CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 211:

  A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering. Which of the following teams will conduct this assessment activity?

  A. White

  B. Purple

  C. Blue

  D. Red

  Correct Answer: D

  Red Team is a term used in the context of offensive security assessments where a group of skilled security professionals, often external to the organization, are hired to simulate real-world attacks against the organization's systems, networks, and personnel. The goal of the Red Team is to identify vulnerabilities, weaknesses, and potential security gaps in the organization's defenses.

• Question 212:

  An organization suffered numerous multiday power outages at its current location. The Chief Executive Officer wants to create a disaster recovery strategy to resolve this issue. Which of the following options offer low-cost solutions? (Choose two.)

  A. Warm site

  B. Generator

  C. Hot site

  D. Cold site

  E. Cloud backups

  F. UPS

  Correct Answer: BF

• Question 213:

  A security analyst discovers that one of the web APIs is being abused by an unknown third party. Logs indicate that the third party is attempting to manipulate the parameters being passed to the API endpoint. Which of the following solutions would best help to protect against the attack?

  A. DLP

  B. SIEM

  C. NIDS

  D. WAF

  Correct Answer: D

  A Web Application Firewall (WAF) is a security solution specifically designed to protect web applications and APIs from various attacks, including those that attempt to manipulate parameters and exploit vulnerabilities in the application layer. It sits between the clients (users or third parties) and the web server, inspecting the HTTP/HTTPS traffic and filtering out malicious requests.

  In this scenario, the security analyst has identified that the web API is being abused by an unknown third party attempting to manipulate the parameters being passed to the API endpoint. A WAF would be able to analyze and validate the incoming requests to the API, blocking any requests that contain suspicious or malicious parameters. It can enforce security policies, perform input validation, and protect against common web application attacks like SQL injection, cross-site scripting (XSS), and parameter tampering.

• Question 214:

  A software development manager wants to ensure the authenticity of the code created by the company. Which of the following options is the most appropriate?

  A. Testing input validation on the user input fields

  B. Performing code signing on company-developed software

  C. Performing static code analysis on the software D. Ensuring secure cookies are used

  Correct Answer: B

  Code signing is a cryptographic process where a digital signature is applied to software to verify its authenticity and integrity. When the software is signed, it provides a way for users or systems to confirm that the code has not been tampered with since it was signed by the trusted entity (in this case, the company). This helps prevent unauthorized modifications and ensures that the code being executed is from a legitimate source.

  Performing code signing is an essential practice in software development, particularly for software that will be distributed or downloaded by end-users. It helps build trust with users and ensures they can verify that the software they are running is from a trusted source and has not been altered by malicious actors.

• Question 215:

  A company's end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server. Which of the following best describes what the security analyst is seeing?

  A. Concurrent session usage

  B. Secure DNS cryptographic downgrade

  C. On-path resource consumption

  D. Reflected denial of service

  Correct Answer: D

  In a reflected denial of service (DoS) attack, the attacker sends requests to a large number of public servers, spoofing the source IP address to make it appear as if the requests are coming from the target server. These public servers, acting as amplifiers, then send the responses back to the target server, overwhelming it with inbound traffic.

  In this case, the DNS server is receiving a flood of inbound traffic due to the DNS requests being amplified by other servers. The DNS server's CPU, disk, and memory usage are minimal because it is only processing legitimate DNS queries sent to it. However, the network interface is overwhelmed with amplified responses, causing the end users to be unable to reach external websites.

• Question 216:

  A company's legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries. Which of the following is the most effective way to limit this access?

  A. Data masking

  B. Encryption

  C. Geolocation policy

  D. Data sovereignty regulation

  Correct Answer: C

  A geolocation policy allows you to restrict access to resources based on the geographical location of users or devices. It can be an effective way to ensure that sensitive documents are not accessible by individuals in high-risk countries or regions. Geolocation policies can be implemented using various security tools or features, such as a content delivery network (CDN) or access control lists (ACLs), to restrict access to the SaaS application from specific geographic locations.

• Question 217:

  A systems administrator receives the following alert from a file integrity monitoring tool:

  The hash of the cmd.exe file has changed.

  The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?

  A. The end user changed the file permissions.

  B. A cryptographic collision was detected.

  C. A snapshot of the file system was taken.

  D. A rootkit was deployed.

  Correct Answer: D

  When a file integrity monitoring tool detects a change in the hash of a critical system file like "cmd.exe," it could indicate that a rootkit has been deployed. Rootkits are malicious software designed to hide their presence on a system by modifying critical files and processes, including system utilities like "cmd.exe." By changing the hash of the file, the rootkit aims to evade detection by security tools that rely on file integrity checks. Rootkits often have the capability to tamper with system logs and other monitoring mechanisms, making them difficult to detect using traditional methods.

• Question 218:

  An analyst is concerned about data leaks and wants to restrict access to internet services to authorized users only. The analyst also wants to control the actions each user can perform on each service. Which of the following would be the best technology for the analyst to consider Implementing?

  A. DLP

  B. VPC

  C. CASB

  D. Content filtering

  Correct Answer: C

  CASB is a security solution that provides visibility and control over the use of cloud services by employees within an organization. It helps enforce security policies and ensures that access to internet services is restricted to authorized users only. CASB allows the organization to define granular policies based on users, devices, locations, and activities, enabling them to control the actions each user can perform on each cloud service. By deploying CASB, the analyst can gain better visibility into data usage and potential data leaks, and apply security policies to prevent unauthorized access and actions on internet services. This can help protect sensitive data and mitigate the risks associated with the use of cloud services within the organization.

• Question 219:

  A user's login credentials were recently compromised. During the investigation, the security analyst determined the user input credentials into a pop-up window when prompted to confirm the username and password. However, the trusted website does not use a pop-up for entering user credentials. Which of the following attacks occurred?

  A. Cross-site scripting

  B. SQL injection

  C. DNS poisoning

  D. Certificate forgery

  Correct Answer: A

  The scenario described is indicative of a cross-site scripting (XSS) attack. In an XSS attack, an attacker injects malicious scripts into a trusted website, which then executes those scripts in the browsers of unsuspecting users. This can happen when the website fails to properly validate and sanitize user input, allowing the attacker to inject malicious code.

  In this case, the pop-up window used to collect user credentials is not a legitimate part of the trusted website's design. The attacker has injected a script that creates the pop-up and tricks the user into entering their login credentials into the fake form. The credentials are then captured and sent to the attacker, compromising the user's account.

  To prevent XSS attacks, web applications should implement proper input validation and output encoding to ensure that user-supplied data is treated as data and not executable code. Additionally, using security mechanisms like Content Security Policy (CSP) and sanitizing user input can help protect against XSS vulnerabilities.

• Question 220:

  A systems administrator set up an automated process that checks for vulnerabilities across the entire environment every morning. Which of the following activities is the systems administrator conducting?

  A. Scanning

  B. Alerting

  C. Reporting

  D. Archiving

  Correct Answer: A

  Scanning involves using automated tools to actively check the entire environment for vulnerabilities. The process typically involves using vulnerability scanning tools to identify and assess potential security weaknesses in the network, systems, and applications. The scan may include checks for known security vulnerabilities, misconfigurations, outdated software versions, and other potential issues that could be exploited by attackers.

  By performing regular vulnerability scanning, the systems administrator can proactively identify and address security risks, allowing them to take appropriate measures to patch or mitigate vulnerabilities before they can be exploited by malicious actors. Scanning is an essential part of a proactive security posture and helps ensure that the organization's systems and data remain secure and protected from potential threats.