Pass SY0-601 Exam Latest Practice Questions Updated on Nov 17, 2024
CompTIA SY0-601 Study Guide Archives
NEW QUESTION # 232
A security analyst is receiving several alerts per user and is trying to determine If various logins are malicious.
The security analyst would like to create a baseline of normal operations and reduce noise. Which of the following actions should the security analyst perform?
- A. Adjust the sensitivity levels of the SIEM correlation engine.
- B. Utilize behavioral analysis to enable the SIEM's learning mode.
- C. Disable email alerting and review the SIEM directly.
- D. Adjust the data flow from authentication sources to the SIEM.
Answer: A
NEW QUESTION # 233
A company uses wireless tor all laptops and keeps a very detailed record of its assets, along with a comprehensive list of devices that are authorized to be on the wireless network. The Chief Information Officer (CIO) is concerned about a script kiddie potentially using an unauthorized device to brute force the wireless PSK and obtain access to the internal network. Which of the following should the company implement to BEST prevent this from occurring?
- A. A WIDS
- B. WPA-EAP
- C. IP filtering
- D. A BPDU guard
Answer: B
NEW QUESTION # 234
Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation.
INSTRUCTIONS
Not all attacks and remediation actions will be used.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
Explanation
Web serverBotnet Enable DDoS protectionUser RAT Implement a host-based IPSDatabase server Worm Change the default application passwordExecutive KeyloggerDisable vulnerable servicesApplication Backdoor Implement 2FA using push notification A screenshot of a computer program Description automatically generated with low confidence
NEW QUESTION # 235
A cybersecurity administrator is usingiptables as an enterprise firewall. The administrator created some rules, but the network now seems to be unresponsive All connections are being dropped by the firewall. Which of the following would be the BEST option to remove the rules?
- A. # iptables -P INPUT -j DROP
- B. # iptables -Z
- C. #iptables -t mangle -X
- D. # iptables -F
Answer: A
NEW QUESTION # 236
Users at a company reported that one of the company's VPN tunnels was not functioning. Security analysts discovered that traffic to the VPN tunnel was being redirected to a malicious IP address to capture log-in credentials. Which of the following security measures should have been the first step in preventing this attack?
- A. Patching the VPN servers to the latest version
- B. Using honeypots to detect network attacks
- C. Enabling MFA for DNS admin accounts
- D. Deploying updates to VPN agents sooner
Answer: A
NEW QUESTION # 237
Several universities are participating in a collaborative research project and need to share compute and storage resources. Which of the following cloud deployment strategies would best meet this need?
- A. Community
- B. Private
- C. Public
- D. Hybrid
Answer: A
Explanation:
Explanation
A community cloud deployment strategy would best meet the need of several universities participating in a collaborative research project and needing to share compute and storage resources. A community cloud is a type of cloud service model that provides a shared platform for multiple organizations with common interests, goals, or requirements. A community cloud can offer benefits such as cost savings, scalability, security, privacy, compliance, and collaboration. References:
https://www.comptia.org/blog/cloud-service-models-saas-paas-and-iaas-explained
https://www.certblaster.com/wp-content/uploads/2020/11/CompTIA-Security-SY0-601-Exam-Objectives-1.0.pd
NEW QUESTION # 238
A security analyst is investigating multiple hosts that are communicating to external IP addresses during the hours of 2:00 a.m - 4:00 am. The malware has evaded detection by traditional antivirus software. Which of the following types of malware is MOST likely infecting the hosts?
- A. A RAT
- B. A worm
- C. Polymophic
- D. Ransomware
Answer: A
Explanation:
Explanation
Based on the given information, the most likely type of malware infecting the hosts is a RAT (Remote Access Trojan). RATs are often used for stealthy unauthorized access to a victim's computer, and they can evade traditional antivirus software through various sophisticated techniques. In particular, the fact that the malware is communicating with external IP addresses during specific hours suggests that it may be under the control of an attacker who is issuing commands from a remote location. Ransomware, polymorphic malware, and worms are also possible culprits, but the context of the question suggests that a RAT is the most likely answer.
