Mobile Menu

2019 Free Microsoft EnsurePass CS0-001 Dumps VCE and PDF Download Part 4

by admin, June 1, 2019

EnsurePass
Exam Dumps
CS0-001 Dumps VCE and PDF
2019 CS0-001 Dumps VCE and PDF

 

QUESTION 31

A cybersecurity analyst has been asked to follow a corporate process that will be used to manage vulnerabilities for an organization. The analyst notices the policy has not been updated in three years. Which of the following should the analyst check to ensure the policy is still accurate?

 

A.

Threat intelligence reports

B.

Technical constraints

C.

Corporate minutes

D.

Governing regulations

 

Correct Answer: A

QUESTION 32

You suspect that multiple unrelated security events have occurred on several nodes on a corporate network. You must review all logs and correlate events when necessary to discover each security event by clicking on each node. Only select corrective actions if the logs shown a security event that needs remediation. Drag and drop the appropriate corrective actions to mitigate the specific security event occurring on each affected device.

 

Instructions:

The Web Server, Database Server, IDS, Development PC, Accounting PC and Marketing PC are clickable. Some actions may not be required and each actions can only be used once per node. The corrective action order is not important. If at any time you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

 

image012

image014

image016

image018

image020

image022

image024

image026

image028

image030

image032

image034

image036

image038

 

Correct Answer:

image040

image042

image044

image046

image048

image050

image051

image052

image054

image056

image058

image060

image062

 

 

QUESTION 33

HOTSPOT

A security analyst suspects that a workstation may be beaconing to a command and control server. You must inspect the logs from the company’s web proxy server and the firewall to determine the best course of action to take in order to neutralize the threat with minimum impact to the organization.

 

Instructions:

If at any time you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.

 

image064

Correct Answer:

image066

QUESTION 34

A security analyst is conducting traffic analysis and observes an HTTP POST to a web server. The POST header is approximately 1000 bytes in length. During transmission, one byte is delivered every ten seconds. Which of the following attacks is the traffic indicative of?

 

A.

Exfiltration

B.

DoS

C.

Buffer overflow

D.

SQL injection

 

Correct Answer: A

 

 

QUESTION 35

When network administrators observe an increased amount of web traffic without an increased number of financial transactions, the company is MOST likely experiencing which of the following attacks?

 

A.

Bluejacking

B.

ARP cache poisoning

C.

Phishing

D.

DoS

 

Correct Answer: D

 

 

QUESTION 36

A security administrator determines several months after the first instance that a local privileged user has been routinely logging into a server interactively as “root” and browsing the Internet. The administrator determines this by performing an annual review of the security logs on that server. For which of the following security architecture areas should the administrator recommend review and modification? (Select TWO).

 

A.

Log aggregation and analysis

B.

Software assurance

C.

Encryption

D.

Acceptable use policies

E.

Password complexity

F.

Network isolation and separation

 

Correct Answer: AD

 

 

QUESTION 37

A security analyst is performing a forensic analysis on a machine that was the subject of some historic SIEM alerts. The analyst noticed some network connections utilizing SSL on non-common ports, copies of svchost.exe and cmd.exe in %TEMP% folder, and RDP files that had connected to external IPs. Which of the following threats has the security analyst uncovered?

 

A.

DDoS

B.

APT

C.

Ransomware

D.

Software vulnerability

Correct Answer: B

 

 

QUESTION 38

A threat intelligence analyst who works for a technology firm received this report from a vendor.

 

“There has been an intellectual property theft campaign executed against organizations in the technology industry. Indicators for this activity are unique to each intrusion. The information that appears to be targeted is R&D data. The data exfiltration appears to occur over months via uniform TTPs. Please execute a defensive operation regarding this attack vector.”

 

Which of the following combinations suggests how the threat should MOST likely be classified and the type of analysis that would be MOST helpful in protecting against this activity?

 

A.

Polymorphic malware and secure code analysis

B.

Insider threat and indicator analysis

C.

APT and behavioral analysis

D.

Ransomware and encryption

 

Correct Answer: B

 

 

QUESTION 39

Datacenter access is controlled with proximity badges that record all entries and exits from the datacenter. The access records are used to identify which staff members accessed the data center in the event of equipment theft. Which of the following MUST be prevented in order for this policy to be effective?

 

A.

Password reuse

B.

Phishing

C.

Social engineering

D.

Tailgating

 

Correct Answer: D

 

 

QUESTION 40

Creating a lessons learned report following an incident will help an analyst to communicate which of the following information? (Select TWO)

 

A.

Root cause analysis of the incident and the impact it had on the organization

B.

Outline of the detailed reverse engineering steps for management to review

C.

Performance data from the impacted servers and endpoints to report to management

D.

Enhancements to the policies and practices that will improve business responses

E.

List of IP addresses, applications, and assets

 

Correct Answer: AD

Categories