

C. PCI

D. OWASP

Joe, a user, is unable to launch an application on his laptop, which he typically uses on a daily basis. Joe informs a security analyst of the issue. After an online database comparison, the security analyst checks the SIEM and notices alerts indicating certain .txt and .dll files are blocked. Which of the following tools would generate these logs?

A. Antivirus

B. HIPS

C. Firewall

D. Proxy

A Chief Information Security Officer (CISO) needs to ensure that a laptop image remains unchanged and can be verified before authorizing the deployment of the image to 4000 laptops. Which of the following tools would be appropriate to use in this case?

A. MSBA

B. SHA1sum

C. FIM

D. DLP

A financial institution's business unit plans to deploy a new technology in a manner that violates existing information security standards. Which of the following actions should the Chief Information Security Officer (CISO) take to manage any type of violation?

A. Enforce the existing security standards and controls

B. Perform a risk analysis and qualify the risk with legal

C. Perform research and propose a better technology

D. Enforce the standard permits