Sample Questions of SY0-601 Dumps With 100% Exam Passing Guarantee
Pass Key features of SY0-601 Course with Updated 1061 Questions
NEW QUESTION # 518
A company was recently breached Part of the company's new cybersecurity strategy is to centralize the logs from all security devices.
Which of the following components forwards the logs to a central source?
- A. Log collector
- B. Log aggregation
- C. Log parser
- D. Log enrichment
Answer: A
Explanation:
Log collectors are pieces of software that function by gathering data from multiple independent sources and feed it into a unified source such as a SIEM. Log collectors will collect the logs and then the SIEM solution will store the logs.
NEW QUESTION # 519
A security analyst Is investigating a malware incident at a company. The malware is accessing a command-and-control website at www.comptia.com. All outbound Intemet traffic is logged to a syslog server and stored in / logfiles/messages. Which of the following commands would be BEST for the analyst to use on the syslog server to search for recent traffic to the command-and-control website?
- A. grep -500 /logfiles/messages | cat www.comptia.com
- B. cat /logfiles/messages | tail -500 wew.comptia.com
- C. head -500 www.comptia.com | grep /logfiles/messages
- D. tail -500 /legfiles/messages | grep www.comptia.com
Answer: B
NEW QUESTION # 520
A security engineer needs to implement an MDM solution that complies with the corporate mobile device policy. The policy states that in order for mobile users to access corporate resources on their devices the following requirements must be met:
* Mobile device OSs must be patched up to the latest release
* A screen lock must be enabled (passcode or biometric)
* Corporate data must be removed if the device is reported lost or stolen
Which of the following controls should the security engineer configure? (Select TWO)
- A. Geofencing
- B. Remote wipe
- C. Posturing
- D. Containerization
- E. Full-device encryption
- F. Storage segmentation
Answer: B,E
NEW QUESTION # 521
A systems administrator reports degraded performance on a virtual server. The administrator increases the virtual memory allocation which improves conditions, but performance degrades again after a few days. The administrator runs an anarysis tool and sees the following output:
The administrator terminates the timeAttend.exe observes system performance over the next few days, and notices that the system performance does not degrade Which of the following issues is MOST likely occurring?
- A. API attack
- B. Memory leak
- C. Buffer oveiflow
- D. DLL injection
Answer: A
NEW QUESTION # 522
The primary goal of the threat-hunting team at a large company is to identify cyberthreats that the SOC has not detected. Which of the following types of data would the threat-hunting team primarily use to identify systems that are exploitable?
- A. Vulnerability scan
- B. User behavior
- C. Threat feed
- D. Packet capture
Answer: A
Explanation:
A vulnerability scan is a type of data that can identify systems that are exploitable by detecting known weaknesses and misconfigurations in the software and hardware. Packet capture, threat feed, and user behavior are types of data that can help identify malicious activities or indicators of compromise, but not necessarily the systems that are vulnerable to exploitation.
NEW QUESTION # 523
Historically. a company has had issues with users plugging in personally owned removable media devices into corporate computers. As a result, the threat of malware incidents is almost constant.
Which of the following would BEST help prevent the malware from being installed on the computers?
- A. AUP
- B. NGFW
- C. EDR
- D. DLP
Answer: B
NEW QUESTION # 524
The Chief Information Security Officer wants to prevent exfiltration of sensitive information from employee cell phones when using public USB power charging stations. Which of the following would be the BEST solution to implement?
- A. Disabling USB ports
- B. USB OTG
- C. USB data blocker
- D. DLP
Answer: C
Explanation:
Malicious USB charging cables and plugs are also a widespread problem. As with card skimming, a device may be placed over a public charging port at airports and other transit locations. A USB data blocker can provide mitigation against these juice- jacking attacks by preventing any sort of data transfer when the smartphone or laptop is connected to a charge point.
NEW QUESTION # 525
A security administrator wants to implement a program that tests a user's ability to recognize attacks over the organization's email system Which of the following would be BEST suited for this task?
- A. Phishing campaign
- B. Annual information security training
- C. Social media analysis
- D. Gamification
Answer: D
NEW QUESTION # 526
Which of the following in the incident response process is the BEST approach to improve the speed of the identification phase?
- A. Redirect all events to multiple syslog servers.
- B. Increase the number of sensors present on the environment.
- C. Tune monitoring in order to reduce false positive rates.
- D. Activate verbose logging in all critical assets.
Answer: D
NEW QUESTION # 527
A security administrator is reviewing reports about suspicious network activity occurring on a subnet Users on the network report that connectivity to various websites is intermittent. The administrator logs in to a workstation and reviews the following command output:
Which of the following best describes what is occurring on the network?
- A. IP address conflicts
- B. ARP poisoning
- C. On-path attack
- D. URL redirection
Answer: B
NEW QUESTION # 528
An employee finds a USB flash drive labeled "Salary Info" in an office parking lot. The employee picks up the USB flash drive, goes into the office, and plugs it into a laptop. Later, a technician inspects the laptop and realizes it has been compromised by malware. Which of the following types of social engineering attacks has occurred?
- A. Smishing
- B. Baiting
- C. Tailgating
- D. Pretexting
Answer: B
Explanation:
USB Baiting: Leaving infected USB drives in a location where the target is likely to find them, hoping that the person will plug the USB drive into their computer out of curiosity.
NEW QUESTION # 529
A security analyst is investigating an incident to determine what an attacker was able to do on a compromised laptop. The analyst reviews the following SIEM log:
Which of the following describes the method that was used to compromise the laptop?
