CompTIA CS0-001 Exam Dumps

An analyst wants to build a lab with multiple workstations to practice penetration testing In a test environment. Which or the following will provide the analyst with the MOST penetration-testing-specific features? 

A logistics company’s vulnerability scan identifies the following vulnerabilities on Internetfacing devices in the DMZ:SQL injection on an infrequently used web server that provides files to vendorsSSL/TLS not used for a website that contains promotional informationThe scan also shows the following vulnerabilities on internal resources:Microsoft Office Remote Code Execution on test server for a human resourcessystemTLS downgrade vulnerability on a server in a development networkIn order of risk, which of the following should be patched FIRST?

A security analyst has discovered that an outbound SFTP process is occurring at the sametime of day for the past several days. At the time this was discovered, large amounts ofbusiness critical data were delivered. The authentication for this process occurred using aservice account with proper credentials. The security analyst investigated the destination IPfor this transfer and discovered that this new process is not documented in the changemanagement log. Which of the following would be the BEST course of action for theanalyst to take?

An analyst is preparing for a technical security compliance check on all Apache servers. Which of the following will be the BEST to use?

Joe, an analyst, has received notice that a vendor who is coming in for a presentation will require access to a server outside the network. Currently, users are only able to access remote sites through a VPN connection. Which of the following should Joe use to BEST accommodate the vendor?

A list of vulnerabilities has been reported in a company’s most recent scan of a server. The security analyst must review the vulnerabilities and decide which ones should be remediated in the next change window and which ones can wait or may not need patching. Pending further investigation. Which of the following vulnerabilities should the analyst remediate FIRST?

A malicious user taps into a network connection, and then Intercepts, sends, and receives data for other users, such as account numbers and passwords. Which of the following remediation’s would prevent the attack the malicious user Is using? 

An organization suspects it has had a breach, and it is trying to determine the potentialimpact. The organization knows the following:The source of the breach is linked to an IP located in a foreign country.The breach is isolated to the research and development servers.The hash values of the data before and after the breach are unchanged.The affected servers were regularly patched, and a recent scan showed novulnerabilities.Which of the following conclusions can be drawn with respect to the threat and impact?(Choose two.)

A company’s asset management software has been discovering a weekly increase in nonstandard software installed on end users’ machines with duplicate license keys. The security analyst wants to know if any of this software is listening on any non-standard ports, such as 6667. Which of the following tools should the analyst recommend to block any command and control traffic?

The development team recently moved a new application into production for the accountingdepartment. After this occurred, the Chief Information Officer (CIO) was contacted by thehead of accounting because the application is missing a key piece of functionality that isneeded to complete the corporation’s quarterly tax returns. Which of the following types oftesting would help prevent this from reoccurring?

A company uses a managed IDS system, and a security analyst has noticed a largevolume of brute force password attacks originating from a single IP address. The analystput in a ticket with the IDS provider, but no action was taken for 24 hours, and the attackscontinued. Which of the following would be the BEST approach for the scenario described?

A security analyst is creating ACLs on a perimeter firewall that will deny inbound packetsthat are from internal addresses, reversed external addresses, and multicast addresses.Which of the following is the analyst attempting to prevent?

A corporation has implemented an 802.1X wireless network using self-signed certificates. Which of the following represents a risk to wireless users? 

A malicious hacker wants to gather guest credentials on a hotel 802.11 network. Which ofthe following tools is the malicious hacker going to use to gain access to information foundon the hotel network?

A security analyst received several service tickets reporting that a company storefront website is not accessible by internal domain users. However, external users are accessing the website without issue. Which of the following is the MOST likely reason for this behavior? 

An analyst identifies multiple instances of node-to-node communication between several endpoints within the 10.200.2.0/24 network and a user machine at the IP address 10.200.2.5. This user machine at the IP address 10.200.2.5 is also identified as initiating outbound communication during atypical business hours with several IP addresses that have recently appeared on threat feeds. Which of the following can be inferred from this activity?

A security architect is reviewing the options for performing input validation on incoming webform submissions. Which of the following should the architect as the MOST secure andmanageable option?

An organization has recently experienced a data breach. A forensic analysis confirmed the attacker found a legacy web server that had not been used in over a year and was not regularly patched. After a discussion with the security team, management decided to initiate a program of network reconnaissance and penetration testing. They want to start the process by scanning the network for active hosts and open ports. Which of the following tools is BEST suited for this job?

A security analyst determines that several workstations are reporting traffic usage on port 3389. All workstations are running the latest OS patches according to patch reporting. The help desk manager reports some users are getting logged off of their workstations, and network access is running slower than normal. The analyst believes a zero-day threat has allowed remote attackers to gain access to the workstations. Which of the following are the BEST steps to stop the threat without impacting all services? (Choose two.) 

A small company Is publishing a new web application to receive customer feedback related to Its products. The web server will only host a form to receive the customer feedback and store It In a local database. The web server is placed In a DMZ network, and the web service and filesystem have been hardened. However, the cybersecurity analyst discovers data from the database can be mined from over the Internet. Which of the following should the cybersecurity analyst recommend be done to provide temporary mitigation from unauthorized access to the database? 

Which of the following describes why it is important to include scope within the rules of engagement of a penetration test?

A web developer wants to create a new web part within the company website thataggregates sales from individual team sites. A cybersecurity analyst wants to ensuresecurity measurements are implemented during this process. Which of the followingremediation actions should the analyst take to implement a vulnerability managementprocess?

A computer at a company was used to commit a crime. The system was seized andremoved for further analysis. Which of the following is the purpose of labeling cables andconnections when seizing the computer system?

An organization wants to perform network scans to Identify active hosts and vulnerabilities.Management places the highest priority on scans that mimic how an attack would progress.Iftime and resources allow, subsequent scans can be performed using different techniquesand methods. Which of the following scan types and sequences would BEST suit theorganization's requirements?

An organization with a small IT department deploys the following security capabilities but isstruggling with aggregating and analyzing security logs:• Enterprise antivirus• Layer 7 firewalls• Network-based IPS• DLP applianceThe security administrator is concerned with the tack of event correlation and the inability todedicate more resources to a SIEM and Its monitoring. Which of the following should thecompany implement to BEST resolve this issue?