CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 461:

  Which of the following is a security best practice that ensures the integrity of aggregated log files within a SIEM?

  A. Set up hashing on the source log file servers that complies with local regulatory requirements,

  B. Back up the aggregated log files at least two times a day or as stated by local regulatory requirements.

  C. Write protect the aggregated log files and move them to an isolated server with limited access.

  D. Back up the source log files and archive them for at least six years or in accordance with local regulatory requirements.

  Correct Answer: A

  Log File Integrity Validation in AWS

  This feature informs you on any modifications or deletions to CloudTrail logs. By using SHA-256 for hashing and SHA-256 with RSA for digital signing, AWS claims, "This makes it computationally infeasible to modify, delete, or forge CloudTrail log files without detection."

• Question 462:

  Which of the following in the incident response process is the BEST approach to improve the speed of the identification phase?

  A. Activate verbose logging in all critical assets.

  B. Tune monitoring in order to reduce false positive rates.

  C. Redirect all events to multiple syslog servers.

  D. Increase the number of sensors present on the environment.

  Correct Answer: B

  Getting accurate report will allow analyst to pinpoint the problem fast.

  not A, cause there is no point focusing on Critical Asset when point of entry is likely some host.

  not C, cause having your logs distributed makes it harder to aggregate.

  not d, more sensor will produce more log for analyst to sift through.

• Question 463:

  An annual information security assessment has revealed that several OS-level configurations are not in compliance due to outdated hardening standards the company is using. Which of the following would be BEST to use to update and reconfigure the OS-level security configurations?

  A. CIS benchmarks

  B. GDPR guidance

  C. Regional regulations

  D. ISO 27001 standards

  Correct Answer: A

  CIS Benchmarks for mobile devices cover security configurations for operating systems that run on mobile phones, tablets, and other hand-held devices.

  ISO/IEC 27001 is an Information security management standard that structures how businesses should manage risk associated with information security threats;

  The General Data Protection Regulation sets guidelines for the collection and processing of personal data of individuals within the European Union; its about how organizations should handle the personal data of individuals

  https://www.beyondtrust.com/resources/glossary/systems-hardening

• Question 464:

  An analyst is reviewing logs associated with an attack. The logs indicate an attacker downloaded a malicious file that was quarantined by the AV solution. The attacker utilized a local non-administrative account to restore the malicious file to a new location. The file was then used by another process to execute a payload. Which of the following attacks did the analyst observe?

  A. Privilege escalation

  B. Request forgeries

  C. Injection

  D. Replay attack

  Correct Answer: C

  key words "non-admin account" and "execute a payload " hence C correct

• Question 465:

  The president of a regional bank likes to frequently provide SOC tours to potential investors. Which of the following policies BEST reduces the risk of malicious activity occurring after a tour?

  A. Password complexity

  B. Acceptable use

  C. Access control

  D. Clean desk

  Correct Answer: D

  A malicious investor would not be able to take advantage of anything gained until after the tour if the swiped a USB, looked at or stole documents. If their was a clean desk policy then that would prevent issues after a tour.

• Question 466:

  A vulnerability has been discovered and a known patch to address the vulnerability does not exist. Which of the following controls works BEST until a proper fix is released?

  A. Detective

  B. Compensating

  C. Deterrent

  D. Corrective

  Correct Answer: B

• Question 467:

  Which of the following uses SAML for authentication?

  A. TOTP

  B. Federation

  C. Kerberos

  D. HOTP

  Correct Answer: B

  Federation, or identity federation, defines policies, protocols, and practices to manage identities across systems and organizations. Federation's ultimate goal is to allow users to seamlessly access data or systems across domains. Federation is enabled through the use of industry standards such as Security Assertion Markup Language (SAML).

• Question 468:

  A SOC operator is receiving continuous alerts from multiple Linux systems indicating that unsuccessful SSH attempts to a functional user ID have been attempted on each one of them in a short period of time. Which of the following BEST explains this behavior?

  A. Rainbow table attack

  B. Password spraying

  C. Logic bomb

  D. Malware bot

  Correct Answer: B

  Password Spraying is a variant of what is known as a brute force attack. In a traditional brute force attack, the perpetrator attempts to gain unauthorized access to a single account by guessing the password "repeatedly" in a very short period of time.

• Question 469:

  A security analyst is evaluating the risks of authorizing multiple security solutions to collect data from the company's cloud environment Which of the following is an immediate consequence of these integrations?

  A. Non-compliance with data sovereignty rules

  B. Loss of the vendor's interoperability support

  C. Mandatory deployment of a SIEM solution

  D. Increase in the attack surface

  Correct Answer: D

  While Non-compliance with data sovereignty rules is an implication of having multiple cloud providers at DIFFERENT countries, this is not specified in the question, besides, they are security solutions, which typically means they will not collect any kind of PII, PHI, SPI

• Question 470:

  A major political party experienced a server breach. The hacker then publicly posted stolen internal communications concerning campaign strategies to give the opposition party an advantage. Which of the following BEST describes these threat actors?

  A. Semi-authorized hackers

  B. State actors

  C. Script kiddies

  D. Advanced persistent threats

  Correct Answer: B

  APT=An attacker's ability to obtain, maintain, and diversify access to network systems using exploits and malware.

  Stateactor=A type of threat actor that is supported by the resources of its host country's military and security services.