Book Image

CompTIA CySA+ Study Guide: Exam CS0-002

By : Mike Chapple, David Seidl
Book Image

CompTIA CySA+ Study Guide: Exam CS0-002

By: Mike Chapple, David Seidl

Overview of this book

The Cybersecurity Analyst (CySA+) certification applies behavioral analytics to improve the overall state of IT security. CompTIA CySA+ meets the ISO 17024 standard and is approved by the U.S. Department of Defense to fulfill Directive 8570.01-M requirements. It is compliant with government regulations under the Federal Information Security Management Act (FISMA). More than just test prep, this book helps you to learn skills to demonstrate your command of all domains and topics covered by the CySA+ exam. The CompTIA CySA+ Study Guide provides complete coverage of all exam objectives for the new CySA+ certification. The CySA+ certification validates a candidate's skills to configure and use threat detection tools, perform data analysis, and identify vulnerabilities with a goal of securing and protecting systems of organizations. You'll study concepts with real-world examples drawn from experts, and hands-on labs. You'll gain insight on how to create your own cybersecurity toolkit. The end-of-chapter review questions will help you reinforce your knowledge. By the end of the book, you’ll have the skills and confidence you need to think and respond like a seasoned professional.
Table of Contents (23 chapters)
Free Chapter
About the Authors
Assessment Test
Answer to the Assessment Test

Review Questions

  1. 1. Which format does dd produce files in?

    1. ddf
    2. RAW
    3. EN01
    4. OVF
  2. 2. Files remnants found in clusters that have been only partially rewritten by new files found are in what type of space?

    1. Outer
    2. Slack
    3. Unallocated space
    4. Non-Euclidean
  3. 3. Mike is looking for information about files that were changed on a Windows system. Which of the following is least likely to contain useful information for his investigation?

    1. The MFT
    2. INDX files
    3. Event logs
    4. Volume shadow copies
  4. 4. Alice wants to copy a drive without any chance of it being modified by the copying process. What type of device should she use to ensure that this does not happen?

    1. A read blocker
    2. A drive cloner
    3. A write blocker
    4. A hash validator
  5. 5. Frederick wants to determine if a thumb drive was ever plugged into a Windows system. How can he test for this?

    1. Review the MFT
    2. Check the system’s live memory
    3. Use USB Historian
    4. Create a forensic image of the drive
  6. 6. What two files may contain encryption keys...