NEW QUESTION # 239
A junior security analyst iss conducting an analysis after passwords were changed on multiple accounts without users' interaction. The SIEM have multiple logtn entnes with the following text:
Which of Ihe following is the MOST likely attack conducted on the environment?
- A. Doman hijacking
- B. DNS poisoning
- C. Privilege escalation
- D. Malicious script
Answer: D
NEW QUESTION # 240
A critical file server is being upgraded and the systems administrator must determine which RAID level the new server will need to achieve parity and handle two simultaneous disk failures. Which of the following RAID levels meets this requirements?
- A. RAID 2
- B. RAID 0+1
- C. RAID 5
- D. RAID 6
Answer: D
NEW QUESTION # 241
Given the following logs:
Which of the following BEST describes the type of attack that is occurring?
- A. Password spraying
- B. Dictionary
- C. Pass-the-hash
- D. Rainbow table
Answer: D
Explanation:
Rainbow table attacks are a type of attack that attempts to discover the password from the hash.
A rainbow table is a huge database of possible passwords with the precomputed hashes for each. It helps to look at the process of how some password cracker applications discover passwords without a rainbow table. Assume that an attacker has the hash of a password.
NEW QUESTION # 242
A company just implemented a new telework policy that allows employees to use personal devices for official email and file sharing while working from home. Some of the requirements are:
* Employees must provide an alternate work location (i.e., a home address)
* Employees must install software on the device that will prevent the loss of proprietary data but will not restrict any other software from being installed.
Which of the following BEST describes the MDM options the company is using?
- A. Application management, remote wipe, geofencing, context-aware authentication, and containerization
- B. Geofencing, content management, remote wipe, containerization, and storage segmentation
- C. Remote wipe, geolocation, screen locks, storage segmentation, and full-device encryption
- D. Content management, remote wipe, geolocation, context-aware authentication, and containerization
Answer: C
NEW QUESTION # 243
A cybersecurity administrator is using iptables as an enterprise firew ll. The administrator created some rules, but the network now seems to be unresponsive All connections are being dropped by the firewall. Which of the following would be the BEST option to remove the rules?
- A. # iptables -P INPUT -j DROP
- B. # iptables -Z
- C. # iptables -t mangle -X
- D. # iptables -F
Answer: A
NEW QUESTION # 244
A software company has a shared codebase for multiple projects using the following strategy:
- Unused features are deactivated but still present on the code.
- New customer requirements trigger additional development work.
Which of the following will most likely occur when the company uses this strategy?
- A. Dead code
- B. Outsourced code
- C. Code obfuscation
- D. Malicious code
Answer: A
Explanation:
Dead code refers to portions of a program's source code that are never executed during the program's runtime. In this strategy, features that are deactivated but still present in the code are effectively dead code. They are not actively used or executed, yet they remain in the codebase.
NEW QUESTION # 245
A systems administrator receives the following alert from a file integrity monitoring tool:
The hash of the cmd.exe file has changed.
The systems administrator checks the OS logs and notices that no patches were applied in the last two months.
Which of the following most likely occurred?
- A. The end user changed the file permissions.
- B. A rootkit was deployed.
- C. A snapshot of the file system was taken.
- D. A cryptographic collision was detected.
Answer: B
NEW QUESTION # 246
The security administrator has installed a new firewall which implements an implicit DENY policy by default.
INSTRUCTIONS:
Click on the firewall and configure it to allow ONLY the following communication.
1. The Accounting workstation can ONLY access the web server on the public network over the default HTTPS port. The accounting workstation should not access other networks.
2. The HR workstation should be restricted to communicate with the Financial server ONLY, over the default SCP port
3. The Admin workstation should ONLY be able to access the servers on the secure network over the default TFTP port.
Instructions: The firewall will process the rules in a top-down manner in order as a first match The port number must be typed in and only one port number can be entered per rule Type ANY for all ports. The original firewall configuration can be reset at any time by pressing the reset button. Once you have met the simulation requirements, click save and then Done to submit.
