CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 511:

  A security administrator is analyzing the corporate wireless network The network only has two access points running on channels 1 and 11. While using airodump-ng. the administrator notices other access points are running with the same corporate ESSID on all available channels and with the same BSSID of one of the legitimate access ports

  Which of the following attacks in happening on the corporate network?

  A. Man in the middle

  B. Evil twin

  C. Jamming

  D. Rogue access point

  E. Disassociation

  Correct Answer: B

  From Prof Messer: A more sinister type of rogue access point is a wireless evil twin. This is an access point that is designed to look exactly like the access points that are already on your network, but they were put there for a malicious reason. This is usually an attacker that's trying to get your users to connect to their access point by using a similar SSID name, similar configuration settings, or putting the access point in an area where your users might happen to be.

  Based on the fact that it's broadcasting across all channels and specifically copying the BSSID of a legitimate access point, it seems more concerning than an employee simply plugging in a wireless router he had laying around.

• Question 512:

  Which of the following describes the exploitation of an interactive process to gain access to restncted areas?

  A. Persistence

  B. Buffer overflow

  C. Privilege escalation

  D. Pharming

  Correct Answer: C

  https://en.wikipedia.org/wiki/Privilege_escalation#:~:text=Privilege%20escalation%20is%20the%20act,from%20an%20application%20or%20user

• Question 513:

  A new company wants to avoid channel interference when building a WLAN. The company needs to know the radio frequency behavior, identify dead zones, and determine the best place for access points. Which of the following should be done FIRST?

  A. Configure heat maps.

  B. Utilize captive portals.

  C. Conduct a site survey.

  D. Install Wi-Fi analyzers.

  Correct Answer: C

• Question 514:

  During a recent incident an external attacker was able to exploit an SMB vulnerability over the internet. Which of the following action items should a security analyst perform FIRST to prevent this from occurring again?

  A. Check for any recent SMB CVEs

  B. Install AV on the affected server

  C. Block unneeded TCP 445 connections

  D. Deploy a NIDS in the affected subnet

  Correct Answer: C

  C. Block unneeded TCP 445 connections. - only blocking unneeded SMB can have "preventive" character.

  Blocking unneeded TCP 445 connections should be performed FIRST as it would prevent the SMB vulnerability from being used.

• Question 515:

  A company is implementing BYOD and wants to ensure all users have access to the same cloud-based services. Which of the following would BEST allow the company to meet this requirement?

  A. laaS

  B. PasS

  C. MaaS

  D. SaaS

  Correct Answer: D

  SaaS. It is not stating what type of devices, just BYOD, so cannot tell which platform is needed, or what requirements are involved. SaaS is the one that fits the most, IMHO.

• Question 516:

  The Chief Information Security Officer (CISO) has requested that a third-party vendor provide supporting documents that show proper controls are in place to protect customer data. Which of the following would be BEST for the third-party vendor to provide to the CISO?

  A. GDPR compliance attestation

  B. Cloud Security Alliance materials

  C. SOC 2 Type 2 report

  D. NIST RMF workbooks

  Correct Answer: C

  GDPR related to EU nothing in question to say they are in EU. SOC type 2 : tests security controls in place https://www.itgovernance.co.uk/soc-reporting

• Question 517:

  A routine audit of medical billing claims revealed that several claims were submitted without the subscriber's knowledge. A review of the audit logs for the medical billing company's system indicated a company employee downloaded customer records and adjusted the direct deposit information to a personal bank account. Which of the following does this action describe?

  A. Insider threat

  B. Social engineering

  C. Third-party risk

  D. Data breach

  Correct Answer: A

  Insider threat is the potential for an insider to use their authorized access or understanding of an organization to harm that organization

• Question 518:

  A company is providing security awareness training regarding the importance of not forwarding social media messages from unverified sources. Which of the following risks would this training help to prevent?

  A. Hoaxes

  B. SPIMs

  C. Identity fraud

  D. Credential harvesting

  Correct Answer: A

  Hoax

  A hoax is a falsehood deliberately fabricated to masquerade as the truth. It is distinguishable from errors in observation or judgment, rumors, urban legends, pseudo sciences, and April Fools' Day events that are passed along in good faith by

  believers or as jokes.

  Identity theft

  Identity theft occurs when someone uses another person's personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. The term identity theft was

  coined in 1964. Identity fraud (also known as identity theft or crime) involves someone using another individual's personal information without consent, often to obtain a benefit.

  Credential Harvesting

  Credential Harvesting (or Account Harvesting) is the use of MITM attacks, DNS poisoning, phishing, and other vectors to amass large numbers of credentials (username / password combinations) for reuse.

• Question 519:

  Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?

  A. Common Weakness Enumeration

  B. OSINT

  C. Dark web

  D. Vulnerability databases

  Correct Answer: C

  Darkweb https://www.hackers-arise.com/post/open-source-intelligence-osint-finding-breached-email-addresses-passwords-and-other-credentials

• Question 520:

  A company is looking to migrate some servers to the cloud to minimize its technology footprint. The company has 100 databases that are on premises. Which of the following solutions will require the LEAST management and support from the company?

  A. SaaS

  B. IaaS

  C. PaaS

  D. SDN

  Correct Answer: A

  In order from the least amount of management, to the most amount of management for the company: SaaS > PaaS > IaaS > On-site SaaS - Basically everything is managed by the provider PaaS - The provider manages everything other than applications and data

  IaaS - The middle-ground of services. The provider takes on half, while you take on the other half. Provider is responsible for virtualization, networking, servers, and storage. The company is responsible for applications, data, runtime, OS, and

  middleware.

  On-site - There is no service provider. The company is responsible for the whole pie.

  https://www.pcmag.com/picks/the-best-database-as-a-service-solutions