SY0-601 practice questions 111–120

1. Question 111 · 856 in bank

   A security manager has tasked the security operations center with locating all web servers that respond to an unsecure protocol. Which of the following commands could an analyst run to find the requested servers?

   • Anslookup 10.10.10.0
   • Bnmap -p 80 10.10.10.0/24
   • Cpathping 10.10.10.0 -p 80
   • Dne -l -p 80

   Show answer

   Answer: B

   Explanation

   Answer: nmap -p 80 10.10.10.0/24 - Nmap or network mapper is a network discovery and security auditing tool mainly used to find services, hosts, and open ports on a network. In this case, nmap will check for the HTTP port 80. ==================================== Other Choices Nslookup - This command queries DNS servers to obtain DNS records Pathping - This command provides information about network latency and packet loss at hops between a source and destination. Used for troubleshooting network issues. ne - Honestly not 100% here

   Source: Adapted from community discussion — rodwave

   Next question

2. Question 112 · 856 in bank

   Which of the following is the MOST effective way to detect security flaws present on third-party libraries embedded on software before it is released into production?

   • AEmploy different techniques for server- and client-side validations
   • BUse a different version control system for third-party libraries
   • CImplement a vulnerability scan to assess dependencies earlier on SDLC
   • DIncrease the number of penetration tests before software release

   Show answer

   Answer: C

   Explanation

   Using a vulnerability scan to assess dependencies in third-party libraries earlier in the software development life cycle (SDLC) is the most effective way to detect security flaws. Vulnerability scanning tools can automatically analyze software and its dependencies to identify known vulnerabilities and security issues. By performing these scans early in the SDLC, developers can identify and address security flaws in third-party libraries before the software is released into production.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 113 · 856 in bank

   Which of the following prevents an employee from seeing a colleague who is visiting an inappropriate website?

   • AJob rotation policy
   • BNDA
   • CAUP
   • DSeparation of duties policy

   Show answer

   Answer: C

   Explanation

   Answer: AUP I don't understand the question so I'll assume the question is.... "Which of the following prevents an employee from visiting an inappropriate website" .....which would somewhat make more sense. An acceptable use policy (AUP) is a document that outlines the rules and restrictions employees must follow in regard to the company's network, software, internet connection and devices. The employee shouldn't access the inappropriate website as it would go against proper use of the company network. ================ Helpful Info I Guess NDA (Non-disclosure agreement) - a binding contract between two or more parties that prevents sensitive information from being shared with others. Separation of Duty - refers to the principle that no user should be given enough privileges to misuse the system on their own. Job rotation - A concept that has employees rotate through different jobs to learn the procedures and processes in each. From a security perspective, job rotation helps to prevent or expose dangerous shortcuts or even fraudulent activity.

   Source: Adapted from community discussion — rodwave

   Next question

4. Question 114 · 856 in bank

   A user reports falling for a phishing email to an analyst. Which of the following system logs would the analyst check FIRST?

   • ADNS
   • BMessage gateway
   • CNetwork
   • DAuthentication

   Show answer

   Answer: B

   Explanation

   Per ChatGPT The analyst would check the Message Gateway logs first in this scenario. Phishing emails are often sent through email, so the Message Gateway logs, which track incoming and outgoing email messages, would provide the earliest record of the phishing email and any related activity. These logs can show the sender and recipient addresses, the time the email was sent, and potentially the contents of the email itself. Checking other logs such as DNS, Network, or Authentication logs may also be useful in the investigation, but the Message Gateway logs would be the first place to start.

   Source: Adapted from community discussion — Calvin616

   References

   • Microsoft Learn

   Next question

5. Question 115 · 856 in bank

   An attacker has determined the best way to impact operations is to infiltrate third-party software vendors. Which of the following vectors is being exploited?

