Free CompTIA SY0-601 Exam 2024 Practice Materials Collection [Q186-Q209]

SY0-601 CompTIA

admin -

January 2, 2024

4/5 - (2 votes)

Free CompTIA SY0-601 Exam 2024 Practice Materials Collection

SY0-601 Exam Info and Free Practice Test All-in-One Exam Guide Jan-2024

The SY0-601 exam covers six domains: attacks, threats, and vulnerabilities; architecture and design; implementation; operations and incident response; governance, risk, and compliance; and cryptography and PKI. SY0-601 exam consists of 90 questions, and candidates have 90 minutes to complete it. SY0-601 exam is available in multiple languages, including English, Japanese, Portuguese, and Spanish. Upon passing the exam, candidates will receive a certification that demonstrates their expertise in IT security and validates their ability to protect data and systems from potential cyber threats.

Q186. During a recent penetration test, a tester plugged a laptop into an Ethernet port in an unoccupied conference room and obtained a valid IP address. Which of the following would have best prevented this avenue of attack?

Enabling MAC address filtering

Moving printers inside a firewall

Implementing 802.IX

Using network port security

Explanation
Implementing 802.1X would have best prevented this avenue of attack. 802.1X is a standard that provides port-based network access control (PNAC), which means that it authenticates devices before allowing them to access network resources through a physical or wireless port. 802.1X can prevent unauthorized devices from obtaining valid IP addresses or accessing sensitive data by requiring them to provide credentials, such as a username and password, a certificate, or a token. 802.1X can also dynamically assign VLANs or firewall rules based on the device identity or role.

Q187. Which of the following control types is focused primarily on reducing risk before an incident occurs?

Preventive

Deterrent

Corrective

Detective

Q188. A user reports trouble using a corporate laptop. The laptop freezes and responds slowly when writing documents and the mouse pointer occasional disappears.
The task list shows the following results

Which of the following is MOST likely the issue?

RAT

PUP

Spyware

Keylogger

Q189. A user contacts the help desk to report the following:
* Two days ago, a pop-up browser window prompted the user for a name and password after connecting to the corporate wireless SSID. This had never happened before, but the user entered the information as requested.
* The user was able to access the Internet but had trouble accessing the department share until the next day.
* The user is now getting notifications from the bank about unauthorized transactions.
Which of the following attack vectors was MOST likely used in this scenario?

Rogue access point

Evil twin

DNS poisoning

ARP poisoning

Q190. A company would like to move to the cloud. The company wants to prioritize control and security over cost and ease of management. Which of the following cloud models would best suit this company’s priorities?

Public

Hybrid

Community

Private

Explanation
A private cloud model would best suit the company’s priorities of control and security over cost and ease of management. In a private cloud, the infrastructure is dedicated to a single organization, providing greater control over the environment and the ability to implement strict security measures. This is in contrast to public, community, or hybrid cloud models, where resources are shared among multiple organizations, potentially compromising control and security. While private clouds can be more expensive and more difficult to manage, they the highest level of control and security for the company.
Reference:
– CompTIA Security+ Certification Exam Objectives (SY0-601), Section 3.2: “Explain the importance of secure staging deployment concepts.”
– Cisco: Private Cloud – https://www.cisco.com/c/en/us/solutions/cloud/private-cloud.html

Q191. Which of the following roles is responsible for defining the protection type and Classification type for a given set of files?

General counsel

Data owner

Risk manager

Chief Information Officer

Data owner is the role that is responsible for defining the protection type and classification type for a given set of files. Data owner is a person in the organization who is accountable for a certain set of data and determines how it should be protected and classified. General counsel is the role that provides legal advice and guidance to the organization. Risk manager is the role that identifies, analyzes, and mitigates risks to the organization. Chief Information Officer is the role that oversees the information technology strategy and operations of the organization
https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/data-roles-and-responsibilities/

Q192. A security analyst is reviewing the following attack log output:

Which of the following types of attacks does this MOST likely represent?

Rainbow table

Brute-force

Password-spraying

Dictionary

Q193. A security manager needs to assess the security posture of one of the organization’s vendors. The contract with the vendor does not allow for auditing of the vendor’s security controls. Which of (he following should the manager request to complete the assessment?

A service-level agreement

A business partnership agreement

A SOC 2 Type 2 report

A memorandum of understanding

Q194. Which of the following is a difference between a DRP and a BCP?

A BCP keeps operations running during a disaster while a DRP does not.

A BCP prepares for any operational interruption while a DRP prepares for natural disasters.

BCP is a technical response to disasters while a DRP is operational.

A BCP is formally written and approved while a DRP is not.

Q195. Which of the following controls would provide the BEST protection against tailgating?

Access control vestibule

Closed-circuit television

Proximity card reader

Faraday cage

Access control vestibules, also known as mantraps or airlocks, are physical security features that require individuals to pass through two or more doors to enter a secure area. They are effective at preventing tailgating, as only one person can pass through each door at a time.
Reference:
https://www.comptia.org/content/guides/what-is-a-mantrap
CompTIA Security+ Study Guide, Sixth Edition (SY0-601), page 222

Q196. A systems administrators considering diferent backup solitons forthe IT rkashuchre The company 5 looky fre sokton tha ofes the fastest recovery ime whie aso saving the most amount of storage used to maintain the backups Which of the following recovery solubons would be the BEST option to meet these requirements?

Snapshot

Differentiated

Full

Tape

Q197. A systems administrator is looking for a solution that will help prevent OAuth applications from being leveraged by hackers to tick users into authonzing the use of their corporate credentials. Which of the following BEST describes this solution?

