CS0-002

CS0-002 practice questions, page 10 of 17, with answer review and explanations.

Question 46

A company wants to ensure confidential data from its storage media files is sanitized so the drives cannot be reused. Which of the following is the BEST approach?

  1. Degaussing
  2. Shredding
  3. Formatting
  4. Encrypting

Question 47

During the forensic analysis of a compromised machine, a security analyst discovers some binaries that are exhibiting abnormal behaviors. After extracting the strings, the analyst finds unexpected content. Which of the following is the NEXT step the analyst should take?

  1. Validate the binaries' hashes from a trusted source.
  2. Use file integrity monitoring to validate the digital signature.
  3. Run an antivirus against the binaries to check for malware.
  4. Only allow whitelisted binaries to execute.

Question 48

An organization recently discovered that spreadsheet files containing sensitive financial data were improperly stored on a web server. The management team wants to find out if any of these files were downloaded by public users accessing the server. The results should be written to a text file and should include the date, time, and IP address associated with any spreadsheet downloads. The web server's log file is named webserver.log, and the report file name should be accessreport.txt. Following is a sample of the web server's log file: Which of the following commands should be run if an analyst only wants to include entries in which a spreadsheet was successfully downloaded?

  1. more webserver.log | grep *.xls > accessreport.txt
  2. more webserver.log > grep ג€*xlsג€ | egrep ג€"E 'success' > accessreport.txt
  3. more webserver.log | grep ג€"E ג€return=200 | xlsג€ > accessreport.txt
  4. more webserver.log | grep ג€"A *.xls < accessreport.txt

Question 49

A security analyst is running a tool against an executable of an unknown source. The input supplied by the tool to the executable program and the output from the executable are shown below: Which of the following should the analyst report after viewing this information?

  1. A dynamic library that is needed by the executable is missing.
  2. Input can be crafted to trigger an injection attack in the executable.
  3. The tool caused a buffer overflow in the executable's memory.
  4. The executable attempted to execute a malicious command.

Question 50

A Chief Information Security Officer (CISO) is concerned about new privacy regulations that apply to the company. The CISO has tasked a security analyst with finding the proper control functions to verify that a user's data is not altered without the user's consent. Which of the following would be an appropriate course of action?

  1. Automate the use of a hashing algorithm after verified users make changes to their data.
  2. Use encryption first and then hash the data at regular, defined times.
  3. Use a DLP product to monitor the data sets for unauthorized edits and changes.
  4. Replicate the data sets at regular intervals and continuously compare the copies for unauthorized changes.