Free CompTIA CS0-002 Practice Exam with Questions & Answers | Set: 9

MFA stands for multi-factor authentication, which is a method of verifying a user’s identity by requiring two or more pieces of evidence, such as something the user knows (e.g., password), something the user has (e.g., token), or something the user is (e.g., fingerprint). MFA is the best control to help prevent credential stuffing attacks from being successful, because even if an attacker obtains a valid username and password from a breached site, they would still need another factor to access the target site. SIEM, IDS, and TLS are other security controls, but they are not as effective as MFA for preventing credential stuffing attacks. Reference: https://www.cloudflare.com/learning/bots/what-is-credential-stuffing/

The difference between intentional and unintentional insider threats is their behavior. Intentional insider threats are malicious actors who deliberately misuse their access to harm the organization or its assets. Unintentional insider threats are careless or negligent users who accidentally compromise the security of the organization or its assets. Their access levels, risk factors, and rates of occurrence may vary depending on various factors, but their behavior is the main distinction. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 12; https://www.cisa.gov/sites/default/files/publications/Insider_Threat_Mitigation_Guide_508.pdf

CVSS stands for Common Vulnerability Scoring System, and it is a standard for measuring and describing the severity of security-related software flaws. CVSS provides a numerical score and a vector string that represent the characteristics and impact of a vulnerability. CVSS can help prioritize remediation efforts and communicate risk levels to stakeholders.

This is a technique that is commonly used by malware to evade detection and blocking by security tools. The malware generates random domain names that are used to communicate with the command and control server, which can change its IP address frequently. The domain names are usually long and nonsensical, such as www.uewiryfajfchfaerwfj.co in the log.  The malware uses a predefined algorithm or a seed value to generate the same domain names as the server, so that they can find each other on the internet12.

Threat intelligence is a collection and analysis of information about current and emerging threats and vulnerabilities that affect an organization’s assets and operations. Threat intelligence can help to guide risk evaluation activities by providing context, prioritization and recommendations for mitigating firmware vulnerabilities. For example, threat intelligence can help to identify which firmware vulnerabilities are actively exploited in the wild, which ones have high severity or impact, and which ones have available patches or workarounds. Implementing critical updates after proper testing can help to ensure that the firmware updates are trusted, compatible and effective. Testing can help to verify the integrity and authenticity of the firmware updates, as well as their compatibility with the existing system configuration and functionality. Testing can also help to identify any issues or conflicts that may arise from applying the firmware updates and resolve them before deployment12.

The /var/log/secure log file is a file that records security-related events on a Linux system, such as authentication attempts or sudo commands. The log file shows that the comptia user executed the sudo su command, which allows the user to switch to the root account and gain superuser privileges. The log file does not show that the comptia user knows the sudo password, knows the root password, or added himself or herself to the /etc/sudoers file. Reference: https://www.cyberciti.biz/faq/linux-log-files-location-and-how-do-i-view-logs-files/

A data minimization plan is a strategy that aims to reduce the amount and type of data that an organization collects, stores, and processes. It can help improve data privacy and protection by limiting the exposure and impact of a data breach or loss. Creating a data minimization plan is the best recommendation for a security officer who needs to find the most cost-effective solution to the current data privacy and protection gap. Requiring users to sign NDAs, adding access control requirements, or implementing a data loss prevention solution are other possible solutions, but they are not as cost-effective as creating a data minimization plan. Reference: https://www.csoonline.com/article/3603898/data-minimization-what-is-it-and-how-to-implement-it.html

Resource exhaustion is most likely occurring on the server. Resource exhaustion is a condition where a system runs out of resources, such as CPU, memory, disk space, or network bandwidth, due to excessive demand or consumption by one or more processes. Resource exhaustion can cause performance degradation, system instability, or denial-of-service. The server statistics show that the CPU usage is 100%, the memory usage is 99%, and the disk usage is 98%. These indicate that the server is under heavy load and has little or no resources available to handle incoming requests or perform other tasks.

Port triggering is a technique that allows inbound traffic to access certain ports on a device only after an outbound traffic request has been made from those ports. It can enhance the security and performance of a device by opening ports only when needed and closing them when not in use. The output from the network enumeration activities shows that port 21 (FTP) and port 22 (SSH) are open only after port 80 (HTTP) has been accessed, which indicates that port triggering is most likely being used. A web application firewall, an intrusion prevention system, port isolation, or port address translation are other techniques that can affect network traffic, but they do not match the description of the output from the network enumeration activities. Reference: https://www.techopedia.com/definition/3846/port-triggering

UEBA stands for User and Entity Behavior Analytics, which is a category of security products that use machine learning and statistical analysis to identify malicious actions by users or entities on a network. UEBA products can detect anomalous or suspicious behaviors that deviate from normal patterns or baselines, such as data exfiltration, privilege escalation, unauthorized access, insider threats, or compromised accounts. UEBA products can also provide alerts, reports, or recommendations for response actions based on the detected behaviors.