CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 791:

  A security researcher has aferted an organization that is sensitive user data was found for sale on a website. Which of the following should the organization use to inform the affected partes?

  A. An incident response plan
  B. A communications plan
  C. A business continuity plan
  D. A disaster recovery plan
  A. An incident response plan

• Question 792:

  A security engineering installing A WAF to protect the company's website from malicious web requests over SSL. Which of the following is needed to meet the objective?

  A. A reverse proxy
  B. A decryption certificate
  C. A split-tunnel VPN
  D. Load-balanced servers
  B. A decryption certificate

  ---

  Explanation Web Application Firewall (WAF): A web application firewall (WAF) is a device that performs restrictions based on rules associated with HTTP/HTTPS traffic. By definition, web application firewalls are a form of content filter, and their various configurations allow them to provide significant capabilities and protections. The level of specificity in what can be allowed or blocked can be as precise as "allow Facebook but block Facebook games." WAFs can detect and block disclosure of critical data, such as account numbers, credit card numbers, and so on. WAFs can also be used to protect websites from common attack vectors such as cross-site scripting, fuzzing, and buffer overflow attacks. You can configure a web application firewall to examine inside a TLS session. This is important if an attacker is attempting to use an encrypted channel such as TLS to mask their activity. Because legitimate TLS channels are instantiated by the system, you can pass the appropriate credentials internally to the WAF to enable TLS inspection

• Question 793:

  An analyst needs to identify the applications a user was running and the files that were open before the user's computer was shut off by holding down the power button. Which of the following would MOST likely contain that information?

  A. NGFW
  B. Pagefile
  C. NetFlow
  D. RAM
  B. Pagefile

• Question 794:

  Which of the following documents specifies what to do in the event of catastrophic loss of a physical or virtual system?

  A. Data retention plan
  B. Incident response plan
  C. Disaster recovery plan
  D. Communication plan
  C. Disaster recovery plan

• Question 795:

  A security analyst needs to complete an assessment. The analyst is logged into a server and must use native tools to map services running on it to the server's listening ports. Which of the following tools can BEST accomplish this talk?

  A. Netcat
  B. Netstat
  C. Nmap
  D. Nessus
  B. Netstat

  ---

  Explanation Explanation/Reference:The network statistics (netstat) command is a networking tool used for troubleshooting and configuration, that can also serve as a monitoring tool for connections over the network. Both incoming and outgoing connections, routing tables, port listening, and usage statistics are common uses for this command.

• Question 796:

  A security analyst Is hardening a Linux workstation and must ensure It has public keys forwarded to remote systems for secure login Which of the following steps should the analyst perform to meet these requirements? (Select TWO).

  A. Forward the keys using ssh-copy-id.
  B. Forward the keys using scp.
  C. Forward the keys using ash -i.
  D. Forward the keys using openssl -s.
  E. Forward the keys using ssh-keyger.
  A. Forward the keys using ssh-copy-id.
  D. Forward the keys using openssl -s.

• Question 797:

  An organization wants to quickly assess how effectively the IT team hardened new laptops.

  Which of the following would be the best solution to perform this assessment?

  A. Install a SIEM tool and properly configure it to read the OS configuration files.
  B. Load current baselines into the existing vulnerability scanner.
  C. Maintain a risk register with each security control marked as compliant or non-compliant.
  D. Manually review the secure configuration guide checklists.
  D. Manually review the secure configuration guide checklists.

• Question 798:

  A forensic analyst needs to prove that data has not been tampered with since it was collected

  Which of the following methods will the analyst MOST likely use?

  A. Look for tampenng on the evidence collection bag
  B. Encrypt the collected data using asymmetric encryption
  C. Ensure proper procedures for chain of custody are being followed
  D. Calculate the checksum using a hashing algorithm
  D. Calculate the checksum using a hashing algorithm

  ---

  A checksum is specifically intended to verify the integrity of data or find data corruption. Comparing a file's original and current checksum. And if a byte or even a piece of the file's data has been changed, the original and current checksum will be different, and therefore you will know whether it's the same file or not. ===================== (A) - This is essentially the physical version of checking if something was tampered but wouldn't work for virtual data (B) - Dont need to encrypt anything (C) - Even if a proper chain of custody was followed, it doesn't guarantee that data hasn't been modified by anyone that had access to the data.

• Question 799:

  A manufacturing company has several one-off legacy information systems that cannot be migrated to a newer OS due to software compatibility issues. The OSs are still supported by the vendor, but the industrial software is no longer supported. The Chief Information Security Officer (CISO) has created a resiliency plan for these systems that will allow OS patches to be installed in a non-production environment, while also creating backups of the systems for recovery.

  Which of the following resiliency techniques will provide these capabilities?

  A. Redundancy
  B. RAID 1+5
  C. Virtual machines
  D. Full backups
  C. Virtual machines

  ---

  Explanation Explanation/Reference:Redundancy doesn't make any sense for this question, while it is a resiliency technique it doesn't specify what they are making redundant. Virtual machines could be easily backed up using a snapshot so that covers full backups and could provide testing for OS patch compatibility with their EOL software. Full backups will require them to dedicate a system to actually conduct live tests on and is generally less cost efficient compared to VMs. Maybe if the question was clear we wouldn't have to assume what the question is asking. FYI you cannot ask questions during the test probably because the people proctoring doesn't know anything (pearson vue) and Comptia wouldn't answer questions regarding their questions because they only want to make money.

• Question 800:

  A security researcher is tracking an adversary by noting its attacks and techniques based on its capabilities, infrastructure, and victims. Which of the following is the researcher MOST likely using?

  A. The Diamond Mode! of Intrusion Analysis
  B. The Cyber Kill Chain e
  C. The MITRE CVE database
  D. The incident response process
  A. The Diamond Mode! of Intrusion Analysis

  ---

  Explanation Explanation/Reference:https://cyware.com/educational-guides/incident-response/what-is-the-diamond-model-of-intrusion-analysis-5f02