CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 591:

  A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better.

  A. validate the vulnerability exists in the organization's network through penetration testing

  B. research the appropriate mitigation techniques in a vulnerability database

  C. find the software patches that are required to mitigate a vulnerability

  D. prioritize remediation of vulnerabilities based on the possible impact.

  Correct Answer: D

  The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities. CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to threat https://en.wikipedia.org/wiki/Common_Vulnerability_Scoring_System

• Question 592:

  A privileged user at a company stole several proprietary documents from a server. The user also went into the log files and deleted all records of the incident. The systems administrator has Just informed investigators that other log files are available for review.

  Which of the following did the administrator MOST likely configure that will assist the investigators?

  A. Memory dumps

  B. The syslog server

  C. The application logs

  D. The log retention policy

  Correct Answer: B

  It is good security practice for organizations to have Syslog server configured and logs from all systems forwarded and stored to it, just in cases like this mentioned in the question, where attacker could get access to the host and delete all logs from it trying to cover his tracks.

• Question 593:

  An analyst needs to set up a method for securely transferring files between systems. One of the requirements is to authenticate the IP header and the payload. Which of the following services would BEST meet the criteria?

  A. TLS

  B. PFS

  C. ESP

  D. AH

  Correct Answer: A

  There are three requirements in the question:

  -transfer data securely between systems

  -authenticate IP header and dataload AH and ESP both provide authentication for IP header and dataload. However, only ESP provides encryption. So best solution is A AH provides authentication for the entire packet but the analyst only needs authentication on IP header/dataload + transferring file securely between systems. That makes ESP better option

• Question 594:

  A company has drafted an insider-threat policy that prohibits the use of external storage devices. Which of the following would BEST protect the company from data exfiltration via removable media?

  A. Monitoring large data transfer transactions in the firewall logs

  B. Developing mandatory training to educate employees about the removable media policy

  C. Implementing a group policy to block user access to system files

  D. Blocking removable-media devices and write capabilities using a host-based security tool

  Correct Answer: D

• Question 595:

  Which of the following BEST describes a security exploit for which a vendor patch is not readily available?

  A. Integer overflow

  B. Zero-day

  C. End of life

  D. Race condition

  Correct Answer: B

• Question 596:

  Which of the following incident response steps involves actions to protect critical systems while maintaining business operations?

  A. Investigation

  B. Containment

  C. Recovery

  D. Lessons learned

  Correct Answer: B

• Question 597:

  Which of the following BEST explains the reason why a server administrator would place a document named password.txt on the desktop of an administrator account on a server?

  A. The document is a honeyfile and is meant to attract the attention of a cyberintruder.

  B. The document is a backup file if the system needs to be recovered.

  C. The document is a standard file that the OS needs to verify the login credentials.

  D. The document is a keylogger that stores all keystrokes should the account be compromised.

  Correct Answer: A

  A honeyfile is a file used to attract an attacker. The primary way a file can attract an attacker is by the name. An example of a file named pssword.txt is a clear example of a honeyfile.

• Question 598:

  An organization suffered an outage and a critical system took 90 minutes to come back online. Though there was no data loss during the outage, the expectation was that the critical system would be available again within 60 minutes Which of the following is the 60- minute expectation an example of:

  A. MTBF

  B. RPO

  C. MTTR

  D. RTO

  Correct Answer: D

  RTO (Recovery Time Objective): is a measure that defines the maximum allowable downtime for a system or service. It represents the time within which a system must be recovered and become operational again after an incident. In the given scenario, the 60-minute expectation of having the critical system available again falls under RTO. RTO specifies the organization's recovery goals for system availability.

  https://www.enterprisestorageforum.com/management/rpo-and-rto- understanding-the-differences/

• Question 599:

  A systems administrator needs to implement an access control scheme that will allow an object's access policy to be determined by its owner. Which of the following access control schemes BEST fits the requirements?

  A. Role-based access control

  B. Discretionary access control

  C. Mandatory access control

  D. Attribute-based access control

  Correct Answer: B

  Discretionary access control (DAC) is a model of access control based on access being determined "by the owner" of the resource in question. The owner of the resource can decide who does and does not have access, and exactly what access they are allowed to have.

• Question 600:

  Which of the following would be BEST to establish between organizations that have agreed cooperate and are engaged in early discussion to define the responsibilities of each party, but do not want to establish a contractually binding agreement?

  A. An SLA

  B. An NDA

  C. A BPA

  D. An MOU

  Correct Answer: A

  Comptia exams are all about keywords and the catch here is "include monetary penalties for breaches". SLA includes penalties for not delivering services up to contract, BPA does not.