CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 1301:

  A network engineer notices the VPN concentrator overloaded and crashes on days when there are a lot of remote workers. Senior management has placed greater importance on the availability of VPN resources for the remote workers than the security of the end users' traffic.

  Which of the following would be BEST to solve this issue?

  A. iPSec
  B. Always On
  C. Split tunneling
  D. L2TP
  B. Always On

• Question 1302:

  A security practitioner is performing due diligence on a vendor that is being considered for cloud services. Which of the following should the practitioner consult for the best insight into the current security posture of the vendor?

  A. PCI DSS standards
  B. SLA contract
  C. CSF framework
  D. SOC 2 report
  D. SOC 2 report

  ---

  A SOC 2 report is a document that provides an independent assessment of a service organization's controls related to the Trust Services Criteria of Security, Availability, Processing Integrity, Confidentiality, or Privacy. A SOC 2 report can help a security practitioner evaluate the current security posture of a vendor that provides cloud services1.

• Question 1303:

  A security architect is working on an email solution that will send sensitive data. However, funds are not currently available in the budget for building additional infrastructure. Which of the following should the architect choose?

  A. POP
  B. IPSec
  C. IMAP
  D. PGP
  D. PGP

  ---

  PGP (Pretty Good Privacy) is a commonly used encryption method for email communications to secure the sensitive data being sent. It allows for the encryption of the entire message or just the sensitive parts. It would be an appropriate solution in this case as it doesn't require additional infrastructure to implement.

• Question 1304:

  A small business uses kiosks on the sales floor to display product information for customers. A security team discovers the kiosks use end-of-life operating systems. Which of the following is the security team most likely to document as a security implication of the current architecture?

  A. Patch availability
  B. Product software compatibility
  C. Ease of recovery
  D. Cost of replacement
  A. Patch availability

  ---

  The security team is most likely to document "Patch availability" as a security implication of the current architecture. End-of-life operating systems are no longer supported by the vendor, which means they do not receive regular security updates or patches. This lack of patch availability leaves the kiosks vulnerable to known and potentially exploitable security vulnerabilities. Attackers can target these vulnerabilities to compromise the kiosks and gain unauthorized access to the systems or customer information. It is crucial for the security team to highlight the risk associated with using end-of-life operating systems and recommend upgrading to a supported and more secure operating system to mitigate potential security threats.

• Question 1305:

  A security operations analyst is using the company's SIEM solution to correlate alerts. Which of the following stages of the incident response process is this an example of?

  A. Eradication
  B. Recovery
  C. Identification
  D. Preparation
  C. Identification

  ---

  C: Identification Incident response lifecycle: -preparation -detection and analysis -containment, eradication, recovery -post-incident activity

• Question 1306:

  A security incident has been resolved Which of the following BEST describes the importance of the final phase of the incident response plan?

  A. It examines and documents how well the team responded discovers what caused the incident, and determines how the incident can be avoided in the future
  B. It returns the affected systems back into production once systems have been fully patched, data restored and vulnerabilities addressed
  C. It identifies the incident and the scope of the breach how it affects the production environment, and the ingress point
  D. It contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach
  A. It examines and documents how well the team responded discovers what caused the incident, and determines how the incident can be avoided in the future

  ---

  The final phase of the incident response is also called the lessons learned or remediation step. ======================= Phases of the Incident Response Plan: 1. Preparation - Preparing for an attack and how to respond 2. Identification - Identifying the threat 3. Containment - Containing the threat 4. Eradication - Removing the threat 5. Recovery - Recovering affected systems 6. Lessons Learned - Evaluating the incident response, see where there can be improvements for a future incident.

• Question 1307:

  The Chief information Securtty Officer (CISO) has decided to reorganize security staff to concentrate on incident response and to outsource outbound Internet URL categorization and filtering to an outside cornpany. Additionally, the CISO would Ske this solution to provide the same protections even when a company laptop or mobile device ts away from # home office. Which of the following should the CISO choose?

  A. CASB
  B. Next-generation SWG
  C. NGFW
  D. Web-application firewall
  B. Next-generation SWG

• Question 1308:

  A company a "right to forgotten" request To legally comply, the company must remove data related to the requester from its systems. Which Of the following Company most likely complying with?

  A. NIST CSF
  B. GDPR
  C. PCI OSS
  D. ISO 27001
  B. GDPR

  ---

  GDPR stands for General Data Protection Regulation, which is a law that regulates data protection and privacy in the European Union (EU) and the European Economic Area (EEA). GDPR also applies to the transfer of personal data outside the EU and EEA areas. GDPR grants individuals the right to request the deletion or removal of their personal data from an organization's systems under certain circumstances. This right is also known as the "right to be forgotten" or the "right to erasure". An organization that receives such a request must comply with it within a specified time frame, unless there are legitimate grounds for retaining the data. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://gdpr-info.eu/issues/right-to-be-forgotten/

• Question 1309:

  An end user reports a computer has been acting slower than normal for a few weeks, During an investigation, an analyst determines the system 3 sending the users email address and a ten-digit number ta an IP address once a day. The only resent log entry regarding the user's computer is the following:

  

  Which of the following is the MOST likely cause of the issue?

  A. The end user purchased and installed a PUP from a web browser
  B. A bot on the computer is brute forcing passwords against a website
  C. A hacker is attempting to exfiltrate sensitive data
  D. Ransomware is communicating with a command-and-control server.
  A. The end user purchased and installed a PUP from a web browser

• Question 1310:

  During a recent security assessment, a vulnerability was found in a common OS, The OS vendor was unaware of the issue and promised to release a patch within next quarter, Which of the following BEST describes this type of vulnerability?

  A. Legacy operating system
  B. Weak configuration
  C. Zero day
  D. Supply chain
  C. Zero day

  ---

  A zero-day vulnerability is a previously unknown vulnerability in software or hardware that is exploited by attackers before the vendor becomes aware of the issue and releases a patch. In this case, the OS vendor was unaware of the vulnerability and promised to release a patch within the next quarter, indicating that it is a zero-day vulnerability.