Pass CS0-002 Exam Latest Practice Questions Updated on Nov 16, 2025
CompTIA CS0-002 Study Guide Archives
NEW QUESTION # 99
During a routine log review, a security analyst has found the following commands that cannot be identified from the Bash history log on the root user.
Which of the following commands should the analyst investigate FIRST?
- A. Line 5
- B. Line 1
- C. Line 4
- D. Line 3
- E. Line 6
- F. Line 2
Answer: F
NEW QUESTION # 100
An online gaming company was impacted by a ransomware attack. An employee opened an attachment that was received via an SMS attack on a company-issued mobile device while connected to the network. Which of the following actions would help during the forensic analysis of the mobile device? (Select TWO).
- A. Performing a memory dump of the mobile device for analysis
- B. Uninstalling any potentially unwanted programs
- C. Unlocking the device by browsing the eFuse
- D. Rebooting the phone and installing the latest security updates
- E. Documenting the respective chain of custody
- F. Resetting the phone to factory settings
Answer: A,E
Explanation:
Documenting the chain of custody is an important step in the forensic analysis of any device, as it helps to ensure that all evidence is collected and preserved correctly. A memory dump is also essential, as it can provide information about the state of the device when the attack occurred and can be used for further analysis.
NEW QUESTION # 101
An analyst reviews a legacy Windows XP system and concludes an attacker executed code that modified the contents of the system's memory. Which of the following attack techniques did the attacker use?
- A. Privilege escalation
- B. Buffer overflow
- C. Backdoor
- D. Rootkit
Answer: B
Explanation:
A buffer overflow is an attack technique that exploits a vulnerability in a program's memory management, by sending more data than the buffer can hold. This can cause the program to overwrite adjacent memory locations, and execute arbitrary code injected by the attacker.
NEW QUESTION # 102
As a proactive threat-hunting technique, hunters must develop situational cases based on likely attack scenarios derived from the available threat intelligence information. After forming the basis of the scenario, which of the following may the threat hunter construct to establish a framework for threat assessment?
- A. Attack profile
- B. Hypothesis
- C. Threat vector
- D. Critical asset list
Answer: B
Explanation:
A hypothesis is a statement that can be tested by threat hunters to establish a framework for threat assessment. A hypothesis is based on situational awareness and threat intelligence information, and describes a possible attack scenario that may affect the organization. A hypothesis can help to guide threat hunters in their investigation by providing a clear and specific question to answer, such as "Is there any evidence of lateral movement within our network?" or "Are there any signs of data exfiltration from our servers?".
NEW QUESTION # 103
Which of the following would a security engineer recommend to BEST protect sensitive system data from being accessed on mobile devices?
- A. Implement a self-encrypted disk.
- B. Enable Secure Boot using TPM
- C. Configure filesystem encryption
- D. Use a UEFl boot password.
Answer: D
NEW QUESTION # 104
A new prototype for a company's flagship product was leaked on the internet As a result, the management team has locked out all USB drives Optical drive writers are not present on company computers The sales team has been granted an exception to share sales presentation files with third parties Which of the following would allow the IT team to determine which devices are USB enabled?
- A. Data loss prevention
- B. SIEMIogs
- C. Device encryption
- D. Asset tagging
Answer: B
Explanation:
A security information and event management (SIEM) system is a tool that collects and analyzes log data from various sources and provides alerts and reports on security incidents and events. A SIEM system can help the IT team to determine which devices are USB enabled by querying the log data for events related to USB device insertion, removal, or usage. The other options are not relevant or effective for this purpose. Reference: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 15; https://www.sans.org/reading-room/whitepapers/analyst/security-information-event-management-siem-implementation-33969
NEW QUESTION # 105
A zero-day crypto-worm is quickly spreading through the internal network on port 25 and exploiting a software vulnerability found within the email servers. Which of the following countermeasures needs to be implemented as soon as possible to mitigate the worm from continuing to spread?
- A. Isolate impacted servers.
- B. Implement a traffic sinkhole.
- C. Block all known port/services.
- D. Patch affected systems.
Answer: A
NEW QUESTION # 106
A security analyst is reviewing WAF logs and notes requests against the corporate website are increasing and starting to impact the performance of the web server. The security analyst queries the logs for requests that triggered an alert on the WAF but were not blocked. Which of the following possible TTP combinations might warrant further investigation? (Select TWO).
