CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 501:

  A security analyst is logged into a Windows file server and needs to see who is accessing files and from which computers Which of the following tools should the analyst use?

  A. netstat
  B. net share
  C. netcat
  D. nbtstat
  E. net session
  A. netstat

• Question 502:

  During a trial, a judge determined evidence gathered from a hard drive was not admissible. Which of the following BEST explains this reasoning?

  A. The forensic investigator forgot to run a checksum on the disk image after creation
  B. The chain of custody form did not note time zone offsets between transportation regions
  C. The computer was turned off. and a RAM image could not be taken at the same time
  D. The hard drive was not properly kept in an antistatic bag when rt was moved
  B. The chain of custody form did not note time zone offsets between transportation regions

  ---

  The question states that a trial Judge determined evidence gathered from a hard drive was not admissible. It is obvious that this is a legal matter. All of the remaining answers are of a technical nature, So consequently the only issue that a Judge can rule on is a Chain of custody issue. So, ladies and gentlemen, I rest my case (quickly bangs a gavel upon the desk)

• Question 503:

  A security engineer obtained the following output from a threat intelligence source that recently performed an attack on the company's server:

  

  Which of the following BEST describes this kind of attack?

  A. Directory traversal
  B. SQL injection
  C. API
  D. Request forgery
  A. Directory traversal

  ---

  Explanation Explanation/Reference:This cannot be Directory Traversal. The key to a traversal attack is the presence of ".../etc/...." on the path.

• Question 504:

  Which of the following often operates in a client-server architecture to act as a service repository, providing enterprise consumers access to structured threat intelligence data?

  A. STIX
  B. CIRT
  C. OSINT
  D. TAXII
  D. TAXII

  ---

  From Sec+ Book - STIX represents the cyber-threat information (threat intelligence) while TAXII defines how the information is exchanged. You can think of TAXII as "how you get there. Look at this Pic >https://oasis-open.github.io/ctidocumentation/taxii/intro.html - There is a TAXII client/TAXII Server. KEY word are "providing enterprise consumers access to structured threat intelligence data?"

• Question 505:

  Which of the following rales is responsible for defining the protection type and classification type for a given set of files?

  A. General counsel
  B. Data owner
  C. Risk manager
  D. Chief Information Officer
  B. Data owner

• Question 506:

  Which of the following control types would be BEST to use to identify violations and incidents?

  A. Detective
  B. Compensating
  C. Deterrent
  D. Corrective
  E. Recovery
  F. Preventive
  A. Detective

• Question 507:

  A security administrator recently reset local passwords and the following values were recorded in the system:

  

  Which of the following is the security administrator most likely protecting against?

  A. Account sharing
  B. Weak password complexity
  C. Pass-the-hash attacks
  D. Password compromise
  C. Pass-the-hash attacks

• Question 508:

  A research company discovered that an unauthorized piece of software has been detected on a small number of machines in its lab. The researchers collaborate with other machines using port 445 and on the Internet using port 443. The unauthorized software is starting to be seen on additional machines outside of the lab and is making outbound communications using HTTPS and SMB. The security team has been instructed to resolve the problem as quickly as possible causing minimal disruption to the researchers.

  Which of the following contains the BEST course of action in this scenario?

  A. Update the host firewalls to block outbound SMB.
  B. Place the machines with the unapproved software in containment.
  C. Place the unauthorized application in a blocklist.
  D. Implement a content filter to block the unauthorized software communication.
  C. Place the unauthorized application in a blocklist.

  ---

  B would be the answer if "while causing minimal disruption to the researchers" wasn't part of the question. C is the only choice that makes sense under these conditions

• Question 509:

  While reviewing the wireless router, a systems administrator of a small business determines someone is spoofing the MAC address of an authorized device. Given the table below:

  

  Which of the following should be the administrator's NEXT step to detect if there is a rague system without impacting availability?

  A. Conduct a ping sweep.
  B. Physically check each system.
  C. Deny Internet access to the "UNKNOWN" hostname.
  D. Apply MAC filtering.
  A. Conduct a ping sweep.

  ---

  NEED FOR PING SWEEP Ping sweep is used for various purposes, such as improving and maintaining network security. It can also be used to: Discover active IP addresses on the network Ensure IP addresses on the network match the documentation Detect rogue devices connected to the network

• Question 510:

  DRAG DROP

  Determine the types of attacks below by selecting an option from the dropdown list. Determine the types of Attacks from right to specific action.

  Select and Place:

  

  

  ---

  Explanation/Reference:

  A. Phishing.

  B. Whaling.

  C. Vishing.

  D. Spim.

  E. Social engineering.

  A: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.

  Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website, however, is bogus and set up only to steal the information the user enters on the page.

  B: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles.

  Hackers who engage in whaling often describe these efforts as "reeling in a big fish,"applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or toplevel executives in business and government to stay vigilant about the possibility of cyber threats.

  C: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he or she will profit.

  D: SPIM is a term sometimes used to refer to spam over IM (Instant Messaging). It's also called just spam, instant spam, or IM marketing. No matter what the name, it consists of unwanted messages transmitted through some form of instant messaging service, which can include Short Message Service (SMS).

  E: Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It is one of the greatest threats that organizations today encounter.

  A social engineer runs what used to be called a "con game." For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that compromises the network's security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires immediate network access. Appealing to vanity, appealing to authority, appealing to greed, and old-fashioned eavesdropping are other typical social engineering techniques.

  References:

  http://www.webopedia.com/TERM/P/phishing.html

  http://www.techopedia.com/definition/28643/whaling

  http://www.webopedia.com/TERM/V/vishing.html

  http://searchsecurity.techtarget.com/definition/social-engineering