CompTIA Cybersecurity Analyst (CySA+): CS0-002

The help desk informed a security analyst of a trend that is beginning to develop regarding a suspicious email that has been reported by multiple users. The analyst has determined the email includes an attachment named invoice.zip that contains the following files:

Locky.js xerty.ini xerty.lib

Further analysis indicates that when the .zip file is opened, it is installing a new version of ransomware on the devices. Which of the following should be done FIRST to prevent data on the company NAS from being encrypted by infected devices?

A. Disable access to the company VPN.

B. Move the files from the NAS to a cloud-based storage solution.

C. Set permissions on file shares to read-only.

D. Add the URL included in the .js file to the company's web proxy filter.

Which of the following represent the reasoning behind careful selection of the timelines and time-of-day boundaries for an authorized penetration test? (Select TWO).

A. To schedule personnel resources required for test activities

B. To determine frequency of team communication and reporting

C. To mitigate unintended impacts to operations

D. To avoid conflicts with real intrusions that may occur

E. To ensure tests have measurable impact to operations

An analyst is detecting Linux machines on a Windows network. Which of the following tools should be used to detect a computer operating system?

A. whois

B. netstat

C. nmap

D. nslookup