SY0-601 Exam Details

  • Exam Code
    :SY0-601
  • Exam Name
    :CompTIA Security+
  • Certification
    :CompTIA Certifications
  • Vendor
    :CompTIA
  • Total Questions
    :1334 Q&As
  • Last Updated
    :May 26, 2026

CompTIA SY0-601 Online Questions & Answers

  • Question 181:

    Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario?

    A. Watering-hole attack
    B. Credential harvesting
    C. Hybrid warfare
    D. Pharming

  • Question 182:

    Several employees return to work the day after attending an industry trade show. That same day, the security manager notices several malware alerts coming from each of the employee's workstations. The security manager investigates but finds no signs of an attack on the perimeter firewall or the NIDS.

    Which of the following is MOST likely causing the malware alerts?

    A. A worm that has propagated itself across the intranet, which was initiated by presentation media
    B. A fileless virus that is contained on a vCard that is attempting to execute an attack
    C. A Trojan that has passed through and executed malicious code on the hosts
    D. A USB flash drive that is trying to run malicious code but is being blocked by the host firewall

  • Question 183:

    Which of the following is a reason to publish files' hashes?

    A. To validate the integrity of the files
    B. To verify if the software was digitally signed
    C. To use the hash as a software activation key
    D. To use the hash as a decryption passphrase

  • Question 184:

    A security analyst is hardening a network infrastructure. The analyst is given the following requirements:

    1.

    Preserve the use of public IP addresses assigned to equipment on the core router.

    2.

    Enable "in transport" encryption protection to the web server with the strongest ciphers.

    Which of the following should the analyst implement to meet these requirements? (Select TWO).

    A. Configure VLANs on the core router.
    B. Configure NAT on the core router.
    C. Configure BGP on the core router.
    D. Enable AES encryption on the web server.
    E. Enable 3DES encryption on the web server.
    F. Enable TLSv2 encryption on the web server.

  • Question 185:

    A security analyst has been reading about a newly discovered cyberattack from a known threat actor. Which of the following would BEST support the analyst's review of the tactics, techniques, and protocols the threat actor was observed using in previous campaigns?

    A. Security research publications
    B. The MITRE ATTandCK framework
    C. The Diamond Model of Intrusion Analysis
    D. The Cyber Kill Chain

  • Question 186:

    A user contacts the help desk to report the following:

    1.

    Two days ago, a pop-up browser window prompted the user for a name and password after connecting to the corporate wireless SSID.

    2.

    This had never happened before, but the user entered the information as requested.

    3.

    The user was able to access the Internet but had trouble accessing the department share until the next day.

    4.

    The user is now getting notifications from the bank about unauthorized transactions.

    Which of the following attack vectors was MOST likely used in this scenario?

    A. Rogue access point
    B. Evil twin
    C. DNS poisoning
    D. ARP poisoning

  • Question 187:

    During an incident response process involving a laptop, a host was identified as the entry point for malware. The management team would like to have the laptop restored and given back to the user. The cybersecurity analyst would like to continue investigating the intrusion on the host. Which of the following would allow the analyst to continue the investigation and also return the laptop to the user as soon as possible?

    A. dd
    B. memdump
    C. tcpdump
    D. head

  • Question 188:

    A Chief Security Officer (CSO) was notified that a customer was able to access confidential internal company files on a commonly used file-sharing service. The file-sharing service is the same one used by company staff as one of its approved third- party applications. After further investigation, the security team determines the sharing of confidential files was accidental and not malicious. However, the CSO wants to implement changes to minimize this type of incident from reoccurring but does not want to impact existing business processes.

    Which of the following would BEST meet the CSO's objectives?

    A. DLP
    B. SWG
    C. CASB
    D. Virtual network segmentation
    E. Container security

  • Question 189:

    A cybersecurity administrator needs to allow mobile BYOD devices to access network resources. As the devices are not enrolled to the domain and do not have policies applied to them, which of the following are best practices for authentication and infrastructure security? (Select TWO).

    A. Create a new network for the mobile devices and block the communication to the internal network and servers
    B. Use a captive portal for user authentication.
    C. Authenticate users using OAuth for more resiliency
    D. Implement SSO and allow communication to the internal network
    E. Use the existing network and allow communication to the internal network and servers.
    F. Use a new and updated RADIUS server to maintain the best solution

  • Question 190:

    An attacker is trying to gain access by installing malware on a website that is known to be visited by the target victims. Which of the following is the attacker MOST likely attempting?

    A. A spear-phishing attack
    B. A watering-hole attack
    C. Typo squatting
    D. A phishing attack

Tips on How to Prepare for the Exams

Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only CompTIA exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your SY0-601 exam preparations and CompTIA certification application, do not hesitate to visit our Vcedump.com to find your solutions here.