CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 1271:

  A report delivered to the Chief Information Security Officer (CISO) shows that some user credentials could be exfilltrated. The report also indicates that users tend to choose the same credentials on different systems and applications. Which of the following policies should the CISO use to prevent someone from using the exfilltrated credentials?

  A. MFA
  B. Lockout
  C. Time-based logins
  D. Password history
  A. MFA

  ---

  The CISO should use MFA (multi-factor authentication) to prevent someone from using the exfiltrated credentials. MFA is a security measure that requires multiple forms of authentication to access a system or data. MFA typically involves the use of two or more of the following factors: something the user knows (e.g. a password or PIN), something the user has (e.g. a security token or smart card), or something the user is (e.g. a biometric characteristic). By requiring multiple forms of authentication, MFA helps to prevent unauthorized access to a system or data, even if a user's credentials are exfiltrated. The report delivered to the CISO indicates that some user credentials could be exfiltrated, and that users tend to choose the same credentials on different systems and applications. This means that if an attacker were to obtain a user's credentials, they could potentially use them to gain access to multiple systems or applications. MFA would help to prevent this by requiring additional forms of authentication, making it more difficult for an attacker to gain access to a system or data.

• Question 1272:

  The primary goal of the threat-hunting team at a large company is to identify cyberthreats that the SOC has not detected. Which of the following types of data would the threat-hunting team primarily use to identify systems that are exploitable?

  A. Vulnerability scan
  B. Packet capture
  C. Threat feed
  D. User behavior
  A. Vulnerability scan

• Question 1273:

  The IT department's on-site developer has been with the team for many years. Each time an application is released, the security team is able to identify multiple vulnerabilities. Which of the following would BEST help the team ensure the application is ready to be released to production?

  A. Limit the use of third-party libraries.
  B. Prevent data exposure queries.
  C. Obfuscate the source code.
  D. Submit the application to QA before releasing it.
  D. Submit the application to QA before releasing it.

• Question 1274:

  The Chief Financial Officer (CFO) of an insurance company received an email from Ann, the company's Chief Executive Officer (CEO), requesting a transfer of $10,000 to an account. The email states Ann is on vacation and has lost her purse, containing cash and credit cards. Which of the following social-engineering techniques is the attacker using?

  A. Phishing
  B. Whaling
  C. Type squatting
  D. Pharming
  B. Whaling

  ---

  Explanation Explanation/Reference:Target is an executive. This type of social engineering is whaling.

• Question 1275:

  An organization has hired a security analyst to perform a penetration test. The analyst captures 1Gb worth of inbound network traffic to the server and transfer the pcap back to the machine for analysis. Which of the following tools should the analyst use to further review the pcap?

  A. Nmap
  B. cURL
  C. Netcat
  D. Wireshark
  D. Wireshark

  ---

  Nmap: Nmap is a network scanning tool used for discovering hosts and services on a network. cURL: cURL is a command-line tool for transferring data with URLs. It's commonly used to send and receive data over various protocols, such as HTTP. Netcat: Netcat (nc) is a versatile networking utility often referred to as the "Swiss Army knife" of networking. It can create TCP and UDP connections, transfer files, and perform various networking tasks. D. Wireshark: Wireshark is specifically designed for capturing and analyzing network packets. It provides a graphical user interface for dissecting and analyzing captured network data, making it the most appropriate tool for reviewing a pcap file to understand the content and behavior of the captured network traffic.

• Question 1276:

  A cyber-security administrator is using an enterprise firewall. The administrator created some rules, but now Seems to be unresponsive. All connections being dropped by the firewall. Which of the following would be the BEST option to remove the rules?

  A. # iptables -t mangle -x
  B. # iptables -f
  C. # iptables -z
  D. # iptables -p input -j drop
  A. # iptables -t mangle -x

• Question 1277:

  A security analyst must determine if either SSH or Telnet is being used to log in to servers.

  Which of the following should the analyst use?

  A. logger
  B. Metasploit
  C. tcpdump
  D. netstat
  D. netstat

• Question 1278:

  A client sent several inquiries to a project manager about the delinquent delivery status of some critical reports. The project manager claimed the reports were previously sent via email, but then quickly generated and backdated the reports before submitting them as plain text within the body of a new email message thread. Which of the following actions MOST likely supports an investigation for fraudulent submission?

  A. Establish chain of custody.
  B. Inspect the file metadata.
  C. Reference the data retention policy.
  D. Review the email event logs
  D. Review the email event logs

  ---

  inspecting the file meta data isn't going to do anything because the file's creation or modified date isn't in question. The question is if they sent the file at all. In this case they didn't which can be proven via email event log.

• Question 1279:

  An engineer needs to deploy a security measure to identify and prevent data tampering within the enterprise. Which of the following will accomplish this goal?

  A. Antivirus
  B. IPS.
  C. FTP
  D. FIM
  D. FIM

• Question 1280:

  As part of the lessons-learned phase, the SOC is tasked with building methods to detect if a previous incident is happening again. Which of the following would allow the security analyst to alert the SOC if an event is reoccurring?

  A. Creating a playbook within the SOAR
  B. Implementing rules in the NGFW
  C. Updating the DLP hash database
  D. Publishing a new CRL with revoked certificates
  A. Creating a playbook within the SOAR

  ---

  Explanation