CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 1221:

  A security analyst has been asked by the Chief Information Security Officer to ?develop a secure method of providing centralized management of infrastructure

  1.

  reduce the need to constantly replace aging end user machines

  2.

  provide a consistent user desktop expenence Which of the following BEST meets these requirements?

  A. BYOD
  B. Mobile device management
  C. VDI
  D. Containers ation
  C. VDI

  ---

  Virtual Desktop Infrastructure (VDI) is a technology that refers to the use of virtual machines to provide and manage virtual desktops. VDI hosts desktop environments on a centralized server and deploys them to end-users on request.

• Question 1222:

  Which of the following security controls can be used to prevent multiple from using a unique card swipe and being admitted to a entrance?

  A. Visitor logs
  B. Faraday cages
  C. Access control vestibules
  D. Motion detection sensors
  C. Access control vestibules

  ---

  Access control vestibules are physical security controls that consist of two sets of doors or gates that create a small enclosed space between them. Only one door or gate can be opened at a time, and only one person can enter or exit the vestibule at a time. Access control vestibules can prevent multiple people from using a unique card swipe and being admitted to a secure entrance, as they require each person to authenticate individually and prevent tailgating or piggybacking.

• Question 1223:

  A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-service in a report to the management team. Which of the following best describes the threat actor in the CISO's report?

  A. Insider threat
  B. Hacktivist
  C. Nation-state
  D. Organized crime
  D. Organized crime

  ---

  The threat actor described in the report, "ransomware-as-a-service," is associated with organized crime. Ransomware-as-a-service (RaaS) is a type of cybercrime where criminal groups develop and distribute ransomware tools and infrastructure to other individuals or groups in exchange for a share of the profits. This allows script kiddies to conduct ransomware attacks, while the developers behind the RaaS schemes handle the technical aspects and receive a portion of the ransom payments as revenue.

• Question 1224:

  An audit report indicates multiple suspicious attempts to access company resources were made. These attempts were not detected by the company. Which of the following would be the best solution to implement on the company's network?

  A. Intrusion prevention system
  B. Proxy server
  C. Jump server
  D. Security zones
  A. Intrusion prevention system

  ---

  To address the issue of suspicious attempts to access company resources that were not detected, the best solution to implement on the company's network would be an Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is a security device or software application that monitors network traffic for malicious activity and can automatically take action to block or prevent potential threats. It goes beyond intrusion detection by actively analyzing network traffic in real-time and can actively respond to identified threats. With an IPS in place, the system can detect and block suspicious activities, such as unauthorized attempts to access company resources, before they can cause harm. It provides an additional layer of security to the network and can help to mitigate various cyber threats.

• Question 1225:

  Which of the following is the GREATEST security concern when outsourcing code development to third-party contractors for an internet-facing application?

  A. Intellectual property theft
  B. Elevated privileges
  C. Unknown backdoor
  D. Quality assurance
  C. Unknown backdoor

• Question 1226:

  A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL. Which of the following is needed to meet the objective?

  A. A reverse proxy
  B. A decryption certificate
  C. A spill-tunnel VPN
  D. Load-balanced servers
  B. A decryption certificate

  ---

  WAF can only block abnormal traffic by filtering the plaintext data.

• Question 1227:

  A security audit of an organization revealed that most of the IT staff members have domain administrator credentials and do not change the passwords regularly. Which of the following solutions should the security team propose to resolve the findings in the most complete way?

  A. Creating group policies to enforce password rotation on domain administrator credentials
  B. Reviewing the domain administrator group, removing all unnecessary administrators, and rotating all passwords
  C. Integrating the domain administrator's group with an IdP and requiring SSO with MFA for all access D. Securing domain administrator credentials in a PAM vault and controlling access with role-based access control
  D

• Question 1228:

  A company would like to protect credit card information that is stored in a database from being exposed and reused. However, the current POS system does not support encryption. Which of the following would be BEST suited to secure this information?

  A. Masking
  B. Tokenization
  C. DLP
  D. SSL/TLS
  B. Tokenization

  ---

  Tokenization replaces sensitive data with non-sensitive data, such as a unique identifier. This means that the data is still present in the system, but the sensitive information itself is replaced with the token. Tokenization is more secure than masking, which only obscures the data but does not eliminate it. DLP is not suitable for this task, as it is designed to prevent the loss or leakage of data from the system. SSL/TLS can be used to secure the transmission of data, but it cannot prevent the data itself from being exposed or reused. For more information, please refer to CompTIA Security+ SY0-601 Exam Objectives, Section 3.3: Explain the security purpose of authentication, authorization and accounting (AAA) services, and Section 4.7: Explain the purpose and characteristics of various types of encryption.

• Question 1229:

  An organization recently released a zero-trust policy that will enforce who is able to remotely access certain data. Authenticated users who access the data must have a need to know, depending on their level of permissions.

  Which of the following is the first step the organization should take when implementing the policy?

  A. Determine a quality CASB solution.
  B. Configure the DLP policies by user groups.
  C. Implement agentless NAC on boundary devices.
  D. Classify all data on the file servers.
  D. Classify all data on the file servers.

  ---

  zero trust is a security strategy that assumes breach and verifies each request as though it originates from an untrusted network12. A zero trust policy is a set of "allow rules" that specify conditions for accessing certain resources3. According to one source4, the first step in implementing a zero trust policy is to identify and classify all data and assets in the organization. This helps to determine the level of sensitivity and risk associated with each resource and apply appropriate access controls. Classifying all data on the file servers is the first step in implementing a zero trust policy because it helps to determine the level of sensitivity and risk associated with each resource and apply appropriate access controls. Reference: Zero Trust implementation guidance | Microsoft Learn

• Question 1230:

  A security analyst needs to be proactive in understand the types of attacks that could potentially target the company's execute. Which of the following intelligence sources should to security analyst review?

  A. Vulnerability feeds
  B. Trusted automated exchange of indicator information
  C. Structured threat information expression
  D. Industry information-sharing and collaboration groups
  D. Industry information-sharing and collaboration groups

  ---

  What is an ISAO? An Information Sharing and Analysis Organization (ISAO) is a trusted community that actively collaborates to identify and disseminate information about cybersecurity threats. These organizations focus on providing technical information about attacks on businesses, governments and organizations. An ISAO gathers data about threat actors and their techniques from various sources. This data can come from governments, large and small companies, and cybersecurity organizations from around the world. The ISAO then crunches this data, turns it into useable information, and sends it to its members. Because an ISAO provides relevant, useful information, it effectively becomes a trusted advisor that raises an industry's cybersecurity resilience. https://connect.comptia.org/content/articles/what-is-an-isao