CASB

UEM

WAF

VPC

Q198. A security analyst is reviewing the following output from a system:

Which of the following is MOST likely being observed?

ARP palsoning

Man in the middle

Denial of service

DNS poisoning

Q199. A smart retail business has a local store and a newly established and growing online storefront. A recent storm caused a power outage to the business and the local ISP, resulting in several hours of lost sales and delayed order processing. The business owner now needs to ensure two things:
* Protection from power outages
* Always-available connectivity In case of an outage
The owner has decided to implement battery backups for the computer equipment Which of the following would BEST fulfill the owner’s second need?

Lease a point-to-point circuit to provide dedicated access.

Connect the business router to its own dedicated UPS.

Purchase services from a cloud provider for high availability
D Replace the business’s wired network with a wireless network.

Q200. A company is required to continue using legacy software to support a critical service. Which of the following BEST explains a risk of this practice?

Default system configuration

Unsecure protocols

Lack of vendor support

Weak encryption

Q201. Which of the following must be in place before implementing a BCP?

SLA

AUP

NDA

BIA

Q202. After a recent security breach, a security analyst reports that several administrative usernames and passwords are being sent via cleartext across the network to access network devices over port 23. Which of the following should be implemented so all credentials sent over the network are encrypted when remotely accessing and configuring network devices?

SSH

SNMPv3

SFTP

Telnet

FTP

Q203. Against the recommendation of the IT security analyst, a company set all user passwords on a server as
“P@)55wOrD”. Upon review of the /etc/pesswa file,
an attacker found the following:

hich of the following BEST explains why the encrypted passwords do not match?

Perfect forward secrecy

Key stretching

Salting

Hashing

Q204. An engineer needs to deploy a security measure to identify and prevent data tampering within the enterprise.
Which of the following will accomplish this goal?

Antivirus

IPS

FTP

FIM

Data tampering prevention can include simple security measures such as the encryption of data, and can include lengths such as using file integrity monitoring (FIM) systems for better security.
https://www.cypressdatadefense.com/blog/data-tampering-prevention/

Q205. Which of the following would be BEST for a technician to review to determine the total risk an organization can bear when assessing a “cloud-first” adoption strategy?

Risk matrix

Risk tolerance

Risk register

Risk appetite

Explanation
To determine the total risk an organization can bear, a technician should review the organization’s risk tolerance, which is the amount of risk the organization is willing to accept. This information will help determine the organization’s “cloud-first” adoption strategy. References: CompTIA Security+ Certification Exam Objectives (SY0-601)

Q206. A security analyst is performing a forensic investigation compromised account credentials. Using the Event Viewer, the analyst able to detect the following message, ”Special privileges assigned to new login.” Several of these messages did not have a valid logon associated with the user before these privileges were assigned. Which of the following attacks is MOST likely being detected?

Pass-the-hash

Buffer overflow

Cross-site scripting

Session replay

https://www.beyondtrust.com/resources/glossary/pass-the-hash-pth-attack

Q207. A security analyst is performing a packet capture on a series of SOAP HTTP requests for a security assessment. The analyst redirects the output to a file After the capture is complete, the analyst needs to review the first transactions quickly and then search the entire series of requests for a particular string Which of the following would be BEST to use to accomplish the task? (Select TWO).

head

Tcpdump

grep

rail

curl

openssi

Q208. Multiple beaconing activities to a malicious domain have been observed. The malicious domain is hosting malware from various endpoints on the network. Which of the following technologies would be best to correlate the activities between the different endpoints?

Firewall

SIEM

IPS

Protocol analyzer

Explanation
SIEM stands for Security Information and Event Management, which is a technology that collects, analyzes, and correlates data from multiple sources, such as firewall logs, IDS/IPS alerts, network devices, applications, and endpoints. SIEM provides real-time monitoring and alerting of security events, as well as historical analysis and reporting for compliance and forensic purposes.
A SIEM technology would be best to correlate the activities between the different endpoints that are beaconing to a malicious domain. A SIEM can detect the malicious domain by comparing it with threat intelligence feeds or known indicators of compromise (IOCs). A SIEM can also identify the endpoints that are communicating with the malicious domain by analyzing the firewall logs and other network traffic data. A SIEM can alert the security team of the potential compromise and provide them with relevant information for investigation and remediation.

Q209. Hackers recently attacked a company’s network and obtained several unfavorable pictures from the Chief Executive Officer’s workstation. The hackers are threatening to send the images to the press if a ransom is not paid. Which of the following is impacted the MOST?

Identify theft

Data loss

Data exfiltration

Reputation

The best option that describes what is impacted the most by the hackers’ attack and threat would be D. Reputation. Reputation is the perception or opinion that others have about a person or an organization. Reputation can affect the trust, credibility, and success of a person or an organization. In this scenario, if the hackers send the unfavorable pictures to the press, it can damage the reputation of the Chief Executive Officer and the company, and cause negative consequences such as loss of customers, partners, investors, or employees.

Loading …

The CompTIA SY0-601 exam consists of 90 multiple-choice and performance-based questions, and candidates have 90 minutes to complete it. SY0-601 exam is computer-based and is administered at Pearson VUE testing centers worldwide. The passing score for the exam is 750 out of 900, and the cost of the exam is $370.

Pass CompTIA SY0-601 Actual Free Exam Q&As Updated Dump: https://www.dumpstests.com/SY0-601-latest-test-dumps.html