CS0-002 sample questions

Question 1

A cyber-incident response analyst is investigating a suspected cryptocurrency miner on a company's server. Which of the following is the FIRST step the analyst should take?

Accepted Answer

Start packet capturing to look for traffic that could be indicative of command and control from the miner.

Answer

Create a full disk image of the server's hard drive to look for the file containing the malware.

Answer

Run a manual antivirus scan on the machine to look for known malicious software.

Answer

Take a memory snapshot of the machine to capture volatile information stored in memory.

Question 2

An information security analyst is compiling data from a recent penetration test and reviews the following output:
The analyst wants to obtain more information about the web-based services that are running on the target.

Which of the following commands would MOST likely provide the needed information?

Accepted Answer

tracert 10.79.95.173

Answer

ping -t 10.79.95.173.rdns.datacenters.com

Answer

telnet 10.79.95.173 443

Answer

ftpd 10.79.95.173.rdns.datacenters.com 443

Question 3

A compliance officer of a large organization has reviewed the firm's vendor management program but has discovered there are no controls defined to evaluate third-party risk or hardware source authenticity. The compliance officer wants to gain some level of assurance on a recurring basis regarding the implementation of controls by third parties.

Which of the following would BEST satisfy the objectives defined by the compliance officer? (Choose two.)

Accepted Answer

Executing vendor compliance assessments against the organization's security controls

Accepted Answer

Completing a business impact assessment for all critical service providers

Answer

Executing NDAs prior to sharing critical data with third parties

Answer

Soliciting third-party audit reports on an annual basis

Answer

Maintaining and reviewing the organizational risk assessment on a quarterly basis

Answer

Utilizing DLP capabilities at both the endpoint and perimeter levels

Question 4

An analyst is performing penetration testing and vulnerability assessment activities against a new vehicle automation platform.

Which of the following is MOST likely an attack vector that is being utilized as part of the testing and assessment?

Accepted Answer

RTOS

Answer

FaaS

Answer

SoC

Answer

GPS

Answer

CAN bus

Question 5

An information security analyst observes anomalous behavior on the SCADA devices in a power plant. This behavior results in the industrial generators overheating and destabilizing the power supply.

Which of the following would BEST identify potential indicators of compromise?

Accepted Answer

Use Wireshark to capture packets between SCADA devices and the management system.

Answer

Use Burp Suite to capture packets to the SCADA device's IP.

Answer

Use tcpdump to capture packets from the SCADA device IP.

Answer

Use Nmap to capture packets from the management system to the SCADA devices.

Question 6

Which of the following would MOST likely be included in the incident response procedure after a security breach of customer PII?

Accepted Answer

Public relations

Answer

Human resources

Answer

Marketing

Answer

Internal network operations center

CS0-002 Cybersecurity Analyst (CySA+ v2) Practice Questions

Unlock the full exam and previous versions

Create an account to continue.

Create an account to continue.

Related exams