CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 11:

  A help desk technician receives an email from the Chief Information Officer (CIO) asking for documents. The technician knows the CIO is on vacation for a few weeks. Which of the following should the technician do to validate the authenticity of the email?

  A. Check the metadata in the email header of the received path in reverse order to follow the email's path.
  B. Hover the mouse over the CIO's email address to verify the email address.
  C. Look at the metadata in the email header and verify the orF m: line matches the CIO's email address.
  D. Forward the email to the CIO and ask if the CIO sent the email requesting the documents.
  A. Check the metadata in the email header of the received path in reverse order to follow the email's path.

  ---

  https://www.cmu.edu/iso/news/2020/email-spoofing.html

• Question 12:

  Which of the following is the FIRST environment in which proper, secure coding should be practiced?

  A. Stage
  B. Development
  C. Production
  D. Test
  B. Development

  ---

  The developer has to start writing secure code from beginning itself. Which will then be tested, staged and finally production

• Question 13:

  The process of passively gathering information prior to launching a cyberattack is called:

  A. tailgating.
  B. reconnaissance.
  C. pharming
  D. prepending
  B. reconnaissance.

• Question 14:

  When implementing automation with loT devices, which of the following should be considered FIRST to keep the network secure?

  A. Z-Wave compatibility
  B. Network range
  C. Zigbee configuration
  D. Communication protocols
  D. Communication protocols

• Question 15:

  An organization plans to transition the intrusion detection and prevention techniques on a critical subnet to an anomaly-based system. Which of the following does the organization need to determine for this to be successful?

  A. The baseline
  B. The endpoint configurations
  C. The adversary behavior profiles
  D. The IPS signatures
  A. The baseline

  ---

  Professor Messer notes : Anomaly-based ?Build a baseline of what's "normal" Behavior-based ?Observe and report Behavior based systems need baseline behavior data to be able to observe abnormal behavior that is different from normal (baseline)

• Question 16:

  Which of the following is the BEST reason to maintain a functional and effective asset management policy that aids in ensuring the security of an organization?

  A. To provide data to quantity risk based on the organization's systems.
  B. To keep all software and hardware fully patched for known vulnerabilities
  C. To only allow approved, organization-owned devices onto the business network
  D. To standardize by selecting one laptop model for all users in the organization
  A. To provide data to quantity risk based on the organization's systems.

• Question 17:

  A company has had several malware incidents that have been traced back to users accessing personal SaaS applications on the internet from the company network. The company has a policy that states users can only access business-related cloud applications from within the company network. Which of the following technical solutions should be used to enforce the policy?

  A. Implement single sign-on using an identity provider
  B. Leverage a cloud access security broker.
  C. Configure cloud security groups
  D. Install a virtual private cloud endpoint
  B. Leverage a cloud access security broker.

• Question 18:

  During an incident, a company's CIRT determines it is necessary to observe the continued network-based transactions between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?

  A. Physical move the PC to a separate internet pint of presence
  B. Create and apply microsegmentation rules.
  C. Emulate the malware in a heavily monitored DMZ segment.
  D. Apply network blacklisting rules for the adversary domain
  B. Create and apply microsegmentation rules.

  ---

  AH secure in entire packet

• Question 19:

  An organization wants to enable built-in FDE on all laptops.

  Which of the following should the organization ensure is Installed on all laptops?

  A. TPM
  B. CA
  C. SAML
  D. CRL
  A. TPM

  ---

  The organization should ensure that a Trusted Platform Module (TPM) is installed on all laptops in order to enable built-in Full Disk Encryption (FDE). TPM is a hardware-based security chip that stores encryption keys and helps to protect data from malicious attacks. It is important to ensure that the TPM is properly configured and enabled in order to get the most out of FDE.

• Question 20:

  All security analysts' workstations at a company have network access to a critical server VLAN. The information security manager wants to further enhance the controls by requiring that all access to the secure VLAN be authorized only from a given single location. Which of the following will the information security manager most likely implement?

  A. A forward proxy server
  B. A jump server
  C. A reverse proxy server
  D. A stateful firewall server
  B. A jump server

  ---

  A jump server, also known as a bastion host or a secure access server, is a dedicated server that serves as a single access point for administrators or authorized users to connect to other systems within a network. By requiring all access to the secure VLAN to go through the jump server, the information security manager can enforce a centralized and controlled access point. This ensures that all access to the secure VLAN is authorized and can be monitored or logged for security purposes. A jump server provides an additional layer of security and helps protect against unauthorized access.