CS0-002 無料問題集「CompTIA Cybersecurity Analyst (CySA+) Certification」
A security analyst is logged on to a jump server to audit the system configuration and status. The organization's policies for access to and configuration of the jump server include the following:
* No network access is allowed to the internet.
* SSH is only for management of the server.
* Users must utilize their own accounts, with no direct login as an administrator.
* Unnecessary services must be disabled.
The analyst runs netstar with elevated permissions and receives the following output:
Which of the following policies does the server violate?
* No network access is allowed to the internet.
* SSH is only for management of the server.
* Users must utilize their own accounts, with no direct login as an administrator.
* Unnecessary services must be disabled.
The analyst runs netstar with elevated permissions and receives the following output:
Which of the following policies does the server violate?
正解：B
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
A security analyst is evaluating the following support ticket:
Issue: Marketing campaigns are being filtered by the customer's email servers.
Description: Our marketing partner cannot send emails using our email address. The following log messages were collected from multiple customers:
* The SPF result is PermError.
* The SPF result is SoftFail or Fail.
* The 550 SPF check failed.
Which of the following should the analyst do next?
Issue: Marketing campaigns are being filtered by the customer's email servers.
Description: Our marketing partner cannot send emails using our email address. The following log messages were collected from multiple customers:
* The SPF result is PermError.
* The SPF result is SoftFail or Fail.
* The 550 SPF check failed.
Which of the following should the analyst do next?
正解：C
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
An online gaming company was impacted by a ransomware attack. An employee opened an attachment that was received via an SMS attack on a company-issue firewall. Which following actions would help during the forensic analysis of the mobile device? (Select TWO).
正解：C、E
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
Due to continued support of legacy applications, an organization's enterprise password complexity rules are inadequate for its required security posture. Which of the following is the BEST compensating control to help reduce authentication compromises?
正解：C
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
A risk assessment concludes that the perimeter network has the highest potential for compromise by an attacker, and it is labeled as a critical risk environment. Which of the following is a valid compensating control to reduce the volume of valuable information in the perimeter network that an attacker could gain using active reconnaissance techniques?
正解：D
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
An organization has a policy that requires dedicated user accounts to run programs that need elevated privileges. Users must be part of a group that allows elevated permissions. While reviewing security logs, an analyst sees the following:
Which of the following hosts violates the organizational policies?
Which of the following hosts violates the organizational policies?
正解：B
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
A company's threat team has been reviewing recent security incidents and looking for a common theme. The team discovered the incidents were caused by incorrect configurations on the impacted systems. The issues were reported to support teams, but no action was taken. Which of the following is the next step the company should take to ensure any future issues are remediated?
正解：B
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
A systems administrator believes a user's workstation has been compromised. The workstation's performance has been lagging significantly for the past several hours. The administrator runs the task list
/ v command and receives the following output:
Which of the following should a security analyst recognize as an indicator of compromise?
/ v command and receives the following output:
Which of the following should a security analyst recognize as an indicator of compromise?
正解：A
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)
A security analyst identified one server that was compromised and used as a data making machine, and a few of the hard drive that was created. Which of the following will MOST likely provide information about when and how the machine was compromised and where the malware is located?
正解：C
解答を投票する
解説: (JPNTest メンバーにのみ表示されます)