SY0-601 practice questions 1–10

1. Question 1 · 856 in bank

   A user is attempting to navigate to a website from inside the company network using a desktop. When the user types in the URL, https://www.site.com, the user is presented with a certificate mismatch warning from the browser. The user does not receive a warning when visiting http://www.anothersite.com. Which of the following describes this attack?

   • AOn-path
   • BDomain hijacking
   • CDNS poisoning
   • DEvil twin

   Show answer

   Answer: C

   Explanation

   C. DNS poisoning. The certificate mismatch warning suggests that the website is using a different SSL/TLS certificate than what the browser was expecting. This could happen if an attacker has tampered with the DNS resolution process, so the user is directed to a different server than the legitimate site. This type of attack is known as DNS poisoning, where an attacker corrupts or manipulates the DNS cache of a network to redirect users to malicious websites. On-path attacks involve intercepting and altering network traffic between the user and the website, while domain hijacking refers to the unauthorized transfer of a domain name from its rightful owner to another party. Evil twin attacks involve setting up a rogue wireless access point to impersonate a legitimate one in order to steal login credentials or other sensitive information. None of these scenarios fit the description given in the question.

   Source: Adapted from community discussion — princajen

   Next question

2. Question 2 · 856 in bank

   A company wants to simplify the certificate management process. The company has a single domain with several dozen subdomains, all of which are publicly accessible on the internet. Which of the following BEST describes the type of certificate the company should implement?

   • ASubject alternative name
   • BWildcard
   • CSelf-signed
   • DDomain validation

   Show answer

   Answer: B

   Explanation

   The company should implement: B. Wildcard certificate. A Wildcard certificate is the best option for the company with a single domain and several dozen subdomains. It simplifies the certificate management process by securing not only the main domain but also all its subdomains with a single certificate. Here's how a Wildcard certificate works: 1. It is issued for a specific domain, such as ".example.com," where the asterisk () is a wildcard character that covers all subdomains of "example.com." 2. With a single Wildcard certificate, the company can secure any number of subdomains (e.g., mail.example.com, shop.example.com, blog.example.com, etc.) without needing separate certificates for each subdomain. 3. Wildcard certificates are especially beneficial when there are numerous subdomains to manage, as it significantly reduces the administrative overhead and simplifies the renewal and deployment processes. Therefore, a Wildcard certificate is the most appropriate choice for the company with a single domain and several dozen subdomains, providing a streamlined and efficient certificate management process.

   Source: Adapted from community discussion — Protract8593

   Next question

3. Question 3 · 856 in bank

   Which of the following components can be used to consolidate and forward inbound internet traffic to multiple cloud environments though a single firewall?

   • ATransit gateway
   • BCloud hot site
   • CEdge computing
   • DDNS sinkhole

   Show answer

   Answer: A

   Explanation

   VPC peering relationships can quickly become difficult to manage, especially if each VPC must interconnect in a mesh-like structure. A transit gateway is a simpler means of managing these interconnections. Essentially, a transit gateway is a virtual router that handles routing between the subnets in each attached VPC and any attached VPN gateways (aws.amazon.com/transit-gateway).

   Source: Adapted from community discussion — stoneface

   Next question

4. Question 4 · 856 in bank

   A DBA reports that several production server hard drives were wiped over the weekend. The DBA also reports that several Linux servers were unavailable due to system files being deleted unexpectedly. A security analyst verified that software was configured to delete data deliberately from those servers. No backdoors to any servers were found. Which of the following attacks was MOST likely used to cause the data loss?

   • ALogic bomb
   • BRansomware
   • CFileless virus
   • DRemote access Trojans
   • ERootkit

   Show answer

   Answer: A

   Explanation

   A logic bomb is a type of malicious code or software that is intentionally inserted into a system and designed to execute a specific malicious action when certain conditions are met. In this scenario, the logic bomb was deliberately configured to delete data from the production server hard drives and Linux servers unexpectedly. It is important to note that logic bombs can be triggered by various conditions such as a specific date, time, or event, and they are intended to cause harm or damage to the targeted system or data.

   Source: Adapted from community discussion — Protract8593

   Next question

5. Question 5 · 856 in bank

   Digital signatures use asymmetric encryption. This means the message is encrypted with:

   • Athe sender's private key and decrypted with the sender's public key.
   • Bthe sender's public key and decrypted with the sender's private key.
   • Cthe sender's private key and decrypted with the recipient's public key.
   • Dthe sender's public key and decrypted with the recipient's private key.