Hot Area:
Answer:
Explanation:
Explanation
Graphical user interface Description automatically generated with medium confidence
Graphical user interface Description automatically generated
Section: Network Security
Implicit deny is the default security stance that says if you aren't specifically granted access or privileges for a resource, you're denied access by default.Rule #1 allows the Accounting workstation to ONLY access the web server on the public network over the default HTTPS port, which is TCP port 443.Rule #2 allows the HR workstation to ONLY communicate with the Financial server over the default SCP port, which is TCP Port
22Rule #3 & Rule #4 allow the Admin workstation to ONLY access the Financial and Purchasing servers located on the secure network over the default TFTP port, which is Port 69.
References:Stewart,
James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp. 26, 44
http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
NEW QUESTION # 247
An analyst visits an internet forum looking for information about a tool. The analyst finds a threat that appears to contain relevant information. One of the posts says the following:
Which of the following BEST describes the attack that was attempted against the forum readers?
- A. API attack
- B. DLL attack
- C. SOU attack
- D. XSS attack
Answer: D
NEW QUESTION # 248
Which of the following is the MOST secure but LEAST expensive data destruction method for data that is stored on hard drives?
- A. Pulverizing
- B. Incinerating
- C. Shredding
- D. Degaussing
Answer: C
Explanation:
Another form of physical destruction, shredding may be the most secure and cost-effective way to destroy electronic data in any media that contain hard drives or solid state drives and have reached their end-of-life. It's also very effective for optical drives, smartphones, tablets, motherboards, thumb drives and credit card swipe devices, to name a few.
Shredding is a great way to destroy data if you have a large data enterprise center or a large stockpile of old hard drives and media that you want to destroy. It's very secure, fast and efficient. Shredding reduces electronic devices to pieces no larger than 2 millimeters. If you work in a high-security environment with high-security data, shredding should be your number one choice as it guarantees that all data is obliterated.
https://dataspan.com/blog/what-are-the-different-types-of-data-destruction-and-which-one-should-you-use/
NEW QUESTION # 249
Employees in the research and development business unit receive extensive training 10 ensure they understand how to best protect company data. Which of the following is the type of data these employees are most likely to use in day-to-day work activities?
- A. Data in transit
- B. Encrypted
- C. Intellectual property
- D. Critical
Answer: C
Explanation:
Explanation
Intellectual property is a type of data that is proprietary and unique to an organization. It includes trade secrets and other information that the organization does not want to share with third parties or competitors. Employees in the research and development business unit are most likely to use intellectual property in their day-to-day work activities, as they are involved in creating new products, services, or processes for the organization.
Intellectual property data requires a high level of security and protection, as it can provide a competitive advantage or disadvantage if leaked or stolen.
Encrypted data is not a type of data, but a state of data. Encryption is a method of transforming data into an unreadable format using a key, so that only authorized parties can access it. Encryption can be applied to any type of data, such as intellectual property, critical data, or data in transit.
Critical data is a type of data that is essential for the operation and continuity of an organization. It includes information such as customer records, financial transactions, employee details, and so on. Critical data may or may not be intellectual property, depending on the nature and source of the data. Critical data also requires a high level of security and protection, as it can affect the reputation, performance, or legal compliance of the organization.
Data in transit is not a type of data, but a state of data. Data in transit refers to data that is moving from one location to another over a network, such as the internet, a LAN, or a WAN. Data in transit can be vulnerable to interception, modification, or theft by malicious actors. Data in transit can also be any type of data, such as intellectual property, critical data, or PII.
NEW QUESTION # 250
......
SY0-601 Questions Prepare with Learning Information: https://www.dumpexams.com/SY0-601-real-answers.html
Download SY0-601 Mock Test Study Material: https://drive.google.com/open?id=1sB9j_2odtMLdx7EkyWqVubhLFZlEFm6U