CS0-001 | Approved CS0-001 Dumps Questions 2019
We provide CS0-001 Exam Dumps which are the best for clearing CS0-001 test, and to get certified by CompTIA CompTIA CSA+ Certification Exam. The CS0-001 Study Guides covers all the knowledge points of the real CS0-001 exam. Crack your CompTIA CS0-001 Exam with latest dumps, guaranteed!
Free CS0-001 Demo Online For Microsoft Certifitcation:
NEW QUESTION 1
A security analyst is conducting a vulnerability assessment of older SCADA devices on the corporate network. Which of the following compensating controls is likely to prevent the scans from providing value?
- A. Access control list network segmentation that prevents access to the SCADA devices inside the network.
- B. Detailed and tested firewall rules that effectively prevent outside access of the SCADA devices.
- C. Implementation of a VLAN that allows all devices on the network to see all SCADA devices on the network.
- D. SCADA systems configured with ‘SCADA SUPPORT’=ENABLE
NEW QUESTION 2
The security configuration management policy states that all patches must undergo testing procedures before being moved into production. The security analyst notices a single web application server has been downloading and applying patches during non-business hours without testing. There are no apparent adverse reactions, server functionality does not seem to be affected, and no malware was found after a scan.
Which of the following actions should the analyst take?
- A. Reschedule the automated patching to occur during business hours.
- B. Monitor the web application service for abnormal bandwidth consumption.
- C. Create an incident ticket for anomalous activity.
- D. Monitor the web application for service interruptions caused from the patching.
NEW QUESTION 3
The business has been informed of a suspected breach of customer data. The internal audit team, in conjunction with the legal department, has begun working with the cybersecurity team to validate the report. To which of the following response processes should the business adhere during the investigation?
- A. The security analysts should not respond to internal audit requests during an active investigation
- B. The security analysts should report the suspected breach to regulators when an incident occurs
- C. The security analysts should interview system operators and report their findings to the internal auditors
- D. The security analysts should limit communication to trusted parties conducting the investigation
NEW QUESTION 4
A technician is running an intensive vulnerability scan to detect which ports are open to exploit. During the scan, several network services are disabled and production is affected. Which of the following sources would be used to evaluate which network service was interrupted?
- A. Syslog
- B. Network mapping
- C. Firewall logs
- D. NIDS
NEW QUESTION 5
A company that is hiring a penetration tester wants to exclude social engineering from the list of authorized activities. Which of the following documents should include these details?
- A. Acceptable use policy
- B. Service level agreement
- C. Rules of engagement
- D. Memorandum of understanding
- E. Master service agreement
NEW QUESTION 6
A security analyst reserved several service tickets reporting that a company storefront website is not accessible
by internal domain users. However, external users ate accessing the website without issue. Which of the following is the MOST likely reason for this behavior?
- A. The FQDN is incorrect.
- B. The DNS server is corrupted.
- C. The time synchronization server is corrupted.
- D. The certificate is expired.
NEW QUESTION 7
Datacenter access is controlled with proximity badges that record all entries and exits from the datacenter.
The access records are used to identify which staff members accessed the data center in the event of equipment theft.
Which of the following MUST be prevented in order for this policy to be effective?
- A. Password reuse
- B. Phishing
- C. Social engineering
- D. Tailgating
NEW QUESTION 8
After reading about data breaches at a competing company, senior leaders in an organization have grown increasingly concerned about social engineering attacks. They want to increase awareness among staff
regarding this threat, but do not want to use traditional training methods because they regard these methods as ineffective. Which of the following approaches would BEST meet the requirements?
- A. Classroom training on the dangers of social media followed by a test and gift certificates for any employee getting a perfect score.
- B. Simulated phishing emails asking employees to reply to the email with their updated phone number and office location
- C. A poster contest to raise awareness of PII and asking employees to provide examples of data breaches and consequences
- D. USB drives randomly placed inside and outside the organization that contain a pop-up warning to any users who plug the drive into their computer
NEW QUESTION 9
The primary difference in concern between remediating identified vulnerabilities found in general-purpose IT network servers and that of SCADA systems is that:
- A. change and configuration management processes do not address SCADA systems.
