Get Full Version of the Exam
http://www.EnsurePass.com/CS0-001.html

Question No.51

Given the following access log:

Which of the following accurately describes what this log displays?

1. A vulnerability in jQuery

2. Application integration with an externally hosted database

3. A vulnerability scan performed from the Internet

4. A vulnerability in Javascript

Correct Answer: C

Question No.52

The new Chief Technology Officer (CTO) is seeking recommendations for network monitoring services for the local intranet. The CTO would like the capability to monitor all traffic to and from the gateway, as well as the capability to block certain content. Which of the following recommendations would meet the needs of the organization?

1. Recommend setup of IP filtering on both the internal and external interfaces of the gateway router.

2. Recommend installation of an IDS on the internal interface and a firewall on the external interface of the gateway router.

3. Recommend installation of a firewall on the internal interface and a NIDS on the external interface of the gateway router.

4. Recommend installation of an IPS on both the internal and external interfaces of the gateway router.

Correct Answer: C

Question No.53

A cybersecurity analyst has received the laptop of a user who recently left the company. The analyst types `history#39; into the prompt, and sees this line of code in the latest bash history:

This concerns the analyst because this subnet should not be known to users within the company. Which of the following describes what this code has done on the network?

1. Performed a ping sweep of the Class C network.

2. Performed a half open SYB scan on the network.

3. Sent 255 ping packets to each host on the network.

4. Sequentially sent an ICMP echo reply to the Class C network.

Correct Answer: A

Question No.54

A recent audit has uncovered several coding errors and a lack of input validation being used on a public portal. Due to the nature of the portal and the severity of the errors, the portal is unable to

be patched. Which of the following tools could be used to reduce the risk of being compromised?

1. Web application firewall

2. Network firewall

3. Web proxy

4. Intrusion prevention system

Correct Answer: A

Question No.55

Which of the following principles describes how a security analyst should communicate during an incident?

1. The communication should be limited to trusted parties only.

2. The communication should be limited to security staff only.

3. The communication should come from law enforcement.

4. The communication should be limited to management only.

Correct Answer: B

Question No.56

After scanning the main company#39;s website with the OWASP ZAP tool, a cybersecurity analyst is reviewing the following warning:

The analyst reviews a snippet of the offending code:

Which of the following is the BEST course of action based on the above warning and code snippet?

1. The analyst should implement a scanner exception for the false positive.

2. The system administrator should disable SSL and implement TLS.

3. The developer should review the code and implement a code fix.

4. The organization should update the browser GPO to resolve the issue.

Correct Answer: D

Question No.57

A security analyst has noticed an alert from the SIEM. A workstation is repeatedly trying to

connect to port 445 of a file server on the production network. All of the attempts are made with invalid credentials. Which of the following describes what is occurring?

1. Malware has infected the workstation and is beaconing out to the specific IP address of the file server.

2. The file server is attempting to transfer malware to the workstation via SMB.

3. An attacker has gained control of the workstation and is attempting to pivot to the file server by creating an SMB session.

4. An attacker has gained control of the workstation and is port scanning the network.

Correct Answer: C

Question No.58

A security analyst is performing a review of Active Directory and discovers two new user accounts in the accounting department. Neither of the users has elevated permissions, but accounts in the group are given access to the company#39;s sensitive financial management application by default. Which of the following is the BEST course of action?

1. Follow the incident response plan for the introduction of new accounts

2. Disable the user accounts

3. Remove the accounts#39; access privileges to the sensitive application

4. Monitor the outbound traffic from the application for signs of data exfiltration

5. Confirm the accounts are valid and ensure role-based permissions are appropriate

Correct Answer: E

Question No.59

A security analyst has created an image of a drive from an incident. Which of the following describes what the analyst should do NEXT?

1. The analyst should create a backup of the drive and then hash the drive.

2. The analyst should begin analyzing the image and begin to report findings.

3. The analyst should create a hash of the image and compare it to the original drive#39;s hash.

4. The analyst should create a chain of custody document and notify stakeholders.

Correct Answer: C

Question No.60

A system administrator recently deployed and verified the installation of a critical patch issued by the company#39;s primary OS vendor. This patch was supposed to remedy a vulnerability that would allow an adversary to remotely execute code from over the network. However, the administrator just ran a vulnerability assessment of networked systems, and each of them still reported having the same vulnerability. Which of the following is the MOST likely explanation for this?

1. The administrator entered the wrong IP range for the assessment.

2. The administrator did not wait long enough after applying the patch to run the assessment.

3. The patch did not remediate the vulnerability.

4. The vulnerability assessment returned false positives.

Correct Answer: C

Get Full Version of the Exam
CS0-001 Dumps
CS0-001 VCE and PDF