CompTIA CySA+ Practice Tests

Exam CS0-002

Mike Chapple, David Seidl

• Publisher: Sybex
• Year: 2020
• ISBN:
  9781119684046
• Edition: 2
• Topic: Informatica
• Subtopic: Sicurezza informatica

Efficiently prepare yourself for the demanding CompTIA CySA+ exam

CompTIA CySA+ Practice Tests: Exam CS0-002, 2nd Edition offers readers the fastest and best way to prepare for the CompTIA Cybersecurity Analyst exam. With five unique chapter tests and two additional practice exams for a total of 1000 practice questions, this book covers topics including:

• Threat and Vulnerability Management
• Software and Systems Security
• Security Operations and Monitoring
• Incident Response
• Compliance and Assessment

The new edition of CompTIA CySA+ Practice Tests is designed to equip the reader to tackle the qualification test for one of the most sought-after and in-demand certifications in the information technology field today.

The authors are seasoned cybersecurity professionals and leaders who guide readers through the broad spectrum of security concepts and technologies they will be required to master before they can achieve success on the CompTIA CySA exam. The book also tests and develops the critical thinking skills and judgment the reader will need to demonstrate on the exam.

Chapter 1
Domain 1.0: Threat and Vulnerability Management

EXAM OBJECTIVES COVERED IN THIS CHAPTER:

• 1.1 Explain the importance of threat data and intelligence.
  • Intelligence sources
  • Confidence levels
  • Indicator management
  • Threat classification
  • Threat actors
  • Intelligence cycle
  • Commodity malware
  • Information sharing and analysis communities
• 1.2 Given a scenario, utilize threat intelligence to support organizational security.
  • Attack frameworks
  • Threat research
  • Threat modeling methodologies
  • Threat intelligence sharing with supported functions
• 1.3 Given a scenario, perform vulnerability management activities.
  • Vulnerability identification
  • Validation
  • Remediation/mitigation
  • Scanning parameters and criteria
  • Inhibitors to remediation
• 1.4 Given a scenario, analyze the output from common vulnerability assessment tools.
  • Web application scanner
  • Infrastructure vulnerability scanner
  • Software assessment tools and techniques
  • Enumeration
  • Wireless assessment tools
  • Cloud infrastructure assessment tools
• 1.5 Explain the threats and vulnerabilities associated with specialized technology.
  • Mobile
  • Internet of Things (IoT)
  • Embedded
  • Real-time operating system (RTOS)
  • System-on-Chip (SoC)
  • Field programmable gate array (FPGA)
  • Physical access control
  • Building automation systems
  • Vehicles and drones
  • Workflow and process automation systems
  • Industrial control systems (ICS)
  • Supervisory control and data acquisition (SCADA)
• 1.6 Explain the threats and vulnerabilities associated with operating in the cloud.
  • Cloud service models
  • Cloud deployment models
  • Function as a service (FaaS)/serverless architecture
  • Infrastructure as code (IaC)
  • Insecure application programming interface (API)
  • Improper key management
  • Unprotected storage
  • Logging and monitoring
• 1.7 Given a scenario, implement controls to mitigate attacks and software vulnerabilities.
  • Attack types
  • Vulnerabilities

1. Olivia is considering potential sources for threat intelligence information that she might incorporate into her security program. Which one of the following sources is most likely to be available without a subscription fee?
   1. Vulnerability feeds
   2. Open source
   3. Closed source
   4. Proprietary
2. During the reconnaissance stage of a penetration test, Cynthia needs to gather information about the target organization's network infrastructure without causing an IPS to alert the target to her information gathering. Which of the following is her best option?
   1. Perform a DNS brute-force attack.
   2. Use an nmap ping sweep.
   3. Perform a DNS zone transfer.
   4. Use an nmap stealth scan.
3. Roger is evaluating threat intelligence information sources and finds that one source results in quite a few false positive alerts. This lowers his confidence level in the source. What criteria for intelligence is not being met by this source?
   1. Timeliness
   2. Expense
   3. Relevance
   4. Accuracy
4. What markup language provides a standard mechanism for describing attack patterns, malware, threat actors, and tools?
   1. STIX
   2. TAXII
   3. XML
   4. OpenIOC
5. A port scan of a remote system shows that port 3306 is open on a remote database server. What database is the server most likely running?
   1. Oracle
   2. Postgres
   3. MySQL
   4. Microsoft SQL
6. Brad is working on a threat classification exercise, analyzing known threats and assessing the possibility of unknown threats. Which one of the following threat actors is most likely to be associated with an advanced persistent threat (APT)?
   1. Hacktivist
   2. Nation-state
   3. Insider
   4. Organized crime
7. During a port scan of her network, Cynthia discovers a workstation that shows the following ports open. What should her next action be?

   

   1. Determine the reason for the ports being open.
   2. Investigate the potentially compromised workstation.
   3. Run a vulnerability scan to identify vulnerable services.
   4. Reenable the workstation's local host firewall.
8. Charles is working with leaders of his organization to determine the types of information that should be gathered in his new threat intelligence program. In what phase of the intelligence c...