CS0-002 Free Practice Test

- (Exam Topic 1)
An information security analyst observes anomalous behavior on the SCADA devices in a power plant. This behavior results in the industrial generators overheating and destabilizing the power supply.
Which of the following would BEST identify potential indicators of compromise?

1. A. Use Burp Suite to capture packets to the SCADA device's IP.
2. B. Use tcpdump to capture packets from the SCADA device IP.
3. C. Use Wireshark to capture packets between SCADA devices and the management system.
4. D. Use Nmap to capture packets from the management system to the SCADA devices.

Correct Answer: C

- (Exam Topic 3)
A company's Chief Information Officer wants to use a CASB solution to ensure policies are being met during cloud access. Due to the nature of the company's business and risk appetite, the management team elected to not store financial information in the cloud. A security analyst needs to recommend a solution to mitigate the threat of financial data leakage into the cloud. Which of the following should the analyst recommend?

1. A. Utilize the CASB to enforce DLP data-at-rest protection for financial information that is stored on premises.
2. B. Do not utilize the CASB solution for this purpose, but add DLP on premises for data in motion.
3. C. Utilize the CASB to enforce DLP data-in-motion protection for financial information moving to the cloud.
4. D. Do not utilize the CASB solution for this purpose, but add DLP on premises for data at rest.

Correct Answer: C
"CASB solutions generally offer their own DLP policy engine, allowing you to configure DLP policies in a CASB and apply them to cloud services."
https://www.mcafee.com/blogs/enterprise/cloud-security/how-a-casb-integrates-with-an-on-premises-dlp-solutio

- (Exam Topic 2)
In system hardening, which of the following types of vulnerability scans would work BEST to verify the scanned device meets security policies?

1. A. SCAP
2. B. Burp Suite
3. C. OWASP ZAP
4. D. Unauthenticated

Correct Answer: D

- (Exam Topic 3)
A security analyst is researching ways to improve the security of a company's email system to mitigate emails that are impersonating company executives. Which of the following would be BEST for the analyst to configure to achieve this objective?

1. A. A TXT record on the name server for SPF
2. B. DNSSEC keys to secure replication
3. C. Domain Keys identified Man
4. D. A sandbox to check incoming mad

Correct Answer: B

- (Exam Topic 2)
A security analyst needs to obtain the footprint of the network. The footprint must identify the following information;
• TCP and UDP services running on a targeted system
• Types of operating systems and versions
• Specific applications and versions
Which of the following tools should the analyst use to obtain the data?

1. A. ZAP
2. B. Nmap
3. C. Prowler
4. D. Reaver

Correct Answer: B