CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 191:

  Which of the following best describes a legal hold?

  A. It occurs during litigation and requires retention of both electronic and physical documents.
  B. It occurs during a risk assessment and requires retention of risk-related documents.
  C. It occurs during incident recovery and requires retention of electronic documents.
  D. It occurs during a business impact analysis and requires retention of documents categorized as personally identifiable information.
  A. It occurs during litigation and requires retention of both electronic and physical documents.

• Question 192:

  A forensics examiner is attempting to dump password cached in the physical memory of a live system but keeps receiving an error message. Which of the following BEST describes the cause of the error?

  A. The examiner does not have administrative privileges to the system
  B. The system must be taken offline before a snapshot can be created
  C. Checksum mismatches are invalidating the disk image
  D. The swap file needs to be unlocked before it can be accessed
  A. The examiner does not have administrative privileges to the system

  ---

  Explanation Explanation/Reference:A. The examiner does not have administrative privileges to the system - correct answer This is about RAM. If you want to examine pagefile you pull power plug out of the wall so the pagefile contents are not erased

• Question 193:

  A company recently expenenced an attack dunng which #5 main website was directed to the atacker's web server, allowing the attacker to harvest credentials from unsuspecting customers. Which of the following snould the company Implement to prevent this type of attack from accurting in the future?

  A. IPSec
  B. SSL/TLS
  C. DNSSEC
  D. S/MIME
  B. SSL/TLS

• Question 194:

  Which of the following documents provides guidance regarding the recommended deployment of network security systems from the manufacturer?

  A. Cloud control matrix
  B. Reference architecture
  C. NIST RMF
  D. CIS Top 20
  B. Reference architecture

  ---

  A reference architecture is a document or set of documents that provides recommended structures and integrations of IT products and services to form a solution.

• Question 195:

  An information security manager for an organization is completing a PCI DSS self- assessment for the first time. which of the is following MOST likely reason for this type of assessment?

  A. An international expansion project is currently underway.
  B. Outside consultants utilize this tool to measure security maturity.
  C. The organization is expecting to process credit card information.
  D. A government regulator has requested this audit to be completed
  C. The organization is expecting to process credit card information.

• Question 196:

  The Chief Information Security Officer wants to pilot a new adaptive, user-based authentication method. The concept Includes granting logical access based on physical location and proximity. Which of the following Is the BEST solution for the pilot?

  A. Geofencing
  B. Self-sovereign identification
  C. PKl certificates
  D. SSO
  A. Geofencing

• Question 197:

  Which of the following provides a calculated value for known vulnerabilities so organizations can prioritize mitigation steps?

  A. CVSS
  B. SIEM
  C. SOAR
  D. CVE
  A. CVSS

  ---

  CVSS is maintained by the Forum of Incident Response and Security Teams (first.org/cvss). CVSS metrics generate a score from 0 to 10 based on characteristics of the vulnerability, such as whether it can be triggered remotely or needs local access, whether user intervention is required, and so on

• Question 198:

  A company Is concerned about is security after a red-team exercise. The report shows the team was able to reach the critical servers due to the SMB being exposed to the Internet and running NTLMV1,

  Which of the following BEST explains the findings?

  A. Default settings on the servers
  B. Unsecured administrator accounts
  C. Open ports and services
  D. Weak Data encryption
  C. Open ports and services

• Question 199:

  A help desk technician receives a phone call from someone claiming to be a part of the organization's cybersecurity modem response team The caller asks the technician to verify the network's internal firewall IP address

  Which of the following 15 the technician's BEST course of action?

  A. Direct the caller to stop by the help desk in person and hang up declining any further requests from the caller
  B. Ask for the callers name, verify the persons identity in the email directory and provide the requested information over the phone
  C. Write down the phone number of the carter if possible, the name of the person requesting the information hang up. and notify the organization's cybersecurity officer
  D. Request the caller send an email for identity verification and provide the requested information via email to the caller
  C. Write down the phone number of the carter if possible, the name of the person requesting the information hang up. and notify the organization's cybersecurity officer

  ---

  Write down the phone number of the caller if possible, the name of the person requesting the information, hang up, and notify the organization's cybersecurity officer. In this scenario, the help desk technician should be wary of the person's request as help desk technicians would not have this information. Also, if the person claimed to be from the cybersecurity incident response team, they would more likely to have access to this information anyway, or at least know who to contact. For the sake of the technician, it would be best to get as much information as possible and delegate the task of confirming the person's identity to the cybersecurity officer. Even in the very slim chance that it was a legitimate request, it would still be best for the cyber security officer to provide this information instead of a tech.

• Question 200:

  A security policy states that common words should not be used as passwords. A security auditor was able to perform a dictionary attack against corporate credentials Which of the following controls was being violated?

  A. Password complexity
  B. Password history
  C. Password reuse
  D. Password length
  A. Password complexity