CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 201:

  A newly identified network access vulnerability has been found in the OS of legacy IoT devices. Which of the following would best mitigate this vulnerability quickly?

  A. Insurance

  B. Patching

  C. Segmentation

  D. Replacement

  Correct Answer: C

  If support from the manufacturer is not available, and the vulnerability is in the OS of legacy IoT devices, the best option to quickly mitigate the vulnerability is C. Segmentation. Since patching may not be feasible without manufacturer support, segmentation can help isolate the vulnerable devices from the rest of the network. This can limit the potential attack surface and reduce the risk of exploitation, even if the devices themselves cannot be patched or updated. Segmentation can be an effective short-term strategy to enhance security when dealing with unsupported legacy IoT devices.If support from the manufacturer is not available, and the vulnerability is in the OS of legacy IoT devices, the best option to quickly mitigate the vulnerability is C. Segmentation.

  Since patching may not be feasible without manufacturer support, segmentation can help isolate the vulnerable devices from the rest of the network. This can limit the potential attack surface and reduce the risk of exploitation, even if the devices themselves cannot be patched or updated.

• Question 202:

  A security professional wants to enhance the protection of a critical environment that is used to store and manage a company's encryption keys. The selected technology should be tamper resistant. Which of the following should the security professional implement to achieve the goal?

  A. DLP

  B. HSM

  C. CA

  D. FIM

  Correct Answer: B

  An HSM is a dedicated hardware device that provides a secure environment for cryptographic operations and key management. It is designed to be tamper-resistant, physically hardened, and provides strong protection for sensitive cryptographic material and keys. HSMs are often used in environments where secure and reliable key management is essential, such as in banking, financial institutions, or other critical systems where data confidentiality and integrity are paramount.

• Question 203:

  A Chief Information Security Officer (CISO) wants to explicitly raise awareness about the increase of ransomware-as-a-service in a report to the management team. Which of the following best describes the threat actor in the CISO's report?

  A. Insider threat

  B. Hacktivist

  C. Nation-state

  D. Organized crime

  Correct Answer: D

  The threat actor described in the report, "ransomware-as-a-service," is associated with organized crime. Ransomware-as-a-service (RaaS) is a type of cybercrime where criminal groups develop and distribute ransomware tools and infrastructure to other individuals or groups in exchange for a share of the profits. This allows script kiddies to conduct ransomware attacks, while the developers behind the RaaS schemes handle the technical aspects and receive a portion of the ransom payments as revenue.

• Question 204:

  Which of the following would be the best way to block unknown programs from executing?

  A. Access control list

  B. Application allow list

  C. Host-based firewall

  D. DLP solution

  Correct Answer: B

  Application allow list (Application Whitelisting): Application allow listing is a security approach that allows only approved or known applications to run on a system while blocking all others. Unknown or unapproved programs are automatically prevented from executing. It is an effective method for blocking the execution of unauthorized or unknown software and can help prevent malware and unauthorized applications from running on a system.

• Question 205:

  A security analyst is scanning a company's public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following changes should the security analyst recommend?

  A. Changing the remote desktop port to a non-standard number

  B. Setting up a VPN and placing the jump server inside the firewall

  C. Using a proxy for web connections from the remote desktop server

  D. Connecting the remote server to the domain and increasing the password length

  Correct Answer: B

  Placing the jump server inside the firewall and configuring a Virtual Private Network (VPN) for secure remote access would be the best recommendation to enhance security in this scenario. By using a jump server, which is a secure intermediary system, the security analyst can create a controlled access point to the production network. The jump server will act as a gateway for remote users to connect to the production network securely, while also reducing the attack surface by limiting direct access to the production network from external sources.

  Using a VPN ensures that data transmitted between the remote desktop and the production network is encrypted, protecting it from potential eavesdropping and unauthorized access. This approach helps to secure the remote access process and minimizes the risk of unauthorized access to critical resources within the production network. Additionally, by placing the jump server inside the firewall, the organization can apply additional security measures, such as access controls and monitoring, to further protect the production network from potential threats.

• Question 206:

  Which of the following exercises should an organization use to improve its incident response process?

  A. Tabletop

  B. Replication

  C. Failover

  D. Recovery

  Correct Answer: A

  A Tabletop exercise is a type of simulation-based training exercise where key personnel come together in a classroom or conference room setting to discuss and practice their response to various simulated scenarios. It involves discussing hypothetical incidents and their potential impacts on the organization, as well as going through the steps of the incident response process, including identification, containment, eradication, recovery, and lessons learned.

  Tabletop exercises are valuable for testing the effectiveness of the incident response plan, identifying gaps in processes, and improving communication and coordination among different teams involved in incident response. It allows participants to think through complex scenarios in a safe and controlled environment without real-world consequences.

• Question 207:

  During an incident, an EDR system detects an increase in the number of encrypted outbound connections from multiple hosts. A firewall is also reporting an increase in outbound connections that use random high ports. An analyst plans to review the correlated logs to find the source of the incident. Which of the following tools will best assist the analyst?

  A. A vulnerability scanner

  B. A NGFW

  C. The Windows Event Viewer

  D. A SIEM

  Correct Answer: D

  A SIEM is a centralized logging and monitoring solution that collects, analyzes, and correlates log data from various sources within an organization's network and security infrastructure. It helps security analysts to gain visibility into security events and incidents by aggregating and correlating logs from multiple systems and devices.

  In the scenario described, the EDR system and firewall are both generating logs that provide valuable information about the incident. By using a SIEM, the analyst can collect and correlate the logs from these different sources to get a comprehensive view of the incident. The SIEM will help the analyst identify patterns, anomalies, and potential indicators of compromise that may not be immediately apparent when reviewing individual logs in isolation.

• Question 208:

  A company develops a complex platform that is composed of a single application. After several issues with upgrades, the systems administrator recommends breaking down the application into unique, independent modules. Which of the following best identifies the systems administrator's recommendation?

  A. Virtualization

  B. Serverless

  C. Microservices

  D. API gateway

  Correct Answer: C

  The systems administrator's recommendation is to break down the complex platform into unique, independent modules, which is a characteristic of the microservices architecture. Microservices is an architectural style where a large application is divided into smaller, loosely coupled services that can be independently developed, deployed, and scaled. Each service handles a specific business function and communicates with other services through APIs.

• Question 209:

  An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?

  A. Exception

  B. Segmentation

  C. Risk transfer

  D. Compensating controls

  Correct Answer: D

  Legacy = Compensating

  Compensating controls are alternative security measures put in place when standard controls cannot be implemented or are not sufficient to meet security requirements. In this case, the organization disabled unneeded services and implemented a firewall in front of a business-critical legacy system. These actions can be considered compensating controls to mitigate risks associated with the legacy system's security weaknesses or limitations.

• Question 210:

  A company recently suffered a breach in which an attacker was able to access the internal mail servers and directly access several user inboxes. A large number of email messages were later posted online. Which of the following would best prevent email contents from being released should another breach occur?

  A. Implement S/MIME to encrypt the emails at rest.

  B. Enable full disk encryption on the mail servers.

  C. Use digital certificates when accessing email via the web.

  D. Configure web traffic to only use TLS-enabled channels.

  Correct Answer: A

  S/MIME (Secure/Multipurpose Internet Mail Extensions) is a technology that provides end-to-end encryption for email messages. When S/MIME is implemented, email messages are encrypted while at rest on the email server, making it difficult for an attacker to access the content even if they gain unauthorized access to the mail servers.

  Therefore, implementing S/MIME to encrypt the emails at rest would be the best option to prevent email contents from being released in case of another breach.