CompTIA SY0-501 Online Practice Questions and Exam Preparation

CompTIA SY0-501 Online Questions & Answers

• Question 731:

  Which of the following is the summary of loss for a given year?

  A. MTBF
  B. ALE
  C. SLA
  D. ARO
  B. ALE

• Question 732:

  A cryptographer has developed a new proprietary hash function for a company and solicited employees to test the function before recommending its implementation. An employee takes the plaintext version of a document and hashes it, then changes the original plaintext document slightly and hashes it, and continues repeating this process until two identical hash values are produced from two different documents. Which of the following BEST describes this cryptographic attack?

  A. Brute force
  B. Known plaintext
  C. Replay
  D. Collision
  D. Collision

• Question 733:

  Users are attempting to access a company's website but are transparently redirected to another website. The users confirm the URL is correct. Which of the following would BEST prevent this issue in the future?

  A. DNSSEC
  B. HTTPS
  C. IPSec
  D. TLS/SSL
  A. DNSSEC

• Question 734:

  An organization hosts a public-facing website that contains a login page for users who are registered and authorized to access a secure, non-public section of the site. That non-public site hosts information that requires multifactor authentication for access.

  Which of the following access management approaches would be the BEST practice for the organization?

  A. Username/password with TOTP
  B. Username/password with pattern matching
  C. Username/password with a PIN
  D. Username/password with a CAPTCHA
  D. Username/password with a CAPTCHA

• Question 735:

  When considering IoT systems, which of the following represents the GREATEST ongoing risk after a vulnerability has been discovered?

  A. Difficult-to-update firmware
  B. Tight integration to existing systems
  C. IP address exhaustion
  D. Not using industry standards
  B. Tight integration to existing systems

• Question 736:

  A penetration tester harvests potential usernames from a social networking site. The penetration tester then uses social engineering to attempt to obtain associated passwords to gain unauthorized access to shares on a network server.

  Which of the following methods is the penetration tester MOST likely using?

  A. Escalation of privilege
  B. SQL injection
  C. Active reconnaissance
  D. Proxy server
  C. Active reconnaissance

• Question 737:

  Which of the following are disadvantages of full backups? (Choose three.)

  A. They rely on other backups for recovery
  B. They require the most storage
  C. They demand the most bandwidth
  D. They have the slowest recovery time
  E. They are impossible in virtual environments
  F. They require on-site storage
  G. They are time-consuming to complete
  B. They require the most storage
  D. They have the slowest recovery time
  G. They are time-consuming to complete

• Question 738:

  Which of the following controls allows a security guard to perform a post-incident review?

  A. Detective
  B. Preventive
  C. Corrective
  D. Deterrent
  C. Corrective

• Question 739:

  A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:

  A. validate the vulnerability exists in the organization's network through penetration testing.
  B. research the appropriate mitigation techniques in a vulnerability database.
  C. find the software patches that are required to mitigate a vulnerability.
  D. prioritize remediation of vulnerabilities based on the possible impact.
  D. prioritize remediation of vulnerabilities based on the possible impact.

• Question 740:

  During certain vulnerability scanning scenarios, It is possible for the target system to react in unexpected ways. This type of scenario is MOST commonly known as:

  A. intrusive testing.
  B. a butter overflow.
  C. a race condition
  D. active reconnaissance.
  D. active reconnaissance.