SY0-601 practice questions 101–110

1. Question 101 · 856 in bank

   A network engineer created two subnets that will be used for production and development servers. Per security policy production and development servers must each have a dedicated network that cannot communicate with one another directly. Which of the following should be deployed so that server administrators can access these devices?

   • AVLANs
   • BInternet proxy servers
   • CNIDS
   • DJump servers

   Show answer

   Answer: D

   Explanation

   A jump server, jump host or jump box is a system on a network used to access and manage devices in a separate security zone. A jump server is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them

   Source: Adapted from community discussion — stoneface

   Next question

2. Question 102 · 856 in bank

   A social media company based in North America is looking to expand into new global markets and needs to maintain compliance with international standards. With which of the following is the company's data protection officer MOST likely concerned?

   • ANIST Framework
   • BISO 27001
   • CGDPR
   • DPCI-DSS

   Show answer

   Answer: C

   Explanation

   C. GDPR (General Data Protection Regulation) is the regulation with which the social media company's data protection officer is MOST likely concerned when expanding into new global markets. GDPR is a regulation in the European Union that governs the protection of personal data of EU citizens. Any company that collects or processes personal data of EU citizens is subject to GDPR compliance, regardless of where the company is located. Therefore, if the social media company is expanding into new global markets, it is important for the company to comply with GDPR to ensure that it protects the personal data of EU citizens. NIST Framework (option A) is a set of guidelines for improving critical infrastructure cybersecurity and is primarily used in the US. ISO 27001 (option B) is an international standard that provides a framework for information security management systems (ISMS) and is relevant to any organization that wishes to manage and protect its information assets. PCI-DSS (option D) is a standard for securing payment card data and is primarily relevant to organizations that handle payment card transactions.

   Source: Adapted from community discussion — Yawannawanka

   Next question

3. Question 103 · 856 in bank

   A security architect is required to deploy to conference rooms some workstations that will allow sensitive data to be displayed on large screens. Due to the nature of the data, it cannot be stored in the conference rooms. The file share is located in a local data center. Which of the following should the security architect recommend to BEST meet the requirement?

   • AFog computing and KVMs
   • BVDI and thin clients
   • CPrivate cloud and DLP
   • DFull drive encryption and thick clients

   Show answer

   Answer: B

   Explanation

   Answer: VDI and thin clients Virtual Desktop Infrastructure (VDI) is a technology that refers to the use of virtual machines to provide and manage virtual desktops. VDI hosts desktop environments on a centralized server and deploys them to end-users on request. VDI can be used to provide the desktop experience. The computing hardware for VDI can be split into thin clients and thick clients: - Thin clients are simple computers that can be accessed through a remote connection to a central server which provides the client all of its resources. Thin clients do not have hard drives so data isn't stored locally, and applications would also need to be accessed through a server. Thin clients would work for this scenario since data can't be stored in the conference rooms and thin clients cant store data anyway. - Thick clients are fully functional networked computers that have their OS, local storage, and handles their own processing. Just think company-provided desktop computers or laptops. They can connect to a server if they want, but can work independently as well. Since files can be stored locally on a thick client, they wouldn't work with the requirements of the scenario.

   Source: Adapted from community discussion — rodwave

   Next question

4. Question 104 · 856 in bank

   A Chief Information Security Officer wants to ensure the organization is validating and checking the integrity of zone transfers. Which of the following solutions should be implemented?

   • ADNSSEC
   • BLDAPS
   • CNGFW
   • DDLP

   Show answer

   Answer: A

   Explanation

   A zone file is a text based file with a format defined in RFC 1035 and 1034 and is stored on a DNS server (name server). Zone files contain the IP and name data, MX records and other service records. They also contain glue data that connects them to the other DNS servers.The default behavior for DNS zone transfer permits any host to request and receive a full zone transfer for a Domain. This is a security issue since DNS data can be used to decipher the topology of a company’s network. The information obtained can be used for malicious exploitation such as DNS poisoning/spoofing. This is like an anonymous person calling the receptionist to request and receive the entire company’s telephone and address book. https://www.giac.org/paper/gsec/2668/securing-dns-zone-transfer/104562

   Source: Adapted from community discussion — okay123

   Next question

5. Question 105 · 856 in bank

   Which of the following controls is used to make an organization initially aware of a data compromise?

