CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 431:

  Which of the following can best protect against an employee inadvertently installing malware on a company system?

  A. Host-based firewall
  B. System isolation
  C. Least privilege
  D. Application allow list
  D. Application allow list

  ---

  CompTIA Security+ emphasizes the importance of application control and whitelisting as a strong security practice. An application allow list ensures that only approved and authorized applications can run on a system, effectively preventing the execution of unauthorized or potentially malicious software. This practice aligns with the principle of minimizing attack surfaces and reducing the risk of malware infections caused by inadvertently installing unapproved software. While the principle of least privilege (Option C) is also an important security principle, it focuses on restricting user permissions to the minimum necessary level. Application allow lists provide more direct protection against unauthorized software execution in the context of malware prevention.

• Question 432:

  An organization that is located in a flood zone is MOST likely to document the concerns associated with the restoration of IT operation in a:

  A. business continuity plan
  B. communications plan.
  C. disaster recovery plan.
  D. continuity of operations plan
  C. disaster recovery plan.

  ---

  A disaster recovery plan (DRP) is a documented and structured approach that outlines the processes and procedures to recover and restore IT systems and operations after a disruptive event, such as a flood or other disaster In the flood zone, a disaster recovery plan would address the specific concerns and considerations related to the restoration of IT operations after a flood. While a business continuity plan (Option A) is closely related to a disaster recovery plan, it typically has a broader scope and encompasses the overall strategies and actions to ensure the continuity of business operations in the face of various disruptions including floods. Option B focuses on establishing effective communication channels during emergencies. A continuity of operations plan (Option D) is generally associated with government agencies and outlines procedures to ensure the continuous performance of essential functions during a wide range of emergencies.

• Question 433:

  A well-known organization has been experiencing attacks from APIs. The organization is concerned that custom malware is being created and emailed into the company or installed on USB sticks that are dropped in parking lots. Which of the following is the BEST defense against this scenario?

  A. Configuring signature-based antivirus io update every 30 minutes
  B. Enforcing S/MIME for email and automatically encrypting USB drives upon insertion.
  C. Implementing application execution in a sandbox for unknown software.
  D. Fuzzing new files for vulnerabilities if they are not digitally signed
  C. Implementing application execution in a sandbox for unknown software.

  ---

  The best defense against the scenario described is implementing application execution in a sandbox for unknown software. A sandbox is a controlled environment in which an application can be executed and observed without affecting the rest of the system. This allows the application to be run safely, even if it is unknown or potentially malicious. If the application is found to be malicious, it can be terminated without damaging the rest of the system. Configuring signature-based antivirus to update every 30 minutes can help protect against known malware, but it will not protect against custom malware that has not yet been detected. Enforcing S/MIME for email and automatically encrypting USB drives upon insertion can help protect against unauthorized access to sensitive data, but it will not protect against malware that is installed on a system. Fuzzing new files for vulnerabilities can help identify potential weaknesses in software, but it will not protect against malware that is already installed on a system

• Question 434:

  Which of the following is the MOST effective control against zero-day vulnerabilities?

  A. Network segmentation
  B. Patch management
  C. Intrusion prevention system
  D. Multiple vulnerability scanners
  A. Network segmentation

  ---

  Explanation Explanation/Reference:IPS can only protect against known host and application-based attacks and exploits. IPS inspects traffic against signatures and anomalies, it does cover a broad spectrum of attack types, most of them signature-based, and signatures alone cannot protect against zero-day attacks. (www.rawcode7.medium.com) However, with network segmentation, you're able to isolate critical assets into different segments. And when a zero-day attack occurs, you're not at risk of losing all and are able to isolate the attack's effect to one segment.

• Question 435:

  A security analyst is tasked with classifying data to be stored on company servers. Which of the following should be classified as proprietary?

  A. Customers' dates of birth
  B. Customers' email addresses
  C. Marketing strategies
  D. Employee salaries
  C. Marketing strategies

  ---

  Proprietary Information" shall mean information (whether now existing or hereafter created or acquired) developed, created, or discovered by the Company, or which became known by, or was conveyed to the Company, which has commercial value in the Company's business.

• Question 436:

  A company has decided to move its operations to the cloud. It wants to utilize technology that will prevent users from downloading company applications for personal use, restrict data that is uploaded, and have visibility into which applications are being used across the company. Which of the following solutions will best meet these requirements?

  A. An NGFW
  B. A CASB
  C. Application whitelisting
  D. An NG-SWG
  B. A CASB

  ---

  A Cloud Access Security Broker (CASB) would best meet the requirements stated in the scenario. CASBs can provide visibility into which cloud applications are being used across a company, restrict data that is uploaded to the cloud, and prevent unauthorized downloading of company applications for personal use. They act as a gatekeeper, allowing the organization to extend its security policies beyond its own infrastructure. CASBs provide features like visibility, data security, threat protection, and compliance, ensuring secure and only authorized use of cloud services by employees.

• Question 437:

  Law enforcement officials sent a company a notification that states electronically stored information and paper documents cannot be destroyed. Which of the following explains this process?

  A. Data breach notification
  B. Accountability
  C. Legal hald
  D. Chain of custody
  C. Legal hald

  ---

  A legal hold is a process in which an organization is required to preserve all relevant electronically stored information (ESI) and paper documents that may be related to a pending or anticipated legal action. It is typically initiated by law enforcement or legal authorities when there is an investigation, lawsuit, or audit involving the organization. During a legal hold, the organization is prohibited from destroying or altering any potentially relevant data or documents to ensure that evidence is preserved and available for the legal process.

• Question 438:

  Which of the following will MOST likely cause machine-learning and AI-enabled systems to operate with unintended consequences?

  A. Stored procedures
  B. Buffer overflows
  C. Data bias
  D. Code reuse
  C. Data bias

  ---

  Explanation Explanation/Reference:https://bernardmarr.com/default.asp?contentID=1827

• Question 439:

  An organization is concerned that is hosted web servers are not running the most updated version of the software. Which of the following would work BEST to help identify potential vulnerabilities?

  A. Hping3 -s comptia, org - 80
  B. Nc -1 -v comptia, org -p 80
  C. nmp comptia, org -p 80 -aV
  D. nslookup -port=80 comtia.org
  C. nmp comptia, org -p 80 -aV

  ---

  is used to discover hosts and services on a computer network by sending packets and analyzing the responses. Nmap provides a number of features for probing computer networks, including host discovery and service and operating system detection.

• Question 440:

  Which of the following environments minimizes end-user disruption and is MOST likely to be used to assess the impacts of any database migrations or major system changes by using the final version of the code?

  A. Staging
  B. Test
  C. Production
  D. Development
  A. Staging

  ---

  A staging environment is used to validate code that will be deployed. I have seen you providing answers with no context behind them and being wrong.