CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 661:

  An organization wants to integrate its incident response processes into a workflow with automated decision points and actions based on predefined playbooks. Which of the following should the organization implement?

  A. SIEM
  B. SOAR
  C. EDR
  D. CASB
  B. SOAR

• Question 662:

  A security analyst is looking for a way to categorize and share a threat actor's TTPs with colleagues at a partner organization. Which of the following would be the best method to achieve this goal?

  A. Releasing the lessons-learned report
  B. Using the MITRE ATTandCK framework
  C. Sharing the CVE IDs used in attacks
  D. Sending relevant log files and pcaps
  B. Using the MITRE ATTandCK framework

  ---

  B. Using the MITRE ATTandCK framework MITRE ATTandCK provides a standardized way to categorize and share information about threat actors' Tactics, Techniques, and Procedures (TTPs). This framework would be a suitable method for a security analyst to categorize and share information about a threat actor's TTPs with colleagues at a partner organization.

• Question 663:

  An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?

  A. Exception
  B. Segmentation
  C. Risk transfer
  D. Compensating controls
  D. Compensating controls

  ---

  Legacy = Compensating Compensating controls are alternative security measures put in place when standard controls cannot be implemented or are not sufficient to meet security requirements. In this case, the organization disabled unneeded services and implemented a firewall in front of a business-critical legacy system. These actions can be considered compensating controls to mitigate risks associated with the legacy system's security weaknesses or limitations.

• Question 664:

  A critical file server is being upgraded and the systems administrator must determine which RAID level the new server will need to achieve parity and handle two simultaneous disk failures. Which of the following RAID levels meets this requirements?

  A. RAID 0+1
  B. RAID 2
  C. RAID 5
  D. RAID 6
  D. RAID 6

  ---

  RAID 6 is a fault-tolerant RAID level that provides dual parity, which means it can withstand the failure of two disks simultaneously without data loss. It is achieved by distributing two sets of parity information across the disks. This level of fault tolerance makes RAID 6 suitable for critical systems where data integrity and high availability are crucial.

• Question 665:

  A business is looking for a cloud service provider that offers a la carte services, including cloud backups, VM elasticity, and secure networking. Which of the following cloud service provider types should business engage?

  A. A laaS
  B. PaaS
  C. XaaS
  D. SaaS
  C. XaaS

• Question 666:

  Which of the following types of disaster recovery plan exercises requires the least interruption to IT operations?

  A. Parallel
  B. Full-scale
  C. Tabletop
  D. Simulation
  C. Tabletop

• Question 667:

  A security analyst discovers that a large number of employee credentials had been stolen and were being sold on the dark web. The analyst investigates and discovers that some hourly employee credentials were compromised, but salaried employee credentials were not affected.

  Most employees clocked in and out while they were inside the building using one of the kiosks connected to the network. However, some clocked out and recorded their time after leaving to go home. Only those who clocked in and out while inside the building had credentials stolen. Each of the kiosks are on different floors, and there are multiple routers, since the business segments environments for certain business functions.

  Hourly employees are required to use a website called acmetimekeeping.com to clock in and out. This website is accessible from the internet. Which of the following is the most likely reason for this compromise?

  A. A brute-force attack was used against the time-keeping website to scan for common passwords.
  B. A malicious actor compromised the time-keeping website with malicious code using an unpatched vulnerability on the site, stealing the credentials.
  C. The internal DNS servers were poisoned and were redirecting acmetimekeeping.com to a malicious domain that intercepted the credentials and then passed them through to the real site.
  D. ARP poisoning affected the machines in the building and caused the kiosks to send a copy of all the submitted credentials to a malicious machine.
  B. A malicious actor compromised the time-keeping website with malicious code using an unpatched vulnerability on the site, stealing the credentials.

• Question 668:

  A privileged user at a company stole several proprietary documents from a server. The user also went into the log files and deleted all records of the incident. The systems administrator has Just informed investigators that other log files are available for review.

  Which of the following did the administrator MOST likely configure that will assist the investigators?

  A. Memory dumps
  B. The syslog server
  C. The application logs
  D. The log retention policy
  B. The syslog server

  ---

  It is good security practice for organizations to have Syslog server configured and logs from all systems forwarded and stored to it, just in cases like this mentioned in the question, where attacker could get access to the host and delete all logs from it trying to cover his tracks.

• Question 669:

  A security monitoring company offers a service that alerts its customers if their credit cards have been stolen. Which of the following is the MOST likely source of this information?

  A. STIX
  B. The dark web
  C. TAXI
  D. Social media
  E. PCI
  B. The dark web

• Question 670:

  The Chief information Security Officer wants to prevent exfilitration of sensitive information from employee cell phones when using public USB power charging stations. Which of the following would be the Best solution to implement?

  A. DLP
  B. USB data blocker
  C. USB OTG
  D. Disabling USB ports
  B. USB data blocker

  ---

  Explanation Explanation/Reference:A USB data blocker prevents attackers from infecting a device with malware or stealing data. When charging your phone in locations such as airports, or other unknown power sources, the use of a USB data blocker protects the phone but allows it to charge