SY0-601 Real Exam Questions and Verified Answers

Question 1 Single choice

A security incident has been resolved

Which of the following BEST describes the importance of the final phase of the incident response plan?

A
It examines and documents how well the team responded discovers what caused the incident, and determines how the incident can be avoided in the future
B
It returns the affected systems back into production once systems have been fully patched, data restored and vulnerabilities addressed
C
It identifies the incident and the scope of the breach how it affects the production environment, and the ingress point
D
It contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach

Show answer and explanation

Correct answer: A

Explanation

It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.

The final phase of the incident response is also called the lessons learned or remediation step.
=======================
Phases of the Incident Response Plan:
1. Preparation - Preparing for an attack and how to respond
2. Identification - Identifying the threat
3. Containment - Containing the threat
4. Eradication - Removing the threat
5. Recovery - Recovering affected systems
6. Lessons Learned - Evaluating the incident response, see where there can be improvements for a future incident.

Question 2 Single choice

Since a recent upgrade to a WLAN infrastructure, several mobile users have been unable to access the internet from the lobby. The networking team performs a heat map survey of the building and finds several WAPs in the area. The WAPs are using similar frequencies with high power settings.

Which of the following installation considerations should the security team evaluate next?

A
Channel overlap
B
Encryption type
C
New WLAN deployment
D
WAP placement

Show answer and explanation

Correct answer: A

Question 3 Single choice

The website http://companywebsite.com requires users to provide personal information, including security question responses, for registration.

Which of the following would MOST likely cause a data breach?

A
Lack of input validation
B
Lack of input validation
C
Unsecure protocol
D
Missing patches

Show answer and explanation

Correct answer: C

Explanation

Website is using HTTP which is the unsecure protocol of HTTP

Question 4 Single choice

Which of the following represents a biometric FRR?

A
Authorized users being denied access
B
Users failing to enter the correct PIN
C
The denied and authorized numbers being equal
D
The number of unauthorized users being granted access

Show answer and explanation

Correct answer: A

Explanation

This is from chapter Authentication and Authorization, The false rejection rate (FRR) determines level false negatives, or rejections

Question 5 Single choice

After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network.

Which of the following is the most appropriate to disable?

A
Console access
B
Routing protocols
C
VLANs
D
Web-based administration

Show answer and explanation

Correct answer: D

Explanation

Web based Administration, cannot disable the rest of the options.

Question 6 Single choice

A security administrator is compiling information from all devices on the local network in order to gain better visibility into user activities.

Which of the following is the best solution to meet this objective?

A
SIEM
B
HIDS
C
CASB
D
EDR

Show answer and explanation

Correct answer: A

Explanation

SIEM stands for Security Information and Event Management, which is a solution that can collect, correlate, and analyze security logs and events from various devices on a network. SIEM can provide better visibility into user activities by generating reports, alerts, dashboards, and metrics. SIEM can also help detect and respond to security incidents, comply with regulations, and improve security posture.

Question 7 Single choice

A company was recently breached Pan of the company's new cybersecurity strategy is to centralize? the
togs horn all security devices.

Which of the following components forwards the logs to a central source?

A
Log enrichment
B
Log queue
C
Log parser
D
Log collector

Show answer and explanation

Correct answer: D

Explanation

A log collector is a component that forwards the logs from all security devices to a central source. A log collector can be a software tool or a hardware appliance that collects logs from various sources, such as firewalls, routers, servers, applications, or endpoints. A log collector can also perform functions such as log filtering, parsing, aggregation, normalization, and enrichment. A log collector can help centralize logging by sending the collected logs to a central log server or a security information and event management (SIEM) system for further analysis and correlation.

References:
https://www.comptia.org/certifications/security#examdetails
https://www.comptia.org/content/guides/comptia-security-sy0-
601-exam-objectives (https://geekflare.com/open-source-centralized-logging/)

Question 8 Single choice

An enterprise has hired an outside security firm to facilitate penetration testing on its network and applications. The firm has agreed to pay for each vulnerability that is discovered.

Which of the following BEST represents the type of testing that is being used?

A
White-box
B
Red-team
C
Bug bounty
D
Gray-box
E
Black-box

Show answer and explanation

Correct answer: B

Explanation

Definitions from the most up to date Comptia handbook.

bug bounty=Reward scheme operated by software and web services vendors for reporting vulnerabilities.
Where a pen test is performed on a contractual basis, costed by the consultant, a bug bounty program is a way of crowd sourcing detection of vulnerabilities. Some bug bounties are operated as internal programs, with rewards for employees only. Most are open to public submissions (tripwire.com/state-of-security/ security-data-protection/cyber-security/essential-bug-bounty-programs).

red team=The "hostile" or attacking team in a penetration test or incident response exercise.

Question 9 Single choice

A network architect wants a server to have the ability to retain network availability even if one of the network switches it is connected to goes down.

Which of the following should the architect implement on the server to achieve this goal?

A
RAID
B
UPS
C
NIC teaming
D
Load balancing

Show answer and explanation

Correct answer: C

Question 10 Single choice

A backdoor was detected on the containerized application environment. The investigation detected that a zero-day vulnerability was introduced when the latest container image version was downloaded from a public registry.

Which of the following is the BEST solution to prevent this type of incident from occurring again?

A
Enforce the use of a controlled trusted source of container images
B
Deploy an IPS solution capable of detecting signatures of attacks targeting containers
C
Define a vulnerability scan to assess container images before being introduced on the environment
D
Create a dedicated VPC for the containerized environment

Show answer and explanation

Correct answer: A

Explanation

Enforcing the use of a controlled and trusted source of container images is the best solution to prevent incidents like the one described. When using containerized applications, it is crucial to ensure that the container images come from trusted sources, such as a private container registry, where the images are scanned for vulnerabilities and controlled by the organization. This way, the risk of downloading images with zero-day vulnerabilities or other malicious code from public registries is minimized.