CompTIA SY0-501 Online Practice Questions and Exam Preparation

CompTIA SY0-501 Online Questions & Answers

• Question 501:

  Staff members of an organization received an email message from the Chief Executive Officer (CEO) asking them for an urgent meeting in the main conference room. When the staff assembled, they learned the message received was not actually from the CEO. Which of the following BEST represents what happened?

  A. Spear phoshing attack
  B. Whaling attack
  C. Phishing attack
  D. Vishing attack
  A. Spear phoshing attack

• Question 502:

  A user needs to transmit confidential information to a third party. Which of the following should be used to encrypt the message?

  A. AES
  B. SHA-2
  C. SSL
  D. RSA
  A. AES

• Question 503:

  A security administrator has completed a monthly review of DNS server query logs. The administrator notices continuous name resolution attempts from a large number of internal hosts to a single Internet addressable domain name. The security administrator then correlated those logs with the establishment of persistent TCP connections out to this domain. The connections seem to be carrying on the order of kilobytes of data per week.

  Which of the following is the MOST likely explanation for this company?

  A. An attacker is infiltrating large amounts of proprietary company data.
  B. Employees are playing multiplayer computer games.
  C. A worm is attempting to spread to other hosts via SMB exploits.
  D. Internal hosts have become members of a botnet.
  D. Internal hosts have become members of a botnet.

• Question 504:

  Which of the following should a technician use to protect a cellular phone that is needed for an investigation, to ensure the data will not be removed remotely?

  A. Air gap
  B. Secure cabinet
  C. Faraday cage
  D. Safe
  C. Faraday cage

• Question 505:

  During a recent audit, it was discovered that several user accounts belonging to former employees were still active and had valid VPN permissions. Which of the following would help reduce the amount of risk the organization incurs in this situation in the future?

  A. Time-of-day restrictions
  B. User access reviews
  C. Group-based privileges
  D. Change management policies
  B. User access reviews

• Question 506:

  A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them.

  Select and Place:

  

  

  ---

  When dealing with multiple issues, address them in order of volatility (OOV); always deal with the most volatile first. Volatility can be thought of as the amount of time that you have to collect certain data before a window of opportunity is gone.

  Naturally, in an investigation you want to collect everything, but some data will exist longer than others, and you cannot possibly collect all of it once. As an example, the OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and

  printouts.

  Order of volatility: Capture system images as a snapshot of what exists, look at network traffic and logs, capture any relevant video/screenshots/hashes, record time offset on the systems, talk to witnesses, and track total man-hours and

  expenses associated with the investigation.

• Question 507:

  An administrator is setting up automated remote file transfers to another organization. The other organization has the following requirements for the connection protocol.

  Encryption in transit is required

  Mutual authentication must be used.

  Certificate authentication must be used {no passwords).

  Which of the following should the administrator choose?

  A. SNMPv3
  B. SFTP
  C. TLS
  D. LDAPS
  E. SRTP
  B. SFTP

• Question 508:

  A group of non-profit agencies wants to implement a cloud service to share resources with each other and minimize costs. Which of the following cloud deployment models BEST describes this type of effort?

  A. Public
  B. Hybrid
  C. Community
  D. Private
  C. Community

• Question 509:

  An organization uses simulated phishing attacks on its users to better prepare them to recognize actual phishing attacks and get them accustomed to reporting the attacks to the security team. This is an example of:

  A. baselining
  B. user training
  C. stress testing
  D. continuous monitoring
  B. user training

• Question 510:

  In the event of a security incident, which of the following should be captured FIRST?

  A. An external hard drive
  B. System memory
  C. An internal hard drive
  D. Network interface data
  B. System memory