CS0-002

CS0-002 practice questions, page 5 of 17, with answer review and explanations.

Question 21

A security team implemented a SIEM as part of its security-monitoring program. There is a requirement to integrate a number of sources into the SIEM to provide better context relative to the events being processed. Which of the following BEST describes the result the security team hopes to accomplish by adding these sources?

  1. Data enrichment
  2. Continuous integration
  3. Machine learning
  4. Workflow orchestration

Question 22

Which of the following organizational initiatives would be MOST impacted by data sovereignty issues?

  1. Moving to a cloud-based environment
  2. Migrating to locally hosted virtual servers
  3. Implementing non-repudiation controls
  4. Encrypting local database queries

Question 23

A help desk technician inadvertently sent the credentials of the company's CRM in cleartext to an employee's personal email account. The technician then reset the employee's account using the appropriate process and the employee's corporate email, and notified the security team of the incident. According to the incident response procedure, which of the following should the security team do NEXT?

  1. Contact the CRM vendor.
  2. Prepare an incident summary report.
  3. Perform postmortem data correlation.
  4. Update the incident response plan.

Question 24

Which of the following is MOST dangerous to the client environment during a vulnerability assessment/penetration test?

  1. There is a longer period of time to assess the environment.
  2. The testing is outside the contractual scope.
  3. There is a shorter period of time to assess the environment.
  4. No status reports are included with the assessment.

Question 25

An organization is adopting IoT devices at an increasing rate and will need to account for firmware updates in its vulnerability management programs. Despite the number of devices being deployed, the organization has only focused on software patches so far, leaving hardware-related weaknesses open to compromise. Which of the following best practices will help the organization to track and deploy trusted firmware updates as part of its vulnerability management programs?

  1. Utilize threat intelligence to guide risk evaluation activities and implement critical updates after proper testing.
  2. Apply all firmware updates as soon as they are released to mitigate the risk of compromise.
  3. Sign up for vendor emails and create firmware update change plans for affected devices.
  4. Implement an automated solution that detects when vendors release firmware updates and immediately deploy updates to production.