- B. doing so has a greater chance of causing operational impact in SCADA systems.
- C. SCADA systems cannot be rebooted to have changes to take effect.
- D. patch installation on SCADA systems cannot be verified.
NEW QUESTION 10
Law enforcement has contacted a corporation’s legal counsel because correlated data from a breach shows the organization as the common denominator from all indicators of compromise. An employee overhears the conversation between legal counsel and law enforcement, and then posts a comment about it on social media. The media then starts contacting other employees about the breach. Which of the following steps should be taken to prevent further disclosure of information about the breach?
- A. Security awareness about incident communication channels
- B. Request all employees verbally commit to an NDA about the breach
- C. Temporarily disable employee access to social media
- D. Law enforcement meeting with employees
NEW QUESTION 11
An organization uses Common Vulnerability Scoring System (CVSS) scores to prioritize remediation of vulnerabilities.
Management wants to modify the priorities based on a difficulty factor so that vulnerabilities with lower CVSS scores may get a higher priority if they are easier to implement with less risk to system functionality. Management also wants to quantify the priority. Which of the following would achieve management’s objective?
- A. (CVSS Score) * Difficulty = PriorityWhere Difficulty is a range from 0.1 to 1.0 with 1.0 being easiest and lowest risk to implement
- B. (CVSS Score) * Difficulty = PriorityWhere Difficulty is a range from 1 to 5 with 1 being easiest and lowest risk to implement
- C. (CVSS Score) / Difficulty = PriorityWhere Difficulty is a range from 1 to 10 with 10 being easiest and lowest risk to implement
- D. ((CVSS Score) * 2) / Difficulty = PriorityWhere CVSS Score is weighted and Difficulty is a range from 1 to 5 with 5 being easiest and lowest risk to implement
NEW QUESTION 12
An organization is experiencing degradation of critical services and availability of critical external resources. Which of the following can be used to investigate the issue?
- A. Netflow analysis
- B. Behavioral analysis
- C. Vulnerability analysis
- D. Risk analysis
NEW QUESTION 13
A new zero day vulnerability was discovered within a basic screen capture app, which is used throughout the environment Two days after discovering the vulnerability, the manufacturer of the software has not announced a remediation or it there will be a fix for this newly discovered vulnerability. The vulnerable application is not uniquely critical, but it is used occasionally by the management and executive management teams The vulnerability allows remote code execution to gam privileged access to the system Which of the following is the BEST course of action to mitigate this threat'
- A. Work with the manufacturer to determine the tone frame for the fix.
- B. Block the vulnerable application traffic at the firewall and disable the application services on each computer.
- C. Remove the application and replace it with a similar non-vulnerable application.
- D. Communicate with the end users that the application should not be used until the manufacturer has reserved the vulnerability.
NEW QUESTION 14
Which of the following is a best practice with regard to interacting with the media during an incident?
- A. Allow any senior management level personnel with knowledge of the incident to discuss it.
- B. Designate a single point of contact and at least one backup for contact with the media.
- C. Stipulate that incidents are not to be discussed with the media at any time during the incident.
- D. Release financial information on the impact of damages caused by the incident.
NEW QUESTION 15
A security analyst is performing a review of Active Directory and discovers two new user accounts in the accounting department. Neither of the users has elevated permissions, but accounts in the group are given access to the company’s sensitive financial management application by default. Which of the following is the BEST course of action?
- A. Follow the incident response plan for the introduction of new accounts
- B. Disable the user accounts
- C. Remove the accounts’ access privileges to the sensitive application
- D. Monitor the outbound traffic from the application for signs of data exfiltration
- E. Confirm the accounts are valid and ensure role-based permissions are appropriate
NEW QUESTION 16
A security analyst has been asked to remediate a server vulnerability. Once the analyst has located a patch for the vulnerability, which of the following should happen NEXT?
- A. Start the change control process.
- B. Rescan to ensure the vulnerability still exists.
- C. Implement continuous monitoring.
- D. Begin the incident response process.
100% Valid and Newest Version CS0-001 Questions & Answers shared by Certleader, Get Full Dumps HERE: https://www.certleader.com/CS0-001-dumps.html (New 242 Q&As)