CompTIA SY0-501 Online Practice Questions and Exam Preparation

CompTIA SY0-501 Online Questions & Answers

• Question 1021:

  A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

  A. Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis.
  B. Restrict administrative privileges and patch all systems and applications.
  C. Rebuild all workstations and install new antivirus software.
  D. Implement application whitelisting and perform user application hardening.
  A. Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis.

• Question 1022:

  An incident response analyst at a large corporation is reviewing proxy log data.

  The analyst believes a malware infection may have occurred. Upon further review, the analyst determines the computer responsible for the suspicious network traffic is used by the Chief Executive Officer (CEO). Which of the following is the

  best NEXT step for the analyst to take?

  A. Call the CEO directly to ensure awareness of the event
  B. Run a malware scan on the CEO's workstation
  C. Reimage the CEO's workstation
  D. Disconnect the CEO's workstation from the network.
  D. Disconnect the CEO's workstation from the network.

• Question 1023:

  Which of the following is an example of resource exhaustion?

  A. A penetration tester requests every available IP address from a DHCP server.
  B. A SQL injection attack returns confidential data back to the browser.
  C. Server CPU utilization peaks at 100% during the reboot process
  D. System requirements for a new software package recommend having 12GB of RAM, but only 8GB are available.
  A. A penetration tester requests every available IP address from a DHCP server.

• Question 1024:

  A network administrator was recently terminated. A few weeks later, the new administrator noticed unauthorized changes to several devices that are causing denial of services. Additionally, the administrator noticed an unusual connection from an external IP address to an internal server. Which of the following is the MOST likely cause of the problem?

  A. Spyware
  B. Virus
  C. Ransomware
  D. Backdoor
  D. Backdoor

• Question 1025:

  Which of the following scenarios BEST describes an implementation of non-repudiation?

  A. A user logs into a domain workstation and access network file shares for another department
  B. A user remotely logs into the mail server with another user's credentials
  C. A user sends a digitally signed email to the entire finance department about an upcoming meeting
  D. A user access the workstation registry to make unauthorized changes to enable functionality within an application
  C. A user sends a digitally signed email to the entire finance department about an upcoming meeting

• Question 1026:

  A security analyst wishes to increase the security of an FTP server. Currently, all traffic to the FTP server is unencrypted. Users connecting to the FTP server use a variety of modern FTP client software. The security analyst wants to keep the same port and protocol, while also still allowing unencrypted connections. Which of the following would BEST accomplish these goals?

  A. Require the SFTP protocol to connect to the file server.
  B. Use implicit TLS on the FTP server.
  C. Use explicit FTPS for connections.
  D. Use SSH tunneling to encrypt the FTP traffic.
  C. Use explicit FTPS for connections.

• Question 1027:

  Which of the following terms BEST describes an exploitable vulnerability that exists but has not been publicly disclosed yet?

  A. Design weakness
  B. Zero-day
  C. Logic bomb
  D. Trojan
  B. Zero-day

• Question 1028:

  When attackers use a compromised host as a platform for launching attacks deeper into a company's network, it is said that they are:

  A. escalating privilege
  B. becoming persistent
  C. fingerprinting
  D. pivoting
  D. pivoting

• Question 1029:

  A user's laptop is experiencing general slowness following the user's return from an extended time out of the office. After a week, the security team looks at the laptop, but nothing appears out of order. The only noticeable issue is that svchost.exe keeps launching even after the security team kills the process. After running netstat, the team notes svchost.exe is listening on port 443. Using an IoC creation tool, a security analyst does the following:

  OR-File MD5 contains adf321122abce28873aad3e12f262a12c AND PROCESS name contains svchost.exe PROCESS arguments does not contain -k AND FILENAME contains svchost.exe FILE DIRECTORY is not %system32%

  Based on the IoCs created and the netstat output, which of the following types of malware is present?

  A. Backdoor
  B. Crypto-malware
  C. Rootkit
  D. Logic bomb
  C. Rootkit

• Question 1030:

  A contracting company recently completed its period of performance on a government contract and would like to destroy all information associated with contract performance. Which of the following is the best NEXT step for the company to take?

  A. Consult data disposition policies in the contract.
  B. Use a pulper or pulverizer for data destruction
  C. Retain the data for a period no more than one year
  D. Burn hard copies containing Pll or PHI.
  A. Consult data disposition policies in the contract.