CompTIA CompTIA Certifications SY0-501 Questions & Answers

• Question 501:

  On which of the following is the live acquisition of data for forensic analysis MOST dependent? (Select TWO).

  A. Data accessibility

  B. Legal hold

  C. Cryptographic or hash algorithm

  D. Data retention legislation

  E. Value and volatility of data

  F. Right-to-audit clauses

  Correct Answer: CD

• Question 502:

  Which of the following is the primary reason for implementing layered security measures in a cyber security architecture?

  A. it increases the number of controls required to subvert a system.

  B. It decreases the tone a CERT has to respond to a security Incident.

  C. It alleviates problems associated with EOL equipment replacement.

  D. It allows for bandwidth upgrades to be made without user disruption.

  Correct Answer: B

• Question 503:

  An organization is struggling to differentiate threats from normal traffic and access to systems A security engineer has been asked to recommend a system that will aggregate data and provide metrics that will assist in Identifying malicious actors or other anomalous activity throughout the environment. Which of the following solutions should the engineer recommend?

  A. Web application firewall

  B. SIEM

  C. IPS

  D. UTM

  E. File integrity monitor

  Correct Answer: B

• Question 504:

  A systems administrator wants to replace the process of using a CRL to verify certificate validity. Frequent downloads are becoming problematic. Which of the following would BEST suit the administrator's needs?

  A. OCSP

  B. CSR

  C. Key escrow

  D. CA

  Correct Answer: A

• Question 505:

  A network technician needs to monitor and view the websites that are visited by an employee. The employee Is connected to a network switch.

  Which of the following would allow the technician to monitor the employee's web traffic?

  A. Implement promiscuous mode on the NIC of the employee's computer.

  B. Install and configure a transparent proxy server.

  C. Run a vulnerability scanner to capture DNS packets on the router.

  D. Configure a VPN to forward packets to the technician's computer.

  Correct Answer: B

• Question 506:

  Which of the following control types are alerts sent from a SIEM fulfilling based on vulnerably signatures?

  A. Preventive

  B. Corrective

  C. Compensating

  D. Detective

  Correct Answer: D

• Question 507:

  A retail executive recently accepted a job with a major competitor. The following week, a security analyst reviews the security logs and Identifies successful logon attempts to access the departed executive's accounts.

  Which of the following security practices would have addressed the issue?

  A. A non-disclosure agreement

  B. Least privilege

  C. An acceptable use policy

  D. Off boarding

  Correct Answer: B

• Question 508:

  A company is having Issues with intellectual property being sent to a competitor from its system. The information being sent Is not random but has an identifiable pattern. Which of the following should be implemented in the system to stop the content from being sent?

  A. Encryption

  B. Hashing

  C. IPS

  D. DLP

  Correct Answer: D

• Question 509:

  If a current private key is compromised, which of the following would ensure it cannot be used to decrypt all historical data?

  A. Perfect forward secrecy

  B. Elliptic-curve cryptography

  C. Key stretching

  D. Homomorphic encryption

  Correct Answer: D

• Question 510:

  Which of the following disaster recovery sites would require the MOST time to get operations beck online?

  A. Colocation

  B. Cold

  C. Hot

  D. Warm

  Correct Answer: B