   • ASocial media
   • BCloud
   • CSupply chain
   • DSocial Engineering

   Show answer

   Answer: C

   Explanation

   Supply chain attacks are an emerging kind of threat that target software developers and suppliers. The goal is to access source codes, build processes, or update mechanisms by infecting legitimate apps to distribute malware. https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjcye66gKv6AhXWjIkEHZ2BDAMQFnoECAUQAw&url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fintelligence%2Fsupply-chain-malware%23%3A~%3Atext%3DSupply%2520chain%2520attacks%2520are%2520an%2Clegitimate%2520apps%2520to%2520distribute%2520malware.&usg=AOvVaw3RhD4fF-pUIEOJD0fGVjn7

   Source: Adapted from community discussion — i_bird

   Next question

6. Question 116 · 856 in bank

   An organization would like to give remote workers the ability to use applications hosted inside the corporate network. Users will be allowed to use their personal computers, or they will be provided organization assets. Either way, no data or applications will be installed locally on any user systems. Which of the following mobile solutions would accomplish these goals?

   • AVDI
   • BMDM
   • CCOPE
   • DUTM

   Show answer

   Answer: A

   Explanation

   MDM would require something to be installed. VDI, virtual desktop infrastructure, would allow employees to use run apps on the company network without installing locally.

   Source: Adapted from community discussion — Joe1984

   Next question

7. Question 117 · 856 in bank

   Which of the following is used to ensure that evidence is admissible in legal proceedings when it is collected and provided to the authorities?

   • AChain of custody
   • BLegal hold
   • CEvent log
   • DArtifacts

   Show answer

   Answer: A

   Explanation

   Answer: Chain of custody A chain of custody is a chronological paper trail documenting when, how, and by whom individual items of physical or electronic evidence—such as cell phone logs—were collected, handled, analyzed, or otherwise controlled during an investigation.

   Source: Adapted from community discussion — rodwave

   Next question

8. Question 118 · 856 in bank

   The Chief Information Security Officer (CISO) of a bank recently updated the incident response policy. The CISO is concerned that members of the incident response team do not understand their roles. The bank wants to test the policy but with the least amount of resources or impact. Which of the following BEST meets the requirements?

   • AWarm site failover
   • BTabletop walk-through
   • CParallel path testing
   • DFull outage simulation

   Show answer

   Answer: B

   Explanation

   A tabletop walk-through is a simulation exercise where the incident response team members gather in a conference room and discuss the actions they would take in response to a hypothetical security incident. The exercise is typically conducted in a low-stress environment and allows the team members to review and discuss the incident response policy, their roles and responsibilities, and the steps they would take during an incident without actually executing the actions. It is a cost-effective way to test and validate the incident response policy and ensure that the team members understand their roles and are prepared to respond effectively to security incidents.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 119 · 856 in bank

   Which of the following control types fixes a previously identified issue and mitigates a risk?

   • ADetective
   • BCorrective
   • CPreventative
   • DFinalized

   Show answer

   Answer: B

   Explanation

   This question can be interpreted as: Preventative = preventing this previous issue from happening again Corrective = correcting this issue that has happened FUCK YOU COMPTIA

   Source: Adapted from community discussion — Renfri

   Next question

10. Question 120 · 856 in bank

    An analyst is reviewing logs associated with an attack. The logs indicate an attacker downloaded a malicious file that was quarantined by the AV solution. The attacker utilized a local non-administrative account to restore the malicious file to a new location. The file was then used by another process to execute a payload. Which of the following attacks did the analyst observe?

    • APrivilege escalation
    • BRequest forgeries
    • CInjection
    • DReplay attack

    Show answer

    Answer: C

    Explanation

    's difficult to say which attack is more likely based on the scenario provided, as both privilege escalation and injection could be possible explanations for the behavior observed in the logs. On one hand, the fact that the attacker was able to restore the quarantined file to a new location using a non-administrative account suggests that they may have exploited a privilege escalation vulnerability. On the other hand, the fact that the attacker was able to bypass the AV solution and execute the payload using the restored file suggests that they may have injected malicious code into the file. Therefore, without additional information or context, it's difficult to determine which attack is more likely. It's possible that both attacks were used in combination to achieve the final outcome observed in the logs.

    Source: Adapted from community discussion — Ahmed_aldouky

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 111. 856 questions available.