Free SY0-601 Exam Dumps Preview

A security engineer needs to implement an MDM solution that complies with the corporate mobile device policy. The policy states that in order for mobile users to access corporate resources on their devices, the following requirements must be met:

1. Mobile device OSs must be patched up to the latest release.
2. A screen lock must be enabled (passcode or biometric).
3. Corporate data must be removed if the device is reported lost or stolen.

Which of the following controls should the security engineer configure? (Choose two.)

A security analyst is evaluating the risks of authorizing multiple security solutions to collect data from the company's cloud environment.

Which of the following is an immediate consequence of these integrations?

A commercial cyber-threat intelligence organization observes IoCs across a variety of unrelated customers.

Prior to releasing specific threat intelligence to other paid subscribers, the organization is MOST likely obligated by contracts to:

Which of the following policies establishes rules to measure third-party work tasks and ensure deliverables are provided within a specific time line?

The Chief Information Security Officer is concerned about employees using personal email rather than company email to communicate with clients and sending sensitive business information and PII.

Which of the following would be the BEST solution to install on the employees' workstations to prevent information from leaving the company's network?

Which of the following would be the BEST way to analyze diskless malware that has infected a VDI?

A company was compromised, and a security analyst discovered the attacker was able to get access to a service account. The following logs were discovered during the investigation:

Which of the following MOST likely would have prevented the attacker from learning the service account name?

A user enters a username and a password at the login screen for a web portal. A few seconds later the following message appears on the screen: Please use a combination of numbers, special characters, and letters in the password field.

Which of the following concepts does this message describe?

Which of the following best describes the process of adding a secret value to extend the length of stored passwords?

Which of the following would BEST provide a systems administrator with the ability to more efficiently identify systems and manage permissions and policies based on location, role, and service level?

A public relations team will be taking a group of guest on a tour through the facility of a large e-commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboars are cleaned and all desks are cleared. The company is MOST likely trying to protect against.

An organization recently recovered from a data breach. During the root cause analysis, the organization determined the source of the breach to be a personal cell phone that had been reported lost.

Which of the following solutions should the organization implement to reduce the likelihood of future data breaches?

A technician was dispatched to complete repairs on a server in a data center. While locating the server, the technician entered a restricted area without authorization.

Which of the following security controls would BEST prevent this in the future?

An engineer wants to access sensitive data from a corporate-owned mobile device. Personal data is not allowed on the device.

Which of the following MDM configurations must be considered when the engineer travels for business?

A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL.

Which of the following is needed to meet the objective?

A security researcher has aferted an organization that is sensitive user data was found for sale on a website.

Which of the following should the organization use to inform the affected partes?

A security analyst is reviewing application logs to determine the source of a breach and locates the following log:

Which Of the following has been observed?

Server administrators want to configure a cloud solution so that computing memory and processor usage is maximized most efficiently across a number or virtual servers. They also need to avoid potential dental-of-service situations caused by availability.

Which of the following should administrators configure to maximize system availability while efficiently utilizing available computing power?

A security analyst has been tasked with ensuring all programs that are deployed into the enterprise have been assessed in a runtime environment. Any critical issues found in the program must be sent back to the developer for verification and remediation.

Which of the following BEST describes the type of assessment taking place?

Which of the following BEST describes the team that acts as a referee during a penetration-testing exercise?

A company is launching a new internet platform for its clients. The company does not want to implement its own authorization solution but instead wants to rely on the authorization provided by another platform.

Which of the following is the BEST approach to implement the desired solution?

DRAG DROP

An attack has occurred against a company.

INSTRUCTIONS
You have been tasked to do the following: Identify the type of attack that is occurring on the network by clicking on the attacker's tablet and reviewing the output. (Answer Area 1)
Identify which compensating controls should be implemented on the assets, in order to reduce the effectiveness of future attacks by dragging them to the correct server. (Answer area 2) All objects will be used, but not all placeholders may be filled. Objects may only be used once. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

A security analyst is reviewing computer logs because a host was compromised by malware After the computer was infected it displayed an error screen and shut down.

Which of the following should the analyst review first to determine more information?

A major political party experienced a server breach. The hacker then publicly posted stolen internal communications concerning campaign strategies to give the opposition party an advantage.

Which of the following BEST describes these threat actors?

Which of the following conditions impacts data sovereignty?

An organization relies on third-party video conferencing to conduct daily business. Recent security changes now require all remote workers to utilize a VPN to corporate resources.

