CompTIA CompTIA Certifications SY0-501 Questions & Answers

• Question 531:

  A small business just recovered from a ransomware attack against its file servers by purchasing the decryption keys from the attackers. The issue was triggered by a phishing email and IT administrator wants to ensure it does not happen again. Which of the following should the IT administrator do FIRST after recovery?

  A. Scan the NAS for residual or dormant malware and take new daily backups that are tested on a frequent basis.

  B. Restrict administrative privileges and patch all systems and applications.

  C. Rebuild all workstations and install new antivirus software.

  D. Implement application whitelisting and perform user application hardening.

  Correct Answer: A

• Question 532:

  The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and server. Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in the future?

  A. Install a NIDS device at the boundary.

  B. Segment the network with firewalls.

  C. Update all antivirus signatures daily.

  D. Implement application blacklisting.

  Correct Answer: B

• Question 533:

  Which of the following is the BEST use of a WAF?

  A. To protect sites on web servers that are publicly accessible

  B. To allow access to web services of internal users of the organization

  C. To maintain connection status of all HTTP requests

  D. To deny access to all websites with certain contents

  Correct Answer: A

• Question 534:

  An organization is developing its mobile device management policies and procedures and is concerned about vulnerabilities that are associated with sensitive data being saved to a mobile device, as well as weak authentication when using a PIN. As part of some discussions on the topic, several solutions are proposed. Which of the following controls, when required together, will address the protection of data-at-rest as well as strong authentication? (Choose two.)

  A. Containerization

  B. FDE

  C. Remote wipe capability

  D. MDM

  E. MFA

  F. OTA updates

  Correct Answer: BE

• Question 535:

  A government agency with sensitive information wants to virtualize its infrastructure. Which of the following cloud deployment models BEST fits the agency's needs?

  A. Public

  B. Community

  C. Private

  D. Hybrid

  Correct Answer: C

• Question 536:

  A user loses a COPE device. Which of the following should the user do NEXT to protect the data on the device?

  A. Call the company help desk to remotely wipe the device.

  B. Report the loss to authorities.

  C. Check with corporate physical security for the device.

  D. Identify files that are potentially missing on the device.

  Correct Answer: A

• Question 537:

  Which of the following would provide a safe environment for an application to access only the resources needed to function while not having access to run at the system level?

  A. Sandbox

  B. Honeypot

  C. GPO

  D. DMZ

  Correct Answer: A

• Question 538:

  Which of the following attacks is used to capture the WPA2 handshake?

  A. Replay

  B. IV

  C. Evil twin

  D. Disassociation

  Correct Answer: D

• Question 539:

  A company is implementing MFA for all applications that store sensitive data. The IT manager wants MFA to be non-disruptive and user friendly. Which of the following technologies should the IT manager use when implementing MFA?

  A. Onetime passwords

  B. Email tokens

  C. Push notifications

  D. Hardware authentication

  Correct Answer: C

• Question 540:

  Which of the following is a benefit of credentialed vulnerability scans?

  A. Credentials provide access to scan documents to identify possible data theft.

  B. The vulnerability scanner is able to inventory software on the target.

  C. A scan will reveal data loss in real time.

  D. Black-box testing can be performed.

  Correct Answer: B