CS0-002 Free Practice Test

An analyst performs a routine scan of a host using Nmap and receives the following output:

Which of the following should the analyst investigate FIRST?

1. A. Port 21
2. B. Port 22
3. C. Port 23
4. D. Port 80

Correct Answer: C

A system is experiencing noticeably slow response times, and users are being locked out frequently. An analyst asked for the system security plan and found the system comprises two servers: an application server in the DMZ and a database server inside the trusted domain. Which of the following should be performed NEXT to investigate the availability issue?

1. A. Review the firewall logs.
2. B. Review syslogs from critical servers.
3. C. Perform fuzzing.
4. D. Install a WAF in front of the application server.

Correct Answer: C

A development team uses open-source software and follows an Agile methodology with two-week sprints. Last month, the security team filed a bug for an insecure version of a common library. The DevOps team updated the library on the server, and then the security team rescanned the server to verify it was no longer vulnerable. This month, the security team found the same vulnerability on the server.
Which of the following should be done to correct the cause of the vulnerability?

1. A. Deploy a WAF in front of the application.
2. B. Implement a software repository management tool.
3. C. Install a HIPS on the server.
4. D. Instruct the developers to use input validation in the code.

Correct Answer: B

An organization suspects it has had a breach, and it is trying to determine the potential impact. The organization knows the following:
The source of the breach is linked to an IP located in a foreign country.
The breach is isolated to the research and development servers.
The hash values of the data before and after the breach are unchanged.
The affected servers were regularly patched, and a recent scan showed no vulnerabilities.
Which of the following conclusions can be drawn with respect to the threat and impact? (Choose two.)

1. A. The confidentiality of the data is unaffected.
2. B. The threat is an APT.
3. C. The source IP of the threat has been spoofed.
4. D. The integrity of the data is unaffected.
5. E. The threat is an insider.

Correct Answer: BD

A web-based front end for a business intelligence application uses pass-through authentication to authenticate users The application then uses a service account, to perform queries and look up data m a database A security analyst discovers employees are accessing data sets they have not been authorized to use. Which of the following will fix the cause of the issue?

1. A. Change the security model to force the users to access the database as themselves
2. B. Parameterize queries to prevent unauthorized SQL queries against the database
3. C. Configure database security logging using syslog or a SIEM
4. D. Enforce unique session IDs so users do not get a reused session ID

Correct Answer: B