   • AProtective
   • BPreventative
   • CCorrective
   • DDetective

   Show answer

   Answer: D

   Explanation

   Answer: Detective Detective control identifies security events that have already occurred. Intrusion detection systems are detective controls. ======================= Preventative Controls - acts to eliminate or reduce the likelihood that an attack can succeed. A preventative control operates before an attack can take place. They are comparing the configurations to a secure guideline to ensure no gaps. Meaning they are pre-emptively hardening their systems against future attack vectors. Corrective Controls - controls that remediate security issues that have already occurred. Restoring backups after a ransomware attack is an example of a corrective control.

   Source: Adapted from community discussion — rodwave

   Next question

6. Question 106 · 856 in bank

   An annual information security assessment has revealed that several OS-level configurations are not in compliance due to outdated hardening standards the company is using. Which of the following would be BEST to use to update and reconfigure the OS-level security configurations?

   • ACIS benchmarks
   • BGDPR guidance
   • CRegional regulations
   • DISO 27001 standards

   Show answer

   Answer: A

   Explanation

   CIS Benchmarking -> CIS Benchmarks from the Center of Internet Security (CIS) are a set of globally recognized and consensus-driven best practices to help security practitioners implement and manage their cybersecurity defenses.

   Source: Adapted from community discussion — stoneface

   Next question

7. Question 107 · 856 in bank

   A company acquired several other small companies. The company that acquired the others is transitioning network services to the cloud. The company wants to make sure that performance and security remain intact. Which of the following BEST meets both requirements?

   • AHigh availability
   • BApplication security
   • CSegmentation
   • DIntegration and auditing

   Show answer

   Answer: D

   Explanation

   I think the answer is C. I copied what is written below out of an article/blog on CompTIA’s website (https://www.comptia.org/blog/security-awareness-training-network-segmentation#) “Following are a few benefits of network segmentation: - Limiting access privileges to those who truly need it - Protecting the network from widespread cyberattacks - Boosting network performance by reducing the number of users in specific zones”

   Source: Adapted from community discussion — GS1011

   References

   • comptia.org documentation

   Next question

8. Question 108 · 856 in bank

   After a recent external audit, the compliance team provided a list of several non-compliant, in-scope hosts that were not encrypting cardholder data at rest. Which of the following compliance frameworks would address the compliance team's GREATEST concern?

   • APCI DSS
   • BGDPR
   • CISO 27001
   • DNIST CSF

   Show answer

   Answer: A

   Explanation

   PCI DSS (Payment Card Industry Data Security Standard) is a specific compliance framework developed by the Payment Card Industry Security Standards Council (PCI SSC). It applies to organizations that handle credit card transactions and sets security requirements for protecting cardholder data. One of the key requirements of PCI DSS is the encryption of cardholder data, both in transit and at rest.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 109 · 856 in bank

   A security analyst is receiving several alerts per user and is trying to determine if various logins are malicious. The security analyst would like to create a baseline of normal operations and reduce noise. Which of the following actions should the security analyst perform?

   • AAdjust the data flow from authentication sources to the SIEM.
   • BDisable email alerting and review the SIEM directly.
   • CAdjust the sensitivity levels of the SIEM correlation engine.
   • DUtilize behavioral analysis to enable the SIEM's learning mode.

   Show answer

   Answer: D

   Explanation

   Answer: Utilize behavioral analysis to enable the SIEM's learning mode. UBA or User Behavior Analytics and is a threat detection analysis technology that uses AI to understand how users normally behave and then find anomalous activities, which deviate from their normal behavior and may be indicative of a threat. For this scenario, the SIEM will first learn what is normal behavior then when a baseline is created, it will know if any of the logins are malicious. Likely determined by when and where the logins are occurring and if it's different from the baseline. This should hopefully reduce the amount of alerts occurring.

   Source: Adapted from community discussion — rodwave

   Next question

10. Question 110 · 856 in bank

    Which of the following tools is effective in preventing a user from accessing unauthorized removable media?

    • AUSB data blocker
    • BFaraday cage
    • CProximity reader
    • DCable lock

    Show answer

    Answer: A

    Explanation

    USB data blocker -> A USB data blocker, also known as a “USB condom” (really, no kidding!), is a device that allows you to plug into USB charging ports including charging kiosks, and USB ports on gadgets owned by other people. The main purpose of using one is to eliminate the risk of infecting your phone or tablet with malware, and even prevent hackers to install/execute any malicious code to access your data.

    Source: Adapted from community discussion — stoneface

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 101. 856 questions available.