Which of the following would BEST maintain high-quality video conferencing while minimizing latency when connected to the VPN?

A user downloaded software from an online forum. After the user installed the software, the security team observed external network traffic connecting to the user's computer on an uncommon port.

Which of the following is the most likely explanation of this unauthorized connection?

A network administrator is concerned about users being exposed to malicious content when accessing company cloud applications. The administrator wants to be able to block access to sites based on the AUP. The users must also be protected because many of them work from home or at remote locations, providing on-site customer support.

Which of the following should the administrator employ to meet these criteria?

A tax organization is working on a solution to validate the online submission of documents.
The solution should be earned on a portable USB device that should be inserted on any computer that is transmitting a transaction securely.

Which of the following is the BEST certificate for these requirements?

A company has discovered unauthorized devices are using its WiFi network, and it wants to harden the access point to improve security.

Which of the following configurations should an analyst enable to improve security? (Choose two.)

A company wants to enable BYOD for checking email and reviewing documents. Many of the documents contain sensitive organizational information.

Which of the following should be deployed first before allowing the use of personal devices to access company data?

A security analyst receives an alert from trie company's SIEM that anomalous activity is coming from a local source IP address of 192.168.34.26. The Chief Information Security Officer asks the analyst to block the originating source Several days later, another employee opens an internal ticket stating that vulnerability scans are no longer being performed properly. The IP address the employee provides is 192 168.3426.

Which of the following describes this type of alert?

A company must ensure sensitive data at rest is rendered unreadable.

Which of the following will the company most likely use?

An audit report showed that a former employee saved the following files to an external USB drive before the employee's termination date:

? annual_tax_form.pdf
? encrypted_passwords.db
? team_picture.jpg
? contact_list.db
? human_resources.txt

Which of the following could the former employee do to potentially compromise corporate credentials?

A security analyst has been tasked with finding the maximum amount of data loss that can occur before ongoing business operations would be impacted.

Which of the following terms BEST defines this metric?

A network engineer and a security engineer are discussing ways to monitor network operations.

Which of the following is the BEST method?

The SOC for a large MSSP is meeting to discuss the lessons learned from a recent incident that took much too long to resolve This type of incident has become more common in recent weeks and is consuming large amounts of the analysts' time due to manual tasks being performed.

Which of the following solutions should the SOC consider to BEST improve its response time?

An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has been given all the developer's documentation about the internal architecture.

Which of the following best represents the type of testing that will occur?

An end user reports a computer has been acting slower than normal for a few weeks, During an investigation, an analyst determines the system 3 sending the users email address and a ten-digit number ta an IP address once a day. The only resent log entry regarding the user's computer is the following:

Which of the following is the MOST likely cause of the issue?

A security engineer is working to address the growing risks that shadow IT services are introducing to the organization. The organization has taken a cloud-first approach and does not have an on-premises IT infrastructure.

Which of the following would best secure the organization?

An organization has expanded its operations by opening a remote office. The new office is fully furnished with office resources to support up to 50 employees working on any given day.

Which of the following VPN solutions would BEST support the new office?

An organization has been experiencing outages during holiday sales and needs to ensure availability of its point-of-sale systems

The IT administrator has been asked to improve both server-data fault tolerance and site availability under high consumer load

Which of the following are the BEST options to accomplish this objective? (Select TWO)

A security researcher is using an adversary's infrastructure and TTPs and creating a named group to track those targeted.

Which of the following is the researcher MOST likely using?

An organization recently released a zero-trust policy that will enforce who is able to remotely access certain data. Authenticated users who access the data must have a need to know, depending on their level of permissions.

Which of the following is the first step the organization should take when implementing the policy?

A network manager is concerned that business may be negatively impacted if the firewall in its datacenter goes offline. The manager would like to implement a high availability pair to:

A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization's existing keys and to maintain consistent, centralized control and management regardless of the data location.

Which of the following would best meet the architect's objectives?

A security analyst needs to propose a remediation plan for each item in a risk register. The item with the highest priority requires employees to have separate logins for SaaS solutions and different password complexity requirements for each solution.

Which of the following implementation plans will most likely resolve this security issue?

A Chief Information Officer is concerned about employees using company-issued laptops lo steal data when accessing network shares.

Which of the following should the company Implement?

Which of the following prevents an employee from seeing a colleague who is visting an inappropriate website?

