CompTIA CompTIA Certifications SY0-501 Questions & Answers

• Question 1211:

  A company is determining where to host a hot site, and one of the locations being considered is in another country. Which of the following should be considered when evaluating this option?

  A. Mean RTO

  B. Mean RPO

  C. Data sovereignty

  D. Data destruction laws

  E. Backup media recycling policies

  Correct Answer: C

• Question 1212:

  A security analyst wants to prevent current employees who previously worked in different departments from accessing resources that are no longer necessary for their present job roles. Which of the following policies would meet this objective?

  A. Job rotation

  B. Discretionary account

  C. Least privilege

  D. Mandatory vacation

  E. Separation of duties

  Correct Answer: C

• Question 1213:

  A user's laptop is experiencing general slowness following the user's return from an extended time out of the office. After a week, the security team looks at the laptop, but nothing appears out of order. The only noticeable issue is that svchost.exe keeps launching even after the security team kills the process. After running netstat, the team notes svchost.exe is listening on port 443. Using an IoC creation tool, a security analyst does the following:

  OR-File MD5 contains adf321122abce28873aad3e12f262a12c AND PROCESS name contains svchost.exe PROCESS arguments does not contain -k AND FILENAME contains svchost.exe FILE DIRECTORY is not %system32%

  Based on the IoCs created and the netstat output, which of the following types of malware is present?

  A. Backdoor

  B. Crypto-malware

  C. Rootkit

  D. Logic bomb

  Correct Answer: C

• Question 1214:

  Which of the following generates reports that show the number of systems that are associated with POODLE, 3DES, and SMBv1 listings?

  A. A protocol analyzer

  B. A UTM appliance

  C. A vulnerability scanner

  D. A honeypot

  Correct Answer: C

• Question 1215:

  During incident response procedures, technicians capture a unique identifier for a piece of malware running in memory. This captured information is referred to as:

  A. a hash value.

  B. the SSID.

  C. the GUID.

  D. a system image.

  Correct Answer: A

• Question 1216:

  A new PKI is being built at a company, but the network administrator has concerns about spikes of traffic occurring twice a day due to clients checking the status of the certificates. Which of the following should be implemented to reduce the spikes in traffic?

  A. CRL

  B. OCSP

  C. SAN

  D. OID

  Correct Answer: B

• Question 1217:

  Which of the following enables a corporation to extend local security policies to corporate resources hosted in a CSP's infrastructure?

  A. PKI

  B. CRL

  C. Directory services

  D. CASB

  E. VDI

  Correct Answer: D

• Question 1218:

  An organization with very high security needs wants to implement a biometric system. It is required to minimize unauthorized access by ensuring authorized personnel are not denied access. Which of the following solutions will work?

  A. A device with a low false acceptance rate and a high false rejection rate

  B. A device with a high false acceptance rate and a high false rejection rate

  C. A device with a high false acceptance rate and a low false rejection rate

  D. A device with a low false acceptance rate and a low false rejection rate

  Correct Answer: D

• Question 1219:

  A company help desk has received several reports that employees have experienced identity theft and compromised accounts. This occurred several days after receiving an email asking them to update their personal bank information. Which of the following is a vulnerability that has been exploited?

  A. Trojan horses

  B. Phishing

  C. Improperly configured accounts

  D. Forged certificates

  E. Untrained users

  Correct Answer: E

• Question 1220:

  A penetration tester has been hired to scan a company's network for potentially active hosts. The company's IPS system blocks the ICMP echo reply and echo request packets. Which of the following can be used to scan the network?

  A. OSPF

  B. ARP

  C. IPSec

  D. Ping

  Correct Answer: B