CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 1051:

  Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario?

  A. Watering-hole attack

  B. Credential harvesting

  C. Hybrid warfare

  D. Pharming

  Correct Answer: A

  watering hole attack --> An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

• Question 1052:

  While checking logs, a security engineer notices a number of end users suddenly downloading files with the .tar.gz extension. Closer examination of the files reveals they are PE32 files. The end users state they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an external email containing an infected MHT file with an href link a week prior. Which of the following is MOST likely occurring?

  A. A RAT was installed and is transferring additional exploit tools.

  B. The workstations are beaconing to a command-and-control server.

  C. A logic bomb was executed and is responsible for the data transfers.

  D. A fireless virus is spreading in the local network environment

  Correct Answer: A

  "A remote access Trojan (RAT) is a type of malware that allows attackers to control systems from remote locations. It is often delivered via drive-by downloads or malicious attachments in email. Once installed on a system, attackers can then

  access the infected computer at any time and install additional malware if desired.

  A growing trend is for attackers to deliver trojans as Portable Executable (PE) files in 32-bit (PE32) and 64-bit (PE64) formats. They often compress the PE files using compression tools, such as tar (sometimes called tarball). Tar files have

  the .tar.gz file extension."

  taken from darril gibson S+ study guide. answer= RAT

• Question 1053:

  Which of the following would cause a Chief Information Security Officer (CISO) the MOST concern regarding newly installed Internet-accessible 4K surveillance cameras?

  A. An inability to monitor 100% of every facility could expose the company to unnecessary risk.

  B. The cameras could be compromised if not patched in a timely manner.

  C. Physical security at the facility may not protect the cameras from theft.

  D. Exported videos may take up excessive space on the file servers.

  Correct Answer: B

  A is wrong, Newly installed 4k cameras or newly installed potato camera's makes no difference. All cameras solutions inevitably lead to deadspots. This is common knowledge so wouldn't cause the MOST concern. B is right particularly

  because they are "Internet Accesible", and a 4K camera. So the most concerning thing is that these cameras are accesible to those who are not authorized for it.

  C Physical security will not prevent theft of the cameras, but their theft is an acceptable risk.

  D A CISO isn't bothered by the excessive space of the HQ video files. That is someone elses job to worry about.

• Question 1054:

  In which of the following common use cases would steganography be employed?

  A. Obfuscation

  B. Integrity

  C. Non-repudiation

  D. Blockchain

  Correct Answer: A

  https://www.professormesser.com/security-plus/sy0-501/steganography-3/

• Question 1055:

  A user recent an SMS on a mobile phone that asked for bank delays. Which of the following social-engineering techniques was used in this case?

  A. SPIM

  B. Vishing

  C. Spear phishing

  D. Smishing

  Correct Answer: D

• Question 1056:

  A large enterprise has moved all Hs data to the cloud behind strong authentication and encryption A sales director recently had a laptop stolen and later, enterprise data was round to have been compromised database.

  Which of the following was the MOST likely cause?

  A. Shadow IT

  B. Credential stuffing

  C. SQL injection

  D. Man-in-the-browser

  E. Bluejacking

  Correct Answer: A

  While SQL Injection might be one way that enterprise data from the local database was compromised, an attacker could simple have hacked into the person machine and opened up the local database to steal the data. SQL Injection is possible, but is not MOST Likely. You need to ask the question: If the enterprise has moved everything into the cloud, then the only reason there is a local database on the person's machine is because they installed the database. They installed an application on their local machine when they should have been using an application on the company's cloud. That, in its definition, is shadow IT.

• Question 1057:

  A network administrator is setting up wireless access points in all the conference rooms and wants to authenticate device using PKI. Which of the following should the administrator configure?

  A. A captive portal

  B. PSK

  C. 802.1X

  D. WPS

  Correct Answer: C

  Using a PKI for Wi-Fi authentication requires using the 802.1x standard for network access https://www.securew2.com/blog/configuring-pki-wi-fi

• Question 1058:

  An analyst needs to identify the applications a user was running and the files that were open before the user's computer was shut off by holding down the power button. Which of the following would MOST likely contain that information?

  A. NGFW

  B. Pagefile

  C. NetFlow

  D. RAM

  Correct Answer: B

• Question 1059:

  A systems administrator is considering different backup solutions for the IT infrastructure.

  The company is looking for a solution that offers the fastest recovery time while also saving the most amount of storage used to maintain the backups.

  Which of the following recovery solutions would be the BEST option to meet these requirements?

  A. Snapshot

  B. Differentiated

  C. Full

  D. Tape

  Correct Answer: B

  A snapshot is not a back up. If your machine goes down so do the backups. Also microsoft might delete all your snapshots if you I/O is too high or the storage is low and they are saved on the same drive. Because it stakes "saving most amount of storage", I believe its B. Once you have the full back up, you would do differentials. If you did full backups daily, you will run out of storage soon. Tape is long recovery.

• Question 1060:

  A security analyst is logged into a Windows file server and needs to see who is accessing files and from which computers Which of the following tools should the analyst use?

  A. netstat

  B. net share

  C. netcat

  D. nbtstat

  E. net session

  Correct Answer: A