   Show answer

   Answer: A

   Explanation

   In order to verify the authenticity of a digital signature we need to encrypt the initial message with the sender's private key. The receiver then can verify the authenticity by decrypting the message with the sender's public key. https://docs.huihoo.com/globus/gt4-tutorial/ch09s03.html

   Source: Adapted from community discussion — stoneface

   Next question

6. Question 6 · 856 in bank

   A security engineer was assigned to implement a solution to prevent attackers from gaining access by pretending to be authorized users. Which of the following technologies meets the requirement?

   • ASSO
   • BIDS
   • CMFA
   • DTPM

   Show answer

   Answer: C

   Explanation

   MFA adds an extra layer of security by requiring users to provide multiple forms of identification or verification before accessing a system or application. It typically combines something the user knows (such as a password), something the user has (such as a physical token or mobile device), or something the user is (such as biometric data) to authenticate their identity. By implementing MFA, even if an attacker manages to obtain or guess a user's password, they would still need the additional factor (such as a physical token or biometric data) to successfully authenticate as the authorized user.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 7 · 856 in bank

   The Chief Information Security Officer (CISO) has requested that a third-party vendor provide supporting documents that show proper controls are in place to protect customer data. Which of the following would be BEST for the third-party vendor to provide to the CISO?

   • AGDPR compliance attestation
   • BCloud Security Alliance materials
   • CSOC 2 Type 2 report
   • DNIST RMF workbooks

   Show answer

   Answer: C

   Explanation

   Do not overthink. The question is simply on auditing.. note the words in the question. "...has requested that a third-party vendor provide supporting documents." Hence the correct answer is indeed SOC 2. See below directly from Professer messer notes: If your organization has undergone an audit, then you’re probably familiar with the SSAE SOC 2 types I and II. This is from the American Institute of Certified Public Accountants, or the AICPA. It’s an auditing standard called the Statement on Standards for Attestation Engagements number 18, or SSAE 18. During these audits, there’s a series of reports that are created, and the name for the suite of reports that are associated with trust services criteria, or security controls, is the SOC 2, that’s the System and Organization Controls number two. This audit focuses on topics that can include firewalls, intrusion prevention, or intrusion detection, or multi-factor authentication.

   Source: Adapted from community discussion — Nirmalabhi

   Next question

8. Question 8 · 856 in bank

   Which of the following is assured when a user signs an email using a private key?

   • ANon-repudiation
   • BConfidentiality
   • CAvailability
   • DAuthentication

   Show answer

   Answer: A

   Explanation

   When a user signs an email using a private key, it provides assurance of non-repudiation. Non-repudiation is the property that ensures the sender of a message cannot deny sending it. By signing the email with their private key, the sender creates a digital signature that can only be decrypted and verified with their corresponding public key. This process ensures that the sender's identity is authenticated and cannot be denied later, providing non-repudiation.

   Source: Adapted from community discussion — Protract8593

   Next question

9. Question 9 · 856 in bank

   A systems administrator is troubleshooting a server's connection to an internal web server. The administrator needs to determine the correct ports to use. Which of the following tools BEST shows which ports on the web server are in a listening state?

   • Aipconfig
   • Bssh
   • Cping
   • Dnetstat

   Show answer

   Answer: D

   Explanation

   Answer is D A. ipconfig - Just shows you the IP information for your current machine B. ssh - this is used for file transfers (ftp etc etc) C. ping - this is just to reach out to a node to get a response from it These are simple ways of explaining. Don't come behind me and getting real granular super duper tech people -_-

   Source: Adapted from community discussion — Gino_Slim

   Next question

10. Question 10 · 856 in bank

    Which of the following BEST reduces the security risks introduced when running systems that have expired vendor support and lack an immediate replacement?

    • AImplement proper network access restrictions.
    • BInitiate a bug bounty program.
    • CClassify the system as shadow IT.
    • DIncrease the frequency of vulnerability scans.

    Show answer

    Answer: A

    Explanation

    We are asked to REDUCE risk. A. Implement proper network access restrictions. - This more or less reduces risk by limiting who has access to the legacy system. B. Initiate a bug bounty program. - We dont need that, since its a legacy system, which we havent developed. We most likely cannot patch this anyway. C. Classify the system as shadow IT. - Irrelevant to the question. D. Increase the frequency of vulnerability scans. - As in B, us knowing that issues exist, wont help us much, since we cannot patch the system.

    Source: Adapted from community discussion — Ranaer

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 1. 856 questions available.