A customer service representative reported an unusual text message that was sent to the help desk. The message contained an unrecognized invoice number with a large balance due and a link to click for more details.

Which of the following BEST describes this technique?

Which of the following is an example of transference of risk?

The Chief information Security Officer has directed the security and networking team to retire the use of shared passwords on routers and switches.

Which of the following choices BEST meets the requirements?

A company has a flat network in the cloud. The company needs to implement a solution to segment its production and non-production servers without migrating servers to a new network.

Which of the following solutions should the company implement?

A multinational organization that offers web-based services has datacenters that are located only in the United States; however, a large number of its customers are in Australia, Europe, and China. Payments for services are managed by a third party in the United Kingdom that specializes in payment gateways. The management team is concerned the organization is not compliant with privacy laws that cover some of its customers.

Which of the following frameworks should the management team follow?

Which of the following terms should be included in a contract to help a company monitor the ongoing security maturity of a new vendor?

Which of the following environment utilizes dummy data and is MOST to be installed locally on a system that allows to be assessed directly and modified easily wit each build?

A security engineer obtained the following output from a threat intelligence source that recently performed an attack on the company's server:

Which of the following BEST describes this kind of attack?

A financial organization has adopted a new secure, encrypted document-sharing application to help with its customer loan process. Some important PII needs to be shared across this new platform, but it is getting blocked by the DLP systems.

Which of the following actions will BEST allow the PII to be shared with the secure application without compromising the organization's security posture?

A Chief Security Officer (CSO) was notified that a customer was able to access confidential internal company files on a commonly used file-sharing service. The file-sharing service is the same one used by company staff as one of its approved third-party applications. After further investigation, the security team determines the sharing of confidential files was accidental and not malicious. However, the CSO wants to implement changes to minimize this type of incident from reoccurring but does not want to impact existing business processes.

Which of the following would BEST meet the CSO's objectives?

A small company that does not have security staff wants to improve its security posture.

Which of the following would BEST assist the company?

A user forwarded a suspicious email to the security team, Upon investigation, a malicious URL was discovered.

Which of the following should be done FIRST to prevent other users from accessing the malicious URL?

The Chief Information Secunty Officer came across a news arbcle outining a mechan'sm thal allows certan OS passwords to be bypassed

The security team was then tasked with determining which method could be used to prevent data loss in the corporate environment in case an attacker bypasses authentication

Which of the following will accomplish this objective?

Which of the following control types is focused primarily on reducing risk before an incident occurs?

Audit logs indicate an administrative account that belongs to a security engineer has been locked out multiple times during the day. The security engineer has been on vacation (or a few days).

Which of the following attacks can the account lockout be attributed to?

A security analyst is performing a packet capture on a series of SOAP HTTP requests for a security assessment.
The analyst redirects the output to a file After the capture is complete, the analyst needs to review the first transactions quickly and then search the entire series of requests for a particular string Which of the following would be BEST to use to accomplish the task?
(Select TWO).

A security operations technician is searching the log named /vax/messages for any events that were associated with a workstation with the IP address 10.1.1.1.

Which of the following would provide this information?

Which of the following is most likely associated with introducing vulnerabilities on a corporate network by the deployment of unapproved software?

A security analyst is reviewing information regarding recent vulnerabilities.

Which of the following will the analyst MOST likely consult to validate which platforms have been affected?

A systems administrator needs to install the same X.509 certificate on multiple servers.

Which of the following should the administrator use?

A large enterprise has moved all its data to the cloud behind strong authentication and encryption. A sales director recently had a laptop stolen, and later, enterprise data was found to have been compromised from a local database.

Which of the following was the MOST likely cause?

A company labeled some documents with the public sensitivity classification.
This means the documents can be accessed by:

An organization has developed an application that needs a patch to fix a critical vulnerability In which of the following environments should the patch be deployed LAST?

A company's bank has reported that multiple corporate credit cards have been stolen over the past several weeks. The bank has provided the names of the affected cardholders to the company's forensics team to assist in the cyber-incident investigation.

An incident responder learns the following information:

The timeline of stolen card numbers corresponds closely with affected users making Internet-based purchases from diverse websites via enterprise desktop PCs.

All purchase connections were encrypted, and the company uses an SSL inspection proxy for the inspection of encrypted traffic of the hardwired network.

Purchases made with corporate cards over the corporate guest WiFi network, where no SSL inspection occurs, were unaffected.

Which of the following is the MOST likely root cause?

