あなたのCS0-002試験100%合格問題集はここPassTestで一発合格 [Q14-Q37]

質問 14
A cybersecurity analyst inspects DNS logs on a regular basis to identify possible IOCs that are not triggered by known signatures. The analyst reviews the following log snippet:

Which of the following should the analyst do next based on the information reviewed?

質問 15
A large software company wants to move «s source control and deployment pipelines into a cloud-computing environment. Due to the nature of the business management determines the recovery time objective needs to be within one hour. Which of the following strategies would put the company in the BEST position to achieve the desired recovery time?

質問 16
Hotspot Question
A security analyst suspects that a workstation may be beaconing to a command and control server.
You must inspect the logs from the company’s web proxy server and the firewall to determine the best course of action to take in order to neutralize the threat with minimum impact to the organization.
Instructions:
If at any time you would like to bring back the initial state of the simulation, please select the Reset button.
When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

質問 17
Wncn ol the following provides an automated approach 10 checking a system configuration?

質問 18
While investigating an incident in a company’s SIEM console, a security analyst found hundreds of failed SSH login attempts, which all occurred in rapid succession.
The failed attempts were followed by a successful login on the root user Company policy allows systems administrators to manage their systems only from the company’s internal network using their assigned corporate logins.
Which of the following are the BEST actions the analyst can take to stop any further compromise? (Select TWO).

質問 19
A company’s modem response team is handling a threat that was identified on the network Security analysts have as at remote sites. Which of the following is the MOST appropriate next step in the incident response plan?

質問 20
Which of the following technologies can be used to store digital certificates and is typically used in highsecurity
implementations where integrity is paramount?

質問 21
A business recently acquired a software company. The software company’s security posture is unknown. However, based on an assessment, there are limited security controls. No significant security monitoring exists. Which of the following is the NEXT step that should be completed to obtain information about the software company’s security posture?

質問 22
An organization is conducting penetration testing to identify possible network vulnerabilities. The penetration tester has received the following output from the latest scan:

The penetration tester knows the organization does not use Timbuktu servers and wants to have Nmap interrogate the ports on the target in more detail. Which of the following commands should the penetration tester use NEXT?

質問 23
An IT security analyst has received an email alert regarding vulnerability within the new fleet of vehicles the company recently purchased. Which of the following attack vectors is the vulnerability MOST likely targeting?

質問 24
A security analyst is auditing firewall rules with the goal of scanning some known ports to check the firewall’s behavior and responses. The analyst executes the following commands:

The analyst then compares the following results for port 22:
nmap returns “Closed”
hping3 returns “flags=RA”
Which of the following BEST describes the firewall rule?

質問 25
A security analyst is building a malware analysis lab. The analyst wants to ensure malicious applications are not capable of escaping the virtual machines and pivoting to other networks.
To BEST mitigate this risk, the analyst should use __________.

質問 26
The help desk provided a security analyst with a screenshot of a user’s desktop:

For which of the following is aircrack-ng being used?

質問 27
A company is experiencing a malware attack within its network. A security engineer notices many of the impacted assets are connecting outbound to a number of remote destinations and exfiltrating dat a. The security engineer also see that deployed, up-to-date antivirus signatures are ineffective. Which of the following is the BEST approach to prevent any impact to the company from similar attacks in the future?

質問 28
A security analyst, who is working for a company that utilizes Linux servers, receives the following results from a vulnerability scan:

Which of the following is MOST likely a false positive?

質問 29
After receiving reports latency, a security analyst performs an Nmap scan and observes the following output:

Which of the following suggests the system that produced output was compromised?

質問 30
A security analyst is auditing firewall rules with the goal of scanning some known ports to check the firewall’s behavior and responses. The analyst executes the following commands:

The analyst then compares the following results for port 22:
nmap returns “Closed”
hping3 returns “flags=RA”
Which of the following BEST describes the firewall rule?

質問 31
Who is the best facilitator for a post-incident lessons-learned session?

質問 32
An organization was alerted to a possible compromise after its proprietary data was found for sale on the Internet. An analyst is reviewing the logs from the next-generation UTM in an attempt to find evidence of this breach. Given the following output:

Which of the following should be the focus of the investigation?

質問 33
After running the cat file01.bin | hexdump -c command, a security analyst reviews the following output snippet:
00000000 ff d8 ft e0 00 10 4a 46 49 46 00 01 01 00 00 01 |……JFIF……| Which of the following digital-forensics techniques is the analyst using?

質問 34
A security learn implemented a SCM as part for its security-monitoring program there is a requirement to integrate a number of sources Into the SIEM to provide better context relative to the events being processed. Which of the following BEST describes the result the security learn hopes to accomplish by adding these sources?

質問 35
Which of the following MOST accurately describes an HSM?

質問 36
A security analyst found an old version of OpenSSH running on a DMZ server and determined the following piece of code could have led to a command execution through an integer overflow;

Which of the following controls must be in place to prevent this vulnerability?

質問 37
A company was recently awarded several large government contracts and wants to determine its current risk from one specific APT.
Which of the following threat modeling methodologies would be the MOST appropriate to use during this analysis?