- A. Requests identified by a threat intelligence service with a bad reputation
- B. Requests sent from the same IP address using different user agents
- C. Requests sent by NICs with outdated firmware
- D. Existence of HTTP/501 status codes generated to the same IP address
- E. Failed log-in attempts against the web application
- F. Requests blocked by the web server per the input sanitization
Answer: A,B
Explanation:
Requests identified by a threat intelligence service with a bad reputation are likely to be malicious or suspicious, as they originate from sources that are known to be involved in cyberattacks or other malicious activities. These requests may indicate that an attacker is trying to exploit a vulnerability or perform reconnaissance on the web server.
Requests sent from the same IP address using different user agents are also likely to be malicious or suspicious, as they indicate that an attacker is trying to evade detection or bypass security controls by changing their browser or device identification. These requests may indicate that an attacker is using automated tools or scripts to scan or attack the web server.
NEW QUESTION # 107
A technician is running an intensive vulnerability scan to detect which ports are open to exploit.
During the scan, several network services are disabled and production is affected.
Which of the following sources would be used to evaluate which network service was interrupted?
- A. Firewall logs
- B. Network mapping
- C. Syslog
- D. NIDS
Answer: C
NEW QUESTION # 108
Which of the following technologies can be used to house the entropy keys for task encryption on desktops and laptops?
- A. Self-encrypting drive
- B. Bus encryption
- C. TPM
- D. HSM
Answer: A
NEW QUESTION # 109
The steering committee for information security management annually reviews the security incident register for the organization to look for trends and systematic issues. The steering committee wants to rank the risks based on past incidents to improve the security program for next year. Below is the incident register for the organization:
Which of the following should the organization consider investing in first due to the potential impact of availability?
- A. Hire a managed service provider to help with vulnerability management.
- B. Hire additional staff for the IT department to assist with vulnerability management and log review.
- C. Build a warm site in case of system outages.
- D. Invest in a failover and redundant system, as necessary.
Answer: D
Explanation:
Investing in a failover and redundant system, as necessary, is the best solution to improve the availability of the organization's systems based on past incidents. A failover system is a backup system that automatically takes over the operation of a primary system in case of a failure or outage. A redundant system is a duplicate system that runs simultaneously with the primary system and provides backup functionality if needed. Investing in a failover and redundant system can help to ensure that the organization's systems are always available and can handle the workload without interruption or degradation .
NEW QUESTION # 110
A security analyst is reviewing the following server statistics:
Which of the following is MOST likely occurring?
- A. Privilege escalation
- B. Race condition
- C. Resource exhaustion
- D. VM escape
Answer: C
Explanation:
Resource exhaustion is most likely occurring on the server. Resource exhaustion is a condition where a system runs out of resources, such as CPU, memory, disk space, or network bandwidth, due to excessive demand or consumption by one or more processes. Resource exhaustion can cause performance degradation, system instability, or denial-of-service. The server statistics show that the CPU usage is 100%, the memory usage is 99%, and the disk usage is 98%. These indicate that the server is under heavy load and has little or no resources available to handle incoming requests or perform other tasks.
NEW QUESTION # 111
Welcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the desk ticket queue.
INSTRUCTIONS
Click on me ticket to see the ticket details Additional content is available on tabs within the ticket
First, select the appropriate issue from the drop-down menu. Then, select the MOST likely root cause from second drop-down menu
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button
Answer:
Explanation:
NEW QUESTION # 112
A cybersecurity analyst is currently checking a newly deployed server that has an access control list applied. When conducting the scan, the analyst received the following code snippet of results:
Which of the following describes the output of this scan?
- A. The analyst has discovered a False Positive, and the status code is incorrect providing an OK message.
- B. The analyst has discovered a True Positive, and the status code is incorrect providing a forbidden message.
- C. The analyst has discovered a False Positive, and the status code is incorrect providing a server error message.
- D. The analyst has discovered a True Positive, and the status code is correct providing a file not found error message.
Answer: D
NEW QUESTION # 113
A company provides wireless connectivity to the internal network from all physical locations for company- owned devices. Users were able to connect the day before, but now all users have reported that when they connect to an access point in the conference room, they cannot access company resources. Which of the following BEST describes the cause of the problem?