An enterprise needs to keep cryptographic keys in a safe manner.

Which of the following network appliances can achieve this goal?

An analyst needs to identify the applications a user was running and the files that were open before the user's computer was shut off by holding down the power button.

Which of the following would MOST likely contain that information?

The Chief Technology Officer of a local college would like visitors to utilize the school's Wi-Fi but must be able to associate potential malicious activity to a specific person.

Which of the following would best allow this objective to be met?

A security administrator would like to ensure all cloud servers will have software preinstalled for facilitating vulnerability scanning and continuous monitoring.

Which of the following concepts should the administrator utilize?

Which of the following is the FIRST environment in which proper, secure coding should be practiced?

Which of the following are the MOST likely vectors for the unauthorized or unintentional inclusion of vulnerable code in a software company's final software releases? (Choose two.)

Which of the following stores data directly on devices with limited processing and storage capacity?

DDoS attacks are causing an overload on the cluster of cloud servers. A security architect is researching alternatives to make the cloud environment respond to load fluctuation in a cost-effective way.

Which of the following options BEST fulfils the architect's requirements?

A recent security breach exploited software vulnerabilities in the firewall and within the network management solution.

Which of the following will MOST likely be used to identify when the breach occurred through each device?

An attacker replaces a digitally signed document with another version that foes unnoticed. Upon reviewing the document's contents, the author notices some additional verbaige that was not originally in the document but can't validate an integrity issue.

Which of the following attacks was used?

A security analyst finds a rogue device during a monthly audit of current endpoint assets that are connected to the network. The corporate network utilizes 802.1 X for access control. To be allowed on the network, a device must have a known hardware address, and a valid username and password must be entered in a captive portal. The following is the audit report:

Which of the following is the most likely way a rogue device was allowed to connect?

An end user reports a computer has been acting slower than normal for a few weeks. During an investigation, an analyst determines the system is sending the user's email address and a ten-digit number to an IP address once a day. The only recent log entry regarding the user's computer is the following:

Which of the following is the MOST likely cause of the issue?

A hospital's administration is concerned about a potential loss of patient data that is stored on tablets. A security administrator needs to implement controls to alert the SOC any time the devices are near exits.

Which of the following would BEST achieve this objective?

A company wants to restrict emailing of PHI documents. The company is implementing a DLP solution.
In order to restrict PHI documents, which of the following should be performed FIRST?

Which of the following is a reason why a forensic specialist would create a plan to preserve data after an incident and prioritize the sequence for performing forensic analysis?

As part of the lessons-learned phase, the SOC is tasked with building methods to detect if a previous incident is happening again.

Which of the following would allow the security analyst to alert the SOC if an event is reoccurring?

The Chief Security Officer (CSO) at a major hospital wants to implement SSO to help improve security in the environment and protect patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that training and guidance have not been provided to frontline staff, and a risk analysis has not been performed.

Which of the following is the MOST likely cause of the CRO's concerns?

Which of the following describes business units that purchase and implement scripting software without approval from an organization's technology Support staff?

A security analyst is working on a project to implement a solution that monitors network communications and provides alerts when abnormal behavior is detected

Which of the following is the security analyst MOST likely implementing?

A company policy requires third-party suppliers to self-report data breaches within a specific time frame.

Which of the following third-party risk management policies is the company complying with?

A company is enhancing the security of the wireless network and needs to ensure only employees with a valid certificate can authenticate to the network.

Which of the following should the company implement?

A security administrator needs to provide secure access to internal networks for external partners.
The administrator has given the PSK and other parameters to the third-party security administrator.

Which of the following is being used to establish this connection?

A company is providing security awareness training regarding the importance of not forwarding social media messages from unverified sources.

Which of the following risks would this training help to prevent?

An organization wants to implement a biometric system with the highest likelihood that an unauthorized user will be denied access.

Which of the following should the organization use to compare biometric solutions?

During a penetration test, a flaw in the internal PKI was exploited to gain domain administrator rights using specially crafted certificates.

Which of the following remediation tasks should be completed as part of the cleanup phase?

Which of the following corporate policies is used to help prevent employee fraud and to detect system log modifications or other malicious activity based on tenure?

A company's help desk has received calls about the wireless network being down and users being unable to connect to it. The network administrator says all access points are up and running. One of the help desk technicians notices the affected users are working in a building near the parking lot.

Which of the following is the most likely reason for the outage?