CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 661:

  Which of the following scenarios would make a DNS sinkhole effective in thwarting an attack?

  A. An attacker is sniffing traffic to port 53, and the server is managed using unencrypted usernames and passwords.

  B. An organization is experiencing excessive traffic on port 53 and suspects an attacker is trying to DoS the domain name server.

  C. Malware trying to resolve an unregistered domain name to determine if it is running in an isolated sandbox

  D. DNS Routing tables have been compromised, and an attacker is rerouting traffic to malicious websites

  Correct Answer: D

  A DNS sinkhole, also known as a sinkhole server, Internet sinkhole, or Blackhole DNS[1] is a DNS server that gives out a false result for a domain name.

  A sinkhole is a DNS provider that supplies systems looking for DNS information with false results, allowing an attacker to redirect a system to a potentially malicious destination. DNS sinkholes have also historically been used for non-malicious purposes.

• Question 662:

  An engineer needs to deploy a security measure to identify and prevent data tampering within the enterprise. Which of the following will accomplish this goal?

  A. Antivirus

  B. IPS.

  C. FTP

  D. FIM

  Correct Answer: D

• Question 663:

  A security analyst is hardening a network infrastructure. The analyst is given the following requirements:

  1.

  Preserve the use of public IP addresses assigned to equipment on the core router.

  2.

  Enable "in transport" encryption protection to the web server with the strongest ciphers.

  Which of the following should the analyst implement to meet these requirements? (Select TWO).

  A. Configure VLANs on the core router.

  B. Configure NAT on the core router.

  C. Configure BGP on the core router.

  D. Enable AES encryption on the web server.

  E. Enable 3DES encryption on the web server.

  F. Enable TLSv2 encryption on the web server.

  Correct Answer: BF

• Question 664:

  An organization has a growing workforce that is mostly driven by additions to the sales department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering it the organization may need to scale down just as quickly as it scaled up. The ClO is also concerned about the organization's security and customer privacy. Which of the following would be BEST to address the ClO's concerns?

  A. Disallow new hires from using mobile devices for six months

  B. Select four devices for the sales department to use in a CYOD model

  C. Implement BYOD for the sates department while leveraging the MDM

  D. Deploy mobile devices using the COPE methodology

  Correct Answer: C

  BEST way to deal with scale issue is not buying any

• Question 665:

  A company's bank has reported that multiple corporate credit cards have been stolen over the past several weeks. The bank has provided the names of the affected cardholders to the company's forensics team to assist in the cyber-incident

  investigation.

  An incident responder learns the following information:

  The timeline of stolen card numbers corresponds closely with affected users making Internet-based purchases from diverse websites via enterprise desktop PCs.

  All purchase connections were encrypted, and the company uses an SSL inspection proxy for the inspection of encrypted traffic of the hardwired network.

  Purchases made with corporate cards over the corporate guest WiFi network, where no SSL inspection occurs, were unaffected.

  Which of the following is the MOST likely root cause?

  A. HTTPS sessions are being downgraded to insecure cipher suites

  B. The SSL inspection proxy is feeding events to a compromised SIEM

  C. The payment providers are insecurely processing credit card charges

  D. The adversary has not yet established a presence on the guest WiFi network

  Correct Answer: B

  The purchases are only getting affected from systems where SSL inspection is occurring. Its fine on all others. IT cant be a HTTPS downgrade as that wouldn't be specific to the SSL inspection.

• Question 666:

  Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario?

  A. Watering-hole attack

  B. Credential harvesting

  C. Hybrid warfare

  D. Pharming

  Correct Answer: A

  An attack in which an attacker targets specific groups or organizations, discovers which websites they frequent, and injects malicious code into those sites.

• Question 667:

  A security Daalyst is taking part in an evaluation process that analyzes and categorizes threat actors of real-world events in order to improve the incident response team's process. Which of the following is the analyst MOST likely participating in?

  A. MITRE ATTandCK

  B. Walk-through

  C. Red team

  D. Purple team

  E. TAXII

  Correct Answer: D

  A purple team is a group of cyber security professionals who simulate malicious attacks and penetration testing in order to identify security vulnerabilities and recommend remediation strategies for an organization's IT infrastructure. The term is derived from the color purple, which symbolizes the combination of both red and blue teams.

  Unlike traditional red team/blue teams, which are usually separate entities, the purple team works in close coordination, sharing information and insights in order to address acute weaknesses and improve the organization's overall security posture.

• Question 668:

  A security analyst is performing a forensic investigation compromised account credentials. Using the Event Viewer, the analyst able to detect the following message, `'Special privileges assigned to new login.'' Several of these messages did not have a valid logon associated with the user before these privileges were assigned.

  Which of the following attacks is MOST likely being detected?

  A. Pass-the-hash

  B. Buffer overflow

  C. Cross-site scripting

  D. Session replay

  Correct Answer: A

  Pass-the-hash is an attack technique that attackers use to obtain the NTLM or LANMAN hash of a user's password and then use it to authenticate to other systems and resources to which the account has access to achieve lateral movement within the network. This attack is possible because Windows stores password hashes in memory, and an attacker can steal these hashes and use them to authenticate to other systems without knowing the actual password

  https://www.beyondtrust.com/resources/glossary/pass-the-hash-pth-attack

• Question 669:

  A smart retail business has a local store and a newly established and growing online storefront. A recent storm caused a power outage to the business and the local ISP, resulting in several hours of lost sales and delayed order processing. The business owner now needs to ensure two things:

  1.

  Protection from power outages

  2.

  Always-available connectivity In case of an outage The owner has decided to implement battery backups for the computer equipment Which of the following would BEST fulfill the owner's second need?

  A. Lease a point-to-point circuit to provide dedicated access.

  B. Connect the business router to its own dedicated UPS.

  C. Purchase services from a cloud provider for high availability

  D. Replace the business's wired network with a wireless network

  Correct Answer: C

  Read it again if the owner transfers everything to a reliable High-Availability data center, he won't have to worry about buying infrastructure or backup internet connection. So he can simply store everything with a reliable Cloud provider

• Question 670:

  A company processes highly sensitive data and senior management wants to protect the sensitive data by utilizing classification labels. Which of the following access control schemes would be BEST for the company to implement?

  A. Discretionary

  B. Rule-based

  C. Role-based

  D. Mandatory

  Correct Answer: D

  Mandatory Access Control begins with security labels assigned to all resource objects on the system. These security labels contain two pieces of information - a classification (top secret, confidential etc) and a category (which is essentially an indication of the management level, department or project to which the object is available). Mandatory Access Control is by far the most secure access control environment but does not come without a price. Firstly, MAC requires a considerable amount of planning before it can be effectively implemented https://www.techotopia.com/index.php/Mandatory,_Discretionary,_Role_and_Rule_Based_Access_Control