Free Practice Questions for CompTIA CS0-002 Exam

nslookup is a command-line tool that can query the Domain Name System (DNS) and display information about domain names and IP addresses. The security analyst can use nslookup to find out the IP address of the malicious domain accountfix-office365.com that was used in the phishing attempt. This could help the analyst to block or trace the source of the attack. telnet, tracert, and curl are other command-line tools, but they are not as useful as nslookup for investigating a phishing attempt based on a domain name. Reference: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup

Threat intelligence is a collection and analysis of information about current and emerging threats and vulnerabilities that affect an organization’s assets and operations. Threat intelligence can help to guide risk evaluation activities by providing context, prioritization and recommendations for mitigating firmware vulnerabilities. For example, threat intelligence can help to identify which firmware vulnerabilities are actively exploited in the wild, which ones have high severity or impact, and which ones have available patches or workarounds. Implementing critical updates after proper testing can help to ensure that the firmware updates are trusted, compatible and effective. Testing can help to verify the integrity and authenticity of the firmware updates, as well as their compatibility with the existing system configuration and functionality. Testing can also help to identify any issues or conflicts that may arise from applying the firmware updates and resolve them before deployment12.

The calc entry is a suspicious registry entry that should be investigated first by the analyst. The calc entry is located in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key, which is a common location for malware to persist and execute on system startup. The calc entry has a data value of “C:\Windows\System32\calc.exe”, which is the path to the legitimate Windows Calculator program. However, this program does not need to run on system startup, and it could be a disguise for a malicious executable that has replaced or renamed the original calculator program. The calc entry could also be a sign of a fileless malware attack, where the attacker uses the legitimate calculator program to execute malicious commands or scripts in memory1.

 According to the CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives1, one of the skills required for the exam is to “apply incident response procedures and analyze potential indicators of compromise (IOCs)”. The document also states that “the first step in incident response is to contain the incident and prevent further damage” (page 14).

Based on this information, the best answer to your question is C. Remove the malware from the host. This would prevent the malware from spreading to other machines or exfiltrating data from the infected host.

The best practice for establishing a digital certificate for a new application is to ensure the certificate is requested from a trusted CA. A CA stands for Certificate Authority, and it is an entity that issues and verifies digital certificates, which are electronic documents that contain a public key and a digital signature that prove the identity and authenticity of an application, a website, or a person. Requesting a certificate from a trusted CA can help ensure that the certificate is valid, secure, and recognized by other parties.

The host “lincoln” violates the organizational policies that require dedicated user accounts to run programs that need elevated privileges. The log file shows that the user “ldavis” tried to run programs such as “su root”, “sudo apache.bin”, and “sudo grep” on the host “lincoln”, which indicate attempts to gain elevated privileges or access sensitive files. The other hosts do not show any evidence of policy violation.

Live forensics is a technique that involves investigating an active threat on a system without shutting it down or altering its state, by using tools such as memory dumpers, process explorers, registry editors, or network analyzers. Live forensics can help preserve volatile data that may be lost if the system is powered off or rebooted, such as system memory, network connections, running processes, etc. Live forensics can also help identify and stop malicious activities in real time.

The CySA+ exam outline calls out “trusted firmware updates,” but trusted firmware itself is more commonly described as part of trusted execution environments (TEEs). Trusted firmware is signed by a chip vendor or other trusted party, and then used to access keys to help control access to hardware. TEEs like those used by ARM processors leverage these technologies to protect the hardware by preventing unsigned code from using privileged features."

Trusted firmware updates provide organizations with secure code signing, distribution, installation, and attestation for embedded devices. Embedded devices are devices that have a dedicated function and are part of a larger system or network, such as routers, cameras, sensors, etc. Embedded devices often run on firmware, which is a type of software that controls the device’s hardware and functionality. Firmware updates are essential for improving the performance, security, and reliability of embedded devices. However, firmware updates also pose risks of introducing vulnerabilities or malware into the devices if they are not properly secured. Trusted firmware updates are firmware updates that use cryptographic techniques to ensure the integrity, authenticity, and confidentiality of the firmware code and data. Trusted firmware updates typically involve four steps1:

Code signing: The firmware code is digitally signed by the firmware developer or provider using a private key. The digital signature proves that the firmware code is from a trusted source and has not been tampered with.

Distribution: The signed firmware code is securely transmitted to the embedded device or a trusted intermediary (such as a cloud service or a gateway) using encryption or other methods. The transmission ensures that the firmware code is not intercepted or modified by unauthorized parties.

Installation: The embedded device verifies the digital signature of the firmware code using a public key that is stored in a secure location (such as a trusted platform module or TPM). The verification ensures that the firmware code is from a trusted source and has not been tampered with. The embedded device then installs the firmware code and reboots to apply the update.

Attestation: The embedded device reports its firmware status and configuration to a trusted verifier (such as a cloud service or a gateway) using a cryptographic proof. The proof ensures that the embedded device has installed the correct firmware update and has not been compromised.

Trusted firmware updates provide organizations with several benefits for hardware assurance, such as2:

Preventing unauthorized or malicious firmware updates that could compromise the security or functionality of embedded devices

Detecting and mitigating firmware attacks or incidents that could affect the availability or performance of embedded devices

Complying with regulatory or industry standards or best practices for firmware security

Enhancing customer trust and satisfaction with embedded devices

Trusted firmware updates do not provide organizations with development, compilation, remote access, or customization for embedded devices (A), as these are software engineering tasks that are not directly related to firmware security. Trusted firmware updates do not provide organizations with security specifications, open-source libraries, or custom tools for embedded devices (B), as these are software resources that are not directly related to firmware security. Trusted firmware updates do not provide organizations with remote code execution, distribution, maintenance, or extended warranties for embedded devices ©, as these are software features or services that are not directly related to firmware security.

References: 1: https://www.techopedia.com/definition/24771/technical-controls  2: https://www.techopedia.com/definition/25888/security-development-lifecycle-sdl

Authentication is a method of verifying a user’s identity by requiring some piece of evidence, such as something the user knows (e.g., password), something the user has (e.g., token), or something the user is (e.g., fingerprint). Authentication is the best method to prevent unauthorized use of an API, because it ensures that only legitimate users can access or use the API functions or data. HTTPS, geofencing, or rate limiting are other methods that can enhance the security or performance of an API, but they do not prevent unauthorized use of an API. Reference: https://www.redhat.com/en/topics/api/what-is-api-security

A directory traversal attack is a type of web application attack that exploits insufficient input validation or improper configuration to access files or directories that are outside the intended scope of the web server. The log entries given in the question show several requests that contain “…/” sequences in the URL, which indicate an attempt to move up one level in the directory structure. For example, the request “/images/…/…/etc/passwd” tries to access the /etc/passwd file, which contains user account information on Linux systems. If successful, this attack could allow an attacker to read, modify, or execute files on the web server that are not meant to be accessible.