CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 411:

  A security analyst is performing a forensic investigation compromised account credentials. Using the Event Viewer, the analyst able to detect the following message, `'Special privileges assigned to new login.'' Several of these messages did not have a valid logon associated with the user before these privileges were assigned.

  Which of the following attacks is MOST likely being detected?

  A. Pass-the-hash
  B. Buffer overflow
  C. Cross-site scripting
  D. Session replay
  A. Pass-the-hash

  ---

  Explanation Explanation/Reference:Pass-the-hash is an attack technique that attackers use to obtain the NTLM or LANMAN hash of a user's password and then use it to authenticate to other systems and resources to which the account has access to achieve lateral movement within the network. This attack is possible because Windows stores password hashes in memory, and an attacker can steal these hashes and use them to authenticate to other systems without knowing the actual password https://www.beyondtrust.com/resources/glossary/pass-the-hash-pth-attack

• Question 412:

  A security analyst receives an alert from trie company's SIEM that anomalous activity is coming from a local source IP address of 192.168.34.26. The Chief Information Security Officer asks the analyst to block the originating source Several days later, another employee opens an internal ticket stating that vulnerability scans are no longer being performed properly. The IP address the employee provides is 192 168.3426. Which of the following describes this type of alert?

  A. True positive
  B. True negative
  C. False positive
  D. False negative
  C. False positive

  ---

  Explanation Explanation/Reference:True Positive: A legitimate attack which triggers to produce an alarm. You have a brute force alert, and it triggers. You investigate the alert and find out that somebody was indeed trying to break into one of your systems via brute force methods. False Positive: An event signalling to produce an alarm when no attack has taken place. You investigate another of these brute force alerts and find out that it was just some user who mistyped their password a bunch of times, not a real attack. False Negative: When no alarm is raised when an attack has taken place. Someone was trying to break into your system, but they did so below the threshold of your brute force attack logic. For example, you set your rule to look for ten failed login in a minute, and the attacker did only 9. The attack occurred, but your control was unable to detect it. True Negative: An event when no attack has taken place and no detection is made. No attack occurred, and your rule didn't make fire.

• Question 413:

  A symmetric encryption algorithm Is BEST suited for:

  A. key-exchange scalability.
  B. protecting large amounts of data.
  C. providing hashing capabilities,
  D. implementing non-repudiation.
  B. protecting large amounts of data.

  ---

  Explanation Explanation/Reference:Symmetric key distribution does not scale as well as Asymmetric (Dion Symmetric VS Asymmetric Obj. 2.8). Non-Repudiation does not apply here as well..but symmetric does support large amounts of data.

• Question 414:

  Which of the following environments utilizes dummy data and is MOST likely to be installed locally on a system that allows code to be assessed directly and modified easily with each build?

  A. Production
  B. Test
  C. Staging
  D. Development
  D. Development

  ---

  A development environment is essentially what is on the development team's computers. It's where the developers are writing their code, making code updates, and where all their commits and branches exist. The development environment does not affect what the end user sees. Instead, it allows development to try out new features and updates before pushing them forward to deployment. A lot of preliminary testing is done at this point before moving to the next environment ? the stage environment. https://www.pagerduty.com/resources/learn/what-is-production-environment/

• Question 415:

  Users report access to an application from an internal workstation is still unavailable to a specific server, even after a recent firewall rule implementation that was requested for this access. ICMP traffic is successful between the two devices. Which of the following tools should the security analyst use to help identify if the traffic is being blocked?

  A. nmap
  B. tracert
  C. ping
  D. ssh
  A. nmap

  ---

  Tracert is a command-line tool that shows the route that packets take to reach a destination on a network1. It also displays the time it takes for each hop along the way1. By using tracert, you can see if there is a router or firewall that is blocking or slowing down the traffic between the internal workstation and the specific server1.

• Question 416:

  An incident analyst finds several image files on a hard disk. The image files may contain geolocation coordinates. Which of the following best describes the type of information the analyst is trying to extract from the image files?

  A. Log data
  B. Metadata
  C. Encrypted data
  D. Sensitive data
  B. Metadata

• Question 417:

  Which of the following are the MOST likely vectors for the unauthorized inclusion of vulnerable code in a software company's final software releases? (Select TWO.)

  A. Unsecure protocols
  B. Use of penetration-testing utilities
  C. Weak passwords
  D. Included third-party libraries
  E. Vendors/supply chain
  F. Outdated anti-malware software
  D. Included third-party libraries
  E. Vendors/supply chain

  ---

  A. Unsecure protocols --> Could be correct. This is a vector that could be used shortly before the final release to somehow include malicious code. B. Use of penetration-testing utilities --> Makes no sense C. Weak passwords --> Is an attack vector and "unauthorized" could match that. Might be correct. D. Included third-party libraries --> unintentional would fit. But if there was something wrong with a 3rd party libary, that should have been discovered before the final release. E. Vendors/supply chain --> Depends on what these vendors do. If they are developing code that is used in the final release it could contain vulnerabilities that are included unintentionally. But that would be kind of similar to the 3rd party libraries. F. Outdated anti-malware software --> With outdated anti-malware, and attacker could gain acces to a developers machine and include vulnerable code. The developer could then commit it unintentionally.

• Question 418:

  A security proposal was set up to track requests for remote access by creating a baseline of the users' common sign-in properties. When a baseline deviation is detected, an Iv1FA challenge will be triggered. Which of the following should be configured in order to deploy the proposal?

  A. Context-aware authentication
  B. Simultaneous authentication of equals
  C. Extensive authentication protocol D. Agentless network access control
  A. Context-aware authentication

  ---

  An access control scheme that verifies an object's identity based on various environmental factors, like time, location, and behavior.

• Question 419:

  An analyst is working on an email security incident in which the target opened an attachment containing a worm. The analyst wants to implement mitigation techniques to prevent further spread. Which of the following is the BEST course of action for the analyst to take?

  A. Apply a DLP solution.
  B. Implement network segmentation
  C. Utilize email content filtering,
  D. isolate the infected attachment.
  B. Implement network segmentation

  ---

  Implementing network segmentation can effectively contain the spread of the worm by isolating the infected system or segment from the rest of the network. This prevents the worm from propagating to other parts of the network and helps mitigate the impact of the incident. Network segmentation is a proactive approach to prevent lateral movement of malware within the network. While isolating the infected attachment (Option D) can be useful, it might not be as effective in preventing the worm from attempting to spread through other means or vectors beyond the isolated system. Implementing network segmentation provides a broader approach to isolating the affected systems and reducing the potential attack surface for the worm.

• Question 420:

  A company is required to continue using legacy software to support a critical service. Which of the following BEST explains a risk of this practice?

  A. Default system configuration
  B. Unsecure protocols
  C. Lack of vendor support
  D. Weak encryption
  C. Lack of vendor support

  ---

  Explanation Explanation/Reference:Lack of vendor support implies no security patches. Unsecure protocols are not necessarily always the case. Legacy Systems - Legacy systems are a source of risk because they no longer receive security updates and because the expertise to maintain and troubleshoot them is a scarce resource