Free CS0-002 Exam Braindumps

- (Exam Topic 3)
An organization has the following risk mitigation policies
• Risks without compensating controls will be mitigated first it the nsk value is greater than $50,000
• Other nsk mitigation will be pnontized based on risk value. The following risks have been identified:

Which of the following is the ordei of priority for risk mitigation from highest to lowest?

1. A. A, C, D, B
2. B. B, C, D, A
3. C. C, B, A, D
4. D. D, A, B
5. E. D, C, B, A

Correct Answer: D

- (Exam Topic 3)
A security analyst was transferred to an organization's threat-hunting team to track specific activity throughout the enterprise environment The analyst must observe and assess the number ot times this activity occurs and aggregate the results. Which of the following is the BEST threat-hunting method for the analyst to use?

1. A. Stack counting
2. B. Searching
3. C. Clustering
4. D. Grouping

Correct Answer: A

- (Exam Topic 3)
An organization wants to ensure the privacy of the data that is on its systems Full disk encryption and DLP are already in use Which of the following is the BEST option?

1. A. Require all remote employees to sign an NDA
2. B. Enforce geofencmg to limit data accessibility
3. C. Require users to change their passwords more frequently
4. D. Update the AUP to restrict data sharing

Correct Answer: A

- (Exam Topic 2)
A security analyst reviews SIEM logs and detects a well-known malicious executable running in a Windows machine The up-to-date antivirus cannot detect the malicious executable Which of the following is the MOST likely cause of this issue?

1. A. The malware is being executed with administrative privileges.
2. B. The antivirus does not have the mltware's signature.
3. C. The malware detects and prevents its own execution in a virtual environment.
4. D. The malware is fileless and exists only in physical memory.

Correct Answer: A

- (Exam Topic 3)
An organization recently discovered that spreadsheet files containing sensitive financial data were improperly stored on a web server. The management team wants to find out if any of these files were downloaded by pubic users accessing the server. The results should be written to a text file and should induce the date. time, and IP address associated with any spreadsheet downloads. The web server's log file Is named webserver log, and the report We name should be accessreport.txt. Following is a sample of the web servefs.log file:
2017-0-12 21:01:12 GET /index.htlm - @4..102.33.7 - return=200 1622
Which of the following commands should be run if an analyst only wants to include entries in which spreadsheet was successfully downloaded?

1. A. more webserver.log | grep * xIs > accessreport.txt
2. B. more webserver.log > grep ''xIs > egrep -E 'success' > accessreport.txt
3. C. more webserver.log | grep ' -E ''return=200 | accessreport.txt
4. D. more webserver.log | grep -A *.xIs < accessreport.txt

Correct Answer: C