SY0-601 practice questions 161–170

1. Question 161 · 856 in bank

   A penetration tester is fuzzing an application to identify where the EIP of the stack is located on memory. Which of the following attacks is the penetration tester planning to execute?

   • ARace-condition
   • BPass-the-hash
   • CBuffer overflow
   • DXSS

   Show answer

   Answer: C

   Explanation

   The penetration tester is planning to execute a buffer overflow attack. A buffer overflow attack is a type of security vulnerability that occurs when a program attempts to write data to a memory buffer that is too small to hold it. This can cause the program to crash or, in some cases, allow an attacker to execute arbitrary code. One way to identify where the EIP of the stack is located on memory is to use a technique called fuzzing, which involves sending large amounts of data to an application in order to identify areas where the application is vulnerable to buffer overflow attacks

   Source: Adapted from community discussion — FMMIR

   Next question

2. Question 162 · 856 in bank

   Server administrators want to configure a cloud solution so that computing memory and processor usage is maximized most efficiently across a number of virtual servers. They also need to avoid potential denial-of-service situations caused by availability. Which of the following should administrators configure to maximize system availability while efficiently utilizing available computing power?

   • ADynamic resource allocation
   • BHigh availability
   • CSegmentation
   • DContainer security

   Show answer

   Answer: A

   Explanation

   To maximize system availability and efficiently utilize available computing power, administrators should configure dynamic resource allocation. Dynamic resource allocation is a technique that allows a system to automatically adjust the allocation of resources, such as memory and processing power, to different applications or processes in response to changing workloads or conditions. This can help to ensure that computing resources are used efficiently and that the system is able to respond to changes in demand without encountering performance issues or becoming unavailable.

   Source: Adapted from community discussion — FMMIR

   Next question

3. Question 163 · 856 in bank

   While reviewing the wireless router, a systems administrator of a small business determines someone is spoofing the MAC address of an authorized device. Given the table below:

   

   Which of the following should be the administrator’s NEXT step to detect if there is a rogue system without impacting availability?

   • AConduct a ping sweep,
   • BPhysically check each system.
   • CDeny internet access to the "UNKNOWN" hostname.
   • DApply MAC filtering.

   Show answer

   Answer: B

   Explanation

   While ping sweep would be effective at showing what devices are on the network, we already have that information. We already suspect someone is spoofing a MAC address. What would be the point of getting that information again? It's also a small office, physical inspection wouldnt take long and you could rule out which devices are which

   Source: Adapted from community discussion — TheFivePips

   Next question

4. Question 164 · 856 in bank

   A security analyst in a SOC has been tasked with onboarding a new network into the SIEM. Which of the following BEST describes the information that should feed into a SIEM solution in order to adequately support an investigation?

   • ALogs from each device type and security layer to provide correlation of events
   • BOnly firewall logs since that is where attackers will most likely try to breach the network
   • CEmail and web-browsing logs because user behavior is often the cause of security breaches
   • DNetFlow because it is much more reliable to analyze than syslog and will be exportable from every device

   Show answer

   Answer: A

   Explanation

   SIEM works best only if have "A. Logs from each device type and security layer to provide correlation of events ". Firewall logs are not enough during IR process

   Source: Adapted from community discussion — Kashim

   Next question

5. Question 165 · 856 in bank

   An organization just implemented a new security system. Local laws state that citizens must be notified prior to encountering the detection mechanism to deter malicious activities. Which of the following is being implemented?

   • AProximity cards with guards
   • BFence with electricity
   • CDrones with alarms
   • DMotion sensors with signage

   Show answer

   Answer: D

   Explanation

   The implementation of motion sensors with signage is being done to comply with local laws that require citizens to be notified prior to encountering the detection mechanism. The signage serves as a warning to individuals that they are entering an area protected by motion sensors, which helps deter malicious activities and also ensures that people are aware of the security measures in place. This is a common practice to inform individuals about the presence of security systems in use to maintain transparency and adhere to legal requirements.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 166 · 856 in bank

   An organization is planning to open other data centers to sustain operations in the event of a natural disaster. Which of the following considerations would BEST support the organization's resiliency?

   • AGeographic dispersal
   • BGenerator power
   • CFire suppression
   • DFacility automation

   Show answer

   Answer: A

   Explanation

   Geographic dispersal refers to the practice of establishing data centers or facilities in different geographical locations, often at a considerable distance from one another. By having data centers located in diverse geographic regions, the organization can increase its resiliency and ensure continuity of operations even in the face of natural disasters or regional disruptions.

   Source: Adapted from community discussion — Protract8593

   Next question

7. Question 167 · 856 in bank

   An IT security manager requests a report on company information that is publicly available. The manager's concern is that malicious actors will be able to access the data without engaging in active reconnaissance. Which of the following is the MOST efficient approach to perform the analysis?

   • AProvide a domain parameter to theHarvester tool.
   • BCheck public DNS entries using dnsenum.
   • CPerform a Nessus vulnerability scan targeting a public company’s IP.
   • DExecute nmap using the options: scan all ports and sneaky mode.

   Show answer

   Answer: A

   Explanation

   Do you have anything to add to people's comments besides 2 or 3 word responses saying they're wrong? Add some insight or explanations behind your accusations if you think the answer they suggest is incorrect

   Source: Adapted from community discussion — Samsonite363

   Next question

8. Question 168 · 856 in bank

   Which of the following environments utilizes dummy data and is MOST likely to be installed locally on a system that allows code to be assessed directly and modified easily with each build?

   • AProduction
   • BTest
   • CStaging
   • DDevelopment

   Show answer

   Answer: D

   Explanation

   The correct answer is D. Development. Development environments are typically used