CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 351:

  A new plug-and-play storage device was installed on a PC in the corporate environment. Which of the following safeguards will BEST help to protect the PC from malicious files on the storage device?

  A. Change the default settings on the PC.
  B. Define the PC firewall rules to limit access.
  C. Encrypt the disk on the storage device.
  D. Plug the storage device in to the UPS
  A. Change the default settings on the PC.

  ---

  By disabling autorun we will reduce the possible execution of the malware ( unless its rubberducky)

• Question 352:

  A security analyst discovers several .jpg photos from a cellular phone during a forensics investigation involving a compromised system. The analyst runs a forensics tool to gather file metadata. Which of the following would be part of the images if all the metadata is still intact?

  A. The GPS location
  B. When the file was deleted
  C. The total number of print jobs
  D. The number of copies made
  A. The GPS location

  ---

  Explanation Explanation/Reference:A security analyst discovers several .jpg photos from a cellular phone during a forensics investigation involving a compromised system. The analyst runs a forensics tool to gather file metadata.

• Question 353:

  A cybersecurity manager has scheduled biannual meetings with the IT team and department leaders to discuss how they would respond to hypothetical cyberattacks. During these meetings, the manager presents a scenario and injects additional information throughout the session to replicate what might occur in a dynamic cybersecurity event involving the company, its facilities, its data, and its staff. Which of the following describes what the manager is doing?

  A. Developing an incident response plan
  B. Building a disaster recovery plan
  C. Conducting a tabletop exercise
  D. Running a simulation exercise
  C. Conducting a tabletop exercise

  ---

  Explanation Explanation/Reference:This is a tabletop exercise as they are talking about all hypothetical events that could happen a and what to do if it where to happen. A simulation on the other hand would be recreating a specific event to practice what to do in that scenario.

• Question 354:

  Developers are writing code and merging it into shared repositones several times a day, where it is tested automabecally. Which of the following concepts does this BEST represent?

  A. Functional testing
  B. Stored procedures
  C. Elasticity
  D. Continuous integration
  C. Elasticity

• Question 355:

  The Chief Information Security Officer (CISO) asks a security analyst to install an OS update to a production VM that has a 99% uptime SLA. The CISO tells the analyst the installation must be done as quickly as possible. Which of the following courses of action should the security analyst take first?

  A. Log in to the server and perform a health check on the VM.
  B. Install the patch immediately.
  C. Confirm that the backup service is running.
  D. Take a snapshot of the VM.
  D. Take a snapshot of the VM.

• Question 356:

  A systems engineer thinks a business system has been compromised and is being used to exfiltrated data to a competitor The engineer contacts the CSIRT The CSIRT tells the engineer to immediately disconnect the network cable and to not do anything else.

  Which of the following is the most likely reason for this request?

  A. The CSIRT thinks an insider threat is attacking the network
  B. Outages of business-critical systems cost too much money
  C. The CSIRT does not consider the systems engineer to be trustworthy
  D. Memory contents including fileles malware are lost when the power is turned off
  A. The CSIRT thinks an insider threat is attacking the network

• Question 357:

  Which of the following, if compromised, can indirectly impact systemsA. SCADA
  B. TPM
  C. HSM
  D. HVAC

  D. HVAC

• Question 358:

  Which of the following must be in place before implementing a BCP?

  A. SLA
  B. AUP
  C. NDA
  D. BIA
  D. BIA

• Question 359:

  Which of the following incident response phases should the proper collection of the detected 'ocs and establishment of a chain of custody be performed before?

  A. Containment
  B. Identification
  C. Preparation
  D. Recovery
  A. Containment

  ---

  Containment is the phase where the incident response team tries to isolate and stop the spread of the incident12. Before containing the incident, the team should collect and preserve any evidence that may be useful for analysis and investigation12 . This includes documenting the incident details, such as date, time, location, source, and impact12. It also includes establishing a chain of custody, which is a record of who handled the evidence, when, where, how, and why3. A chain of custody ensures the integrity and admissibility of the evidence in court or other legal proceedings3.

• Question 360:

  A Chief Executive Officer's (CEO) personal information was stolen in a social engineering attack. Which of the following sources would reveal if the CEO's personal information is for sale?

  A. Automated information sharing
  B. Open-source intelligence
  C. The dark web
  D. Vulnerability databases
  C. The dark web

  ---

  The dark web is where you go for the purchase of illegal items, but damn ima bout to fail this exam lol.