- A. An attacker was able to phish user credentials successfully from an Outlook user profile
- B. An attacker was able to bypass application whitelisting by emailing a spreadsheet attachment with an embedded PowerShell in the file
- C. An attacker was able to move laterally from PC1 to PC2 using a pass-the-hash attack
- D. An attacker was able to install malware to the CAasdf234 folder and use it to gam administrator nights and launch Outlook
Answer: C
NEW QUESTION # 530
Which of the following typically uses a combination of human and artificial intelligence to analyze event data and take action without intervention?
- A. SOAR
- B. SIEM
- C. OSINT
- D. TTP
Answer: A
Explanation:
What is SOAR? SOAR collects data and alerts security teams using a centralized platform similar to SIEM, but SIEM only sends alerts to security analysts. SOAR security, on the other hand, takes it a step further by automating the responses. It uses artificial intelligence (AI) to learn pattern behaviors, which enable it to predict similar threats before they happen. This makes it easier for IT security staff to detect and address threats.
NEW QUESTION # 531
A customer has reported that an organization's website displayed an image of a smiley (ace rather than the expected web page for a short time two days earlier. A security analyst reviews log tries and sees the following around the lime of the incident:
Which of the following is MOST likely occurring?
- A. Invalid trust chain
- B. Domain hijacking
- C. DNS poisoning
- D. URL redirection
Answer: C
Explanation:
Explanation
The log entry shows the IP address for "www.example.com" being changed to a different IP address, which is likely the result of DNS poisoning. DNS poisoning occurs when an attacker is able to change the IP address associated with a domain name in a DNS server's cache, causing clients to connect to the attacker's server instead of the legitimate server. References: CompTIA Security+ SY0-601 Exam Objectives: 3.2 Given a scenario, implement secure network architecture concepts.
NEW QUESTION # 532
A hosting provider needs to prove that its security controls have been in place over the last six months and have sufficiently protected customer data. Which of the following would provide the best proof that the hosting provider has met the requirements?
- A. SOC 2 Type 2 report
- B. Vulnerability report
- C. CIS Top 20 compliance reports
- D. NIST CSF
Answer: A
NEW QUESTION # 533
Field workers in an organization are issued mobile phones on a daily basis All the work is performed within one city and the mobile phones are not used for any purpose other than work The organization does not want these pnones used for personal purposes. The organization would like to issue the phones to workers as permanent devices so the pnones do not need to be reissued every day Qven the conditions described, which of the following technologies would BEST meet these requirements'
- A. Geofencing
- B. Remote wiping
- C. Mobile device management
- D. Containenzation
Answer: C
NEW QUESTION # 534
The application development team is in the final stages of developing a new healthcare application. The team has requested copies of current PHI records to perform the final testing.
Which of the following would be the best way to safeguard this information without impeding the testing process?
- A. Implementing a content filter
- B. Anonymizing the data
- C. Deploying DLP tools
- D. Installing a FIM on the application server
Answer: B
Explanation:
Explanation
Anonymizing the data is the process of removing personally identifiable information (PII) from data sets, so that the people whom the data describe remain anonymous . Anonymizing the data can safeguard the PHI records without impeding the testing process, because it can protect the privacy of the patients while preserving the data integrity and statistical accuracy for the application development team12. Anonymizing the data can be done by using techniques such as data masking, pseudonymization, generalization, data swapping, or data perturbation12.
Implementing a content filter is not the best way to safeguard the information, because it is a technique that blocks or allows access to certain types of content based on predefined rules or policies3. A content filter does not remove or encrypt PII from data sets, and it may not prevent unauthorized access or leakage of PHI records.
Deploying DLP tools is not the best way to safeguard the information, because it is a technique that monitors and prevents data exfiltration or transfer to unauthorized destinations or users. DLP tools do not remove or encrypt PII from data sets, and they may not be sufficient to protect PHI records from internal misuse or negligence.
Installing a FIM on the application server is not the best way to safeguard the information, because it is a technique that detects and alerts changes to files or directories on a system. FIM does not remove or encrypt PII from data sets, and it may not prevent unauthorized access or modification of PHI records.
NEW QUESTION # 535
A healthcare company is revamping its IT strategy in light of recent regulations. The company is concerned about compliance and wants to use a pay-per-use model.
Which of the following is the BEST solution?
- A. Public SaaS
- B. On-premises hosting
- C. Community cloud
- D. Hosted infrastructure
Answer: A
Explanation:
"Pay per use" in this regard is like your electric Bill where you pay for how much of their services you use.
You have to pay for Software as a Service and it must be public as well.
https://1c-dn.com/1c_enterprise/public/
NEW QUESTION # 536
A security administrator performs weekly vulnerability scans on all cloud assets and provides a detailed report.
Which of the following describes the administrator's activities?
- A. Continuous integration
- B. Continuous monitoring
- C. Continuous deployment
- D. Continuous validation
Answer: D
Explanation:
Explanation
Continuous validation is a process that involves performing regular and automated tests to verify the security and functionality of a system or an application. Continuous validation can help identify and remediate vulnerabilities, bugs, or misconfigurations before they cause any damage or disruption. The security administrator's activities of performing weekly vulnerability scans on all cloud assets and providing a detailed report are examples of continuous validation.
NEW QUESTION # 537
Security engineers are working on digital certificate management with the top priority of making administration easier. Which of the following certificates is the best option?
- A. Wildcard
- B. User
- C. Self-signed
- D. Root
Answer: A
Explanation:
A wildcard certificate is a type of digital certificate that can be used to secure multiple subdomains under a single domain name. For example, a wildcard certificate for *.example.com can be used to secure www.example.com, mail.example.com, blog.example.com, etc. A wildcard certificate can make administration easier by reducing the number of certificates that need to be issued, managed, and renewed. It can also save costs and simplify configuration.
NEW QUESTION # 538
......
SY0-601 Sample Practice Exam Questions 2024 Updated Verified: https://pass4sure.practicetorrent.com/SY0-601-practice-exam-torrent.html