CompTIA CompTIA Security+ SY0-601 Questions & Answers

• Question 31:

  A network administrator at a large organization is reviewing methods to improve the security of the wired LAN. Any security improvement must be centrally managed and allow corporate-owned devices to have access to the intranet but limit others to Internet access only. Which of the following should the administrator recommend?

  A. 802.1X utilizing the current PKI infrastructure

  B. SSO to authenticate corporate users

  C. MAC address filtering with ACLs on the router

  D. PAM for users account management

  Correct Answer: A

  It's possible to combine an 802.1x server with other network elements such as a virtual local area network (VLAN). For example, imagine you want to provide visitors with Internet access, but prevent them from accessing internal network resources. You can configure the 802.1x server to grant full access to authorized clients, but redirect unauthorized clients to a guest area of the network via a VLAN.

• Question 32:

  A company has been experiencing very brief power outages from its utility company over the last few months. These outages only last for one second each time. The utility company is aware of the issue and Is working to replace a faulty transformer. Which of the following BEST describes what the company should purchase to ensure its critical servers and network devices stay online?

  A. Dual power supplies

  B. A UPS

  C. A generator

  D. A PDU

  Correct Answer: B

  based on the name itself "Uninterruptible Power Supply", so an interruption of a 1 second will not gonna happen.

• Question 33:

  An organization recently recovered from a data breach. During the root cause analysis, the organization determined the source of the breach to be a personal cell phone that had been reported lost. Which of the following solutions should the organization implement to reduce the likelihood of future data breaches?

  A. MDM

  B. MAM

  C. VDI

  D. DLP

  Correct Answer: A

  D)DLP won't prevent data being recovered from a stolen/lost phone.

  A) MDM would have the data encrypted or the ability to have it wiped remotely.

• Question 34:

  A manufacturing company has several one-off legacy information systems that cannot be migrated to a newer OS due to software compatibility issues. The OSs are still supported by the vendor, but the industrial software is no longer supported. The Chief Information Security Officer (CISO) has created a resiliency plan for these systems that will allow OS patches to be installed in a non-production environment, while also creating backups of the systems for recovery.

  Which of the following resiliency techniques will provide these capabilities?

  A. Redundancy

  B. RAID 1+5

  C. Virtual machines

  D. Full backups

  Correct Answer: C

  Redundancy doesn't make any sense for this question, while it is a resiliency technique it doesn't specify what they are making redundant. Virtual machines could be easily backed up using a snapshot so that covers full backups and could provide testing for OS patch compatibility with their EOL software. Full backups will require them to dedicate a system to actually conduct live tests on and is generally less cost efficient compared to VMs.

  Maybe if the question was clear we wouldn't have to assume what the question is asking. FYI you cannot ask questions during the test probably because the people proctoring doesn't know anything (pearson vue) and Comptia wouldn't answer questions regarding their questions because they only want to make money.

• Question 35:

  The spread of misinformation surrounding the outbreak of a novel virus on election day led to eligible voters choosing not to take the risk of going the polls.

  This is an example of:

  A. prepending

  B. an influence campaign.

  C. A watering-hole attack

  D. intimidation

  E. information elicitation.

  Correct Answer: B

  From Chapter 1 Social Engineering Techniques Influence Campaigns Influence campaigns involve the use of collected information and selective publication of material to key individuals in an attempt to alter perceptions and change people's minds on a topic. One can engage in an influence campaign against a single person, but the effect is limited. Influence campaigns are even more powerful when used in conjunction with social media to spread influence through influencer propagation. Influencers are people who have large followings of people who read what they post, and in many cases act in accordance or agreement. This results in an amplifying mechanism, where single pieces of disinformation can be rapidly spread and build a following across the Internet.

• Question 36:

  A security operations analyst is using the company's SIEM solution to correlate alerts. Which of the following stages of the incident response process is this an example of?

  A. Eradication

  B. Recovery

  C. Identification

  D. Preparation

  Correct Answer: C

  C: Identification

  Incident response lifecycle:

  -preparation

  -detection and analysis

  -containment, eradication, recovery

  -post-incident activity

• Question 37:

  Which of the following BEST describes the MFA attribute that requires a callback on a predefined landline?

  A. Something you exchibl

  B. Something you can do

  C. Someone you krcear

  D. Somnewehere pou are

  Correct Answer: B

• Question 38:

  A security analyst must determine if either SSH or Telnet is being used to log in to servers. Which of the following should the analyst use?

  A. logger

  B. Metasploit

  C. tcpdump

  D. netstat

  Correct Answer: D

• Question 39:

  A security administrator needs to inspect in-transit files on the enterprise network to search for PII, credit card data, and classification words. Which of the following would be the BEST to use?

  A. IDS solution

  B. EDR solution

  C. HIPS software solution

  D. Network DLP solution

  Correct Answer: D

  DLP - blocks extraction of sensitive data such as PII, PHI, credit card numbers.

• Question 40:

  Which of the following utilize a subset of real data and are MOST likely to be used to assess the features and functions of a system and how it interacts or performs from an end user's perspective against defined test cases? (Select TWO).

  A. A Production

  B. Test

  C. Research and development

  D. PoC

  E. UAT

  F. SDLC

  Correct Answer: BE