CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 111:

  An organization is developing a plan in the event of a complete loss of critical systems and data. Which of the following plans is the organization MOST likely developing?

  A. Incident response
  B. Communications
  C. Disaster recovery
  D. Data retention
  C. Disaster recovery

• Question 112:

  An administrator is investigating an incident and discovers several usersA. Malicious flash drive
  B. Remote access Trojan
  C. Brute-forced password
  D. Cryptojacking

  B. Remote access Trojan

  ---

  A remote access trojan (RAT) - are typically downloaded together with a seemingly legitimate program, like a game, or are sent to the target as an email attachment. RATs can allow attackers to remotely control the infected machines, access files, and bypass security measures without causing noticeable performance issues or failed logins.

• Question 113:

  A systems administrator is auditing all company servers to ensure they meet the minimum security baseline. While auditing a Linux server, the systems administrator observes the /etc/shadow file has permissions beyond the baseline recommendation.

  Which of the following commands should the systems administrator use to resolve this issue?

  A. chmod
  B. grep
  C. dd
  D. passwd
  A. chmod

• Question 114:

  Which of the following will MOST likely cause machine-learning and AI-enabled systems to operate with unintended consequences?

  A. Stored procedures
  B. Buffer overflows
  C. Data bias
  D. Code reuse
  C. Data bias

• Question 115:

  A security analyst is concerned about traffic initiated to the dark web form the corporate LAN. Which of the following networks should the analyst monitor?

  A. SFTP
  B. AS
  C. Tor
  D. LoC
  C. Tor

  ---

  TOR is a dark web browser

• Question 116:

  A network analyst is investigating compromised corporate information. The analyst leads to a theory that network traffic was intercepted before being transmitted to the internet. The following output was captured on an internal host:

  

  Based on the IoCS, which of the following was the MOST likely attack used to compromise the network communication?

  A. Denial of service
  B. ARP poisoning
  C. Command injection
  D. MAC flooding
  D. MAC flooding

• Question 117:

  Which of the following is an effective tool to stop or prevent the exfiltration of data from a network?

  A. DLP
  B. NIDS
  C. TPM
  D. FDE
  A. DLP

  ---

  Data loss prevention (DLP) makes sure that users do not send sensitive or critical information outside the corporate network

• Question 118:

  An incident, which is affecting dozens of systems, involves malware that reaches out to an Internet service for rules and updates. The IP addresses for the Internet host appear to be different in each case. The organization would like to determine a common IoC to support response and recovery actions. Which of the following sources of information would BEST support this solution?

  A. Web log files
  B. Browser cache
  C. DNS query logs
  D. Antivirus
  C. DNS query logs

  ---

  Explanation Explanation/Reference:A. Web Log Files - this can be eliminated because web log files are only viewable by the website's owner. We are not the owner, thus this is not useful to us. B. Browser Cache - this can be eliminated because the malware does not communicate through the browser. C. DNS query logs - the malware reaches out to an internet service. This will be logged in the DNS query logs. D. Antivirus - I don't think this solution is that bad, but what if the antivirus does not detect the malware? An antivirus, in this case, is not reliable for detecting indicators of compromise.

• Question 119:

  The application development teams have been asked to answer the followingQuestions:

  ? Does this application receive patches from an external source?

  ? Does this application contain open-source code?

  ? Is this application accessible by external users?

  ? Does this application meet the corporate password standard?

  Which of the following are theseQuestions part of?

  A. Risk control self-assessment
  B. Risk management strategy
  C. Risk acceptance
  D. Risk matrix
  A. Risk control self-assessment

• Question 120:

  A store receives reports that shoppers' credit card information is being stolen. Upon further analysis, those same shoppers also withdrew money from an ATM in that store.

  The attackers are using the targeted shoppers' credit card information to make online purchases.

  Which of the following attacks is the MOST probable cause?

  A. Identity theft
  B. RFID cloning
  C. Shoulder surfing
  D. Card skimming
  D. Card skimming