Online Access Free CS0-002 Exam Questions

An organization prohibits users from logging in to the administrator account. If a user requires elevated permissions. the user's account should be part of an administrator group, and the user should escalate permission only as needed and on a temporary basis. The organization has the following reporting priorities when reviewing system activity:
* Successful administrator login reporting priority - high
* Failed administrator login reporting priority - medium
* Failed temporary elevated permissions - low
* Successful temporary elevated permissions - non-reportable
A security analyst is reviewing server syslogs and sees the following:
Which of the following events is the HIGHEST reporting priority?

• A.Option C
• B.Option A
• C.Option D
• D.Option B

During a review of recent network traffic, an analyst realizes the team has seen this same traffic multiple times in the past three weeks, and it resulted in confirmed malware activity The analyst also notes there is no other alert in place for this traffic After resolving the security incident, which of the following would be the BEST action for the analyst to take to increase the chance of detecting this traffic in the future?

• A.Share details of the security incident with the organization's human resources management team
• B.Communicate the security incident to the threat team for further review and analysis
• C.Report the security incident to a manager for inclusion in the daily report
• D.Note the security incident so other analysts are aware the traffic is malicious

In SIEM software, a security analysis selected some changes to hash signatures from monitored files during the night followed by SMB brute-force attacks against the file servers Based on this behavior, which of the following actions should be taken FIRST to prevent a more serious compromise?

• A.Check the hash signatures, comparing them with malware databases to verify if the files are infected.
• B.Fully segregate the affected servers physically in a network segment, apart from the production network.
• C.Collect the network traffic during the day to understand if the same activity is also occurring during business hours
• D.Collect all the files that have changed and compare them with the previous baseline

A security analyst has received a report that servers are no longer able to connect to the network. After many hours of troubleshooting, the analyst determines a Group Policy Object is responsible for the network connectivity Issues. Which of the following solutions should the security analyst recommend to prevent an interruption of service in the future?

• A.Change management process
• B.Appropriate network segmentation
• C.Impact analysis and reporting
• D.Cl/CD pipeline

A small business does not have enough staff in the accounting department to segregate duties. The controller writes the checks for the business and reconciles them against the ledger. To ensure there is no fraud occurring, the business conducts quarterly reviews in which a different officer in the business compares all the cleared checks against the ledger. Which of the following BEST describes this type of control?

• A.Deterrent
• B.Detective
• C.Preventive
• D.Compensating