CS0-002

CS0-002 practice questions, page 13 of 17, with answer review and explanations.

Question 61

Which of the following is the BEST way to gather patch information on a specific server?

  1. Event Viewer
  2. Custom script
  3. SCAP software
  4. CI/CD

Question 62

A security analyst reviews SIEM logs and discovers the following error event: Which of the following environments does the analyst need to examine to continue troubleshooting the event?

  1. Proxy server
  2. SQL server
  3. Windows domain controller
  4. WAF appliance
  5. DNS server

Question 63

A security analyst needs to develop a brief that will include the latest incidents and the attack phases of the incidents. The goal is to support threat intelligence and identify whether or not the incidents are linked. Which of the following methods would be MOST appropriate to use?

  1. The Cyber Kill Chain
  2. The MITRE ATT&CK framework
  3. An adversary capability model
  4. The Diamond Model of Intrusion Analysis

Question 64

A security analyst is handling an incident in which ransomware has encrypted the disks of several company workstations. Which of the following would work BEST to prevent this type of incident in the future?

  1. Implement a UTM instead of a stateful firewall and enable gateway antivirus.
  2. Back up the workstations to facilitate recovery and create a gold image.
  3. Establish a ransomware awareness program and implement secure and verifiable backups.
  4. Virtualize all the endpoints with daily snapshots of the virtual machines.

Question 65

A computer hardware manufacturer is developing a new SoC that will be used by mobile devices. The SoC should not allow users or the process to downgrade from a newer firmware to an older one. Which of the following can the hardware manufacturer implement to prevent firmware downgrades?

  1. Encryption
  2. eFuse
  3. Secure Enclave
  4. Trusted execution