CompTIA SY0-601 Online Practice Questions and Exam Preparation

CompTIA SY0-601 Online Questions & Answers

• Question 971:

  A company was recently breached, Part of the company's new cybersecurity strategy is to centralize the logs from all security devices. Which of the following components forwards the logs to a central source?

  A. Log enrichment
  B. Log aggregation
  C. Log parser
  D. Log collector
  D. Log collector

  ---

  Explanation Explanation/Reference:Log collectors are pieces of software that function to gather data from multiple independent sources and feed it into a unified source such as a SIEM. Log aggregation is the process of combining logs together. This is done to allow different formats from different systems to work together.

• Question 972:

  A security analyst generated a file named host1.pcap and shared it with a team member who is going to use it for further incident analysis. Which of the following tools will the other team member MOST likely use to open this file?

  A. Autopsy
  B. Memdump
  C. FTK imager
  D. Wireshark
  D. Wireshark

  ---

  PCAP or Packet Capture is an interface used for capturing live network packet data. PCAP files like 'host1.pcap' are data files created by network analyzers like Wireshark that are used to collect and record packet data from a network. These files which can be used for analyzing the network traffic. ================================== Other Tools/Options (A) Autopsy - A platform that provides digital forensic tools (B) Memdump - The memdump tool is a program that can do memory dumps. A memory dump is the process of taking all data in RAM and storing it on a hard drive for like applications or for the case of a system crash. The memdump tool will dump the contents of physical memory by default. (c) FTk Imager - Forensic Toolkit (FTK) is forensics software and FTK Imager a tool that can be used to create forensic images. Forensic images is basically a copy of an entire physical hard drive including files, folders etc.

• Question 973:

  Which of the following would a European company interested in implementing a technical, hands-on set of security standards MOST likely choose?

  A. GOPR
  B. CIS controls
  C. ISO 27001
  D. Is0 37000
  A. GOPR

• Question 974:

  A cybersecurity incident response team at a large company receives notification that malware is present on several corporate desktops. No known indicators of compromise have been found on the network. Which of the following should the team do first to secure the environment?

  A. Contain the impacted hosts.
  B. Add the malware to the application blocklist.
  C. Segment the core database server.
  D. Implement firewall rules to block outbound beaconing.
  A. Contain the impacted hosts.

  ---

  Contain the impacted hosts: Containment is often the first step in incident response to prevent the malware from spreading further or causing additional damage. By containing the impacted hosts, you're isolating them to prevent potential lateral movement or communication with a command and control server.

• Question 975:

  Which of the following BEST describes the process of documenting who has access to evidence?

  A. Order of volatility
  B. Chain of custody
  C. Non-repudiation
  D. Admissibility
  B. Chain of custody

• Question 976:

  When used at the design stage, which of the following improves the efficiency, accuracy, and speed of a database?

  A. Tokenization
  B. Data masking
  C. Normalization
  D. Obfuscation
  C. Normalization

  ---

  Explanation Explanation/Reference:https://www.informit.com/articles/article.aspx?p=30646

• Question 977:

  An application developer accidentally uploaded a company's code-signing certificate private key to a public web server. The company is concerned about malicious use of its certificate. Which of the following should the company do FIRST?

  A. Delete the private key from the repository.
  B. Verify the public key is not exposed as well.
  C. Update the DLP solution to check for private keys.
  D. Revoke the code-signing certificate.
  D. Revoke the code-signing certificate.

  ---

  We need to revoke the code-signing certificate as this is the most secure way to ensure that the comprised key wont be used by attackers. Usually there are bots crawking all over repos searching this kind of human errors.

• Question 978:

  HOTSPOT

  Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation.

  INSTRUCTIONS

  Not all attacks and remediation actions will be used.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  Hot Area:

  

  

  ---

  Explanation/Reference:

  Web serverBotnet Enable DDoS protectionUser RAT Implement a host-based IPS Database server Worm Change the default application passwordExecutive KeyloggerDisable vulnerable servicesApplication Backdoor Implement 2FA using push notification

• Question 979:

  Which of the following describes where an attacker can purchase DDoS or ransomware services?

  A. Threat intelligence
  B. Open-source intelligence
  C. Vulnerability database
  D. Dark web
  D. Dark web

  ---

  Explanation Explanation/Reference:The best option to describe where an attacker can purchase DDoS or ransomware services is the dark web. The dark web is an anonymous, untraceable part of the internet where a variety of illicit activities take place, including the purchase of DDoS and ransomware services. According to the CompTIA Security+ SY0-601 Official Text Book, attackers can purchase these services anonymously and without the risk of detection or attribution. Additionally, the text book recommends that organizations monitor the dark web to detect any possible threats or malicious activity.

• Question 980:

  A security analyst is reviewing the vulnerability scan report for a web server following an incident. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is available for the vulnerability. Which of the following is the MOST likely cause?

  A. Security patches were uninstalled due to user impact.
  B. An adversary altered the vulnerability scan reports
  C. A zero-day vulnerability was used to exploit the web server
  D. The scan reported a false negative for the vulnerability
  D. The scan reported a false negative for the vulnerability