CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 31:

  Multiple business accounts were compromised a few days after a public website had its credentials database leaked on the Internet. No business emails were identified in the breach, but the security team thinks that the list of passwords exposed was later used to compromise business accounts.

  Which of the following would mitigate the issue?

  A. Complexity requirements
  B. Password history
  C. Acceptable use policy
  D. Shared accounts
  B. Password history

  ---

  Password reuse is an important concern in any organization. Many users want to reuse the same password for their account over a long period of time.

• Question 32:

  A company's public-facing website, https://www.organization.com, has an IP address of 166.18.75.6. However, over the past hour the SOC has received reports of the site's homepage displaying incorrect information. A quick nslookup search shows hitps://;www.organization.com is pointing to 151.191.122.115.

  Which of the following is occurring?

  A. DoS attack
  B. ARP poisoning
  C. DNS spoofing
  D. NXDOMAIN attack
  C. DNS spoofing

  ---

  Domain Name Server (DNS) spoofing, or DNS cache poisoning, is an attack involving manipulating DNS records to redirect users toward a fraudulent, malicious website that may resemble the user's intended destination.

• Question 33:

  A security analyst is reviewing information regarding recent vulnerabilities. Which of the following will the analyst MOST likely consult to validate which platforms have been affected?

  A. SINT
  B. SIEM
  C. CVSS
  D. CVE
  D. CVE

  ---

  Explanation Explanation/Reference:CVE as answer doesn't make sense to me, unless I'm reading/interpreting it in a wrong way, here's why: If tha analyst is reviwring info regarding recent vulnerabilities, that means he's aware of the vuln, so why bother to look into the CVE at the first place? The questions goes "...to validate **which platforms have been affected**", how can you possibly know which platforms have been affected in your environment just looking at an external informational database like CVE/ CVSS? You need some sort of internal tool that will log which platform/devices are likely vulnerable to a given CVE, and a SIEM solution has definitely all the requirements to give you that information.

• Question 34:

  Which of the following security controls is used to isolate a section of the network and its externally available resources from the internal corporate network in order to reduce the number of possible attacks?

  A. Faraday cages
  B. Air gap
  C. Vaulting
  D. Proximity readers
  B. Air gap

• Question 35:

  Which of the following conditions impacts data sovereignty?

  A. Rights management
  B. Criminal investigations
  C. Healthcare data
  D. Intemational operations
  D. Intemational operations

• Question 36:

  A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization's existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would best meet the architect's objectives?

  A. Trusted Platform Module
  B. IaaS
  C. HSMaaS
  D. PaaS
  C. HSMaaS

  ---

  HSMaaS (Hardware Security Module as a Service): HSMaaS is a cloud service that offers dedicated cryptographic processing and key management. It's designed to protect sensitive data and allows for centralized management and storage of encryption keys. By using HSMaaS, organizations can achieve the required key management across multicloud environments while maintaining centralized control.

• Question 37:

  An organization regularly scans its infrastructure for missing security patches but is concerned about hackers gaining access to the scanner's account. Which of the following would be BEST to minimize this risk?

  A. Require a complex, eight-character password that is updated every 90 days.
  B. Perform only non-intrusive scans of workstations.
  C. Use non-credentialed scans against high-risk servers.
  D. Log and alert on unusual scanner account logon times.
  A. Require a complex, eight-character password that is updated every 90 days.

• Question 38:

  A security analyst must determine if either SSH or Telnet is being used to log in to servers. Which of the following should the analyst use?

  A. logger
  B. Metasploit
  C. tcpdump
  D. netstat
  D. netstat

• Question 39:

  A web server administrator has redundant servers and needs to ensure failover to the secondary server when the primary server goes down. Which of the following should the administrator implement to avoid disruption?

  A. NIC teaming
  B. High availability
  C. Dual power supply
  D. laaS
  B. High availability

  ---

  Failover is the key word in here. We can get redundancy with NIC Teaming. But they dont take the fail over. The traffic is directed automaticly to another NIC. it is not a failover.

• Question 40:

  To further secure a company's email system, an administrator is adding public keys to DNS records in the company's domain Which of the following is being used?

  A. PFS
  B. SPF
  C. DMARC
  D. DNSSEC
  D. DNSSEC

  ---

  1. DNSSEC 2. Domain Name System Security Extensions 3. Validate DNS responses 4. Origin authentication, data integrit