- A. The access point is a rogue device. Follow incident response procedures.
- B. Expired DNS entries on users' devices. Request the affected users perform a DNS flush.
- C. The network is not available. Escalate the issue to network support.
- D. The access point is blocking access by MAC address. Disable MAC address filtering.
Answer: A
NEW QUESTION # 114
Data spillage occurred when an employee accidentally emailed a sensitive file to an external recipient.
Which of the following controls would have MOST likely prevented this incident?
- A. VDI
- B. SSO
- C. DLP
- D. WAF
Answer: C
Explanation:
Reference:
https://greenlightcorp.com/blog/cyber-security-solutions-data-spillage-and-how-to-create-an-after- incident-to-do-list/
NEW QUESTION # 115
An analyst is reviewing the following log from the company web server:
Which of the following is this an example of?
- A. Offline dictionary attack
- B. Offline brute force attack
- C. Online rainbow table attack
- D. Online hybrid attack
Answer: B
NEW QUESTION # 116
The help desk noticed a security analyst that emails from a new email server are not being sent out. The new email server was recently added to the existing ones. The analyst runs the following command on the new server.
Given the output, which of the following should the security analyst check NEXT?
- A. The DNS name of the new email server
- B. The IP address of the new email server
- C. The DMARC policy
- D. The version of SPF that is being used
Answer: A
NEW QUESTION # 117
Risk management wants IT to implement a solution that will permit an analyst to intercept, execute, and analyze potentially malicious files that are downloaded from the Internet.
Which of the following would BEST provide this solution?
- A. File fingerprinting
- B. Risk evaluation
- C. Decomposition of malware
- D. Sandboxing
Answer: A
NEW QUESTION # 118
A vulnerability scan came back with critical findings for a Microsoft SharePoint server:
Which of the following actions should be taken?
- A. Patch Microsoft Office on the server.
- B. Document the finding as an exception.
- C. Remove Microsoft Office from the server.
- D. Install a newer version of Microsoft Office on the server.
Answer: A
NEW QUESTION # 119
An analyst is working on a method to allow secure access to a highly sensi-tive server. The solution must allow named individuals remote access to data contained on the box and must limit access to a single IP address. Which of the following solutions would best meet these requirements?
- A. Jump box
- B. VLAN
- C. Software-defined networking
- D. ACL
Answer: A
Explanation:
A jump box is a secure computer that can be used to access a remote server or network. It acts as an intermediary between the user and the target system, and can limit access to specific IP addresses. A jump box can also provide logging and auditing of the user's actions on the remote system. A jump box is a common solution for accessing highly sensitive servers or networks1.
NEW QUESTION # 120
The help desk provided a security analyst with a screenshot of a user's desktop:
For which of the following is aircrack-ng being used?
- A. Wireless access point discovery
- B. Brute-force attack
- C. Rainbow attack
- D. PCAP data collection
Answer: C
NEW QUESTION # 121
A security analyst is trying to determine if a host is active on a network. The analyst first attempts the following:
The analyst runs the following command next:
Which of the following would explain the difference in results?
- A. The routing tables for ping and hping3 were different.
- B. The original ping command needed root permission to execute.
- C. hping3 is returning a false positive.
- D. ICMP is being blocked by a firewall.
Answer: D
NEW QUESTION # 122
A security engineer has been asked to reduce the attack surface on an organization's production environment. To limit access, direct VPN access to all systems must be terminated, and users must utilize multifactor authentication to access a constrained VPN connection and then pivot to other production systems form a bastion host. The MOST appropriate way to implement the stated requirement is through the use of a:
- A. single-tenant platform.
- B. sinkhole.
- C. jump box
- D. multitenant platform.
Answer: C
NEW QUESTION # 123
......
The CySA+ certification exam is ideal for IT professionals who are looking to advance their career in the field of cybersecurity. CompTIA Cybersecurity Analyst (CySA+) Certification Exam certification is recognized by industry leaders such as Microsoft, Cisco, and IBM, making it a valuable addition to any IT professional's resume. CompTIA Cybersecurity Analyst (CySA+) Certification Exam certification also provides a pathway to other advanced certifications such as the CompTIA Advanced Security Practitioner (CASP+) certification.
CS0-002 Questions Prepare with Learning Information: https://examdumps.passcollection.com/CS0-002-valid-vce-dumps.html
