Free CompTIA Cybersecurity Analyst CS0-001 Exam Practice Test

A cybersecurity analyst has identified a new mission-essential function that utilizes a public cloud-based system. The analyst needs to classify the information processed by the system with respect to CIA. Which of the following should provide the CIA classification for the information?

• The cloud provider
  
• The data owner
  
• The cybersecurity analyst
  
• The system administrator
  

An analyst wants to build a lab with multiple workstations to practice penetration testing In a test environment. Which or the following will provide the analyst with the MOST penetration-testing-specific features?

• Nessus
  
• Qualys
  
• Metasport
  
• Nexpose
  

A medical organization recently started accepting payments over the phone. The manager is concerned about the impact of the storage of different types of data. Which of the following types of data incurs the highest regulatory constraints?

• PHI
  
• PCI
  
• PII
  
• IP
  

The new Chief Technology Officer (CTO) is seeking recommendations for network monitoring services for the local intranet. The CTO would like the capability to monitor all traffic to and from the gateway, as well as the capability to block certain content. Which of the following recommendations would meet the needs of the organization?

• Recommend setup of IP filtering on both the internal and external interfaces of the gateway router.
  
• Recommend installation of an IDS on the internal interface and a firewall on the external interface of the gateway router.
  
• Recommend installation of a firewall on the internal interface and a NIDS on the external interface of the gateway router.
  
• Recommend installation of an IPS on both the internal and external interfaces of the gateway router.
  

Which of the following items represents a document that includes detailed information on when an incident was detected, how impactful the incident was, and how it was remediated, in addition to incident response effectiveness and any identified gaps needing improvement?

• Forensic analysis report
  
• Chain of custody report
  
• Trends analysis report
  
• Lessons learned report
  

When performing reverse engineering, which of the following file types would be MOST easily decompiled Into source code?

• so
  
• .exe
  
• .Jar
  
• a
  

A security analyst is concerned that unauthorized users can access confidential data stored in the production server environment. All workstations on a particular network segment have full access to any server in production. Which of the following should be deployed in the production environment to prevent unauthorized access? (Choose two.)

• DLP system
  
• Honeypot
  
• Jump box
  
• IPS
  
• Firewall
  

Due to new regulations, a company has decided to institute an organizational vulnerability management program and assign the function to the security team. Which of the following frameworks would BEST support the program? (Choose two.)

• COBIT
  
• NIST
  
• ISO 27000 series
  
• ITIL
  
• COSO
  

A company office was broken into over the weekend. The office manager contacts the IT security group to provide details on which servers were stolen. The security analyst determines one of the stolen servers contained a list of customer PII information, and another server contained a copy of the credit card transactions processed on the Friday before the break-in. In addition to potential security implications of information that could be gleaned from those servers and the rebuilding/restoring of the data on the stolen systems, the analyst needs to determine any communication or notification requirements with respect to the incident. Which of the following items is MOST important when determining what information needs to be provided, who should be contacted, and when the communication needs to occur.

• Total number of records stolen
  
• Government and industry regulations
  
• Impact on the reputation of the company's name/brand
  
• Monetary value of data stolen
  

A security analyst has concluded that suspicious Intermittent network activity Is coming from one or more systems using random IP addresses and MAC addresses. The same IP or MAC address Is not used twice Which of the following Is the BEST course of action to Identify the source of the suspicious activity when It resumes?

• Configure a dynamic sinkhole.
  
• Review the firewall logs.
  
• Trace down to the switchport
  
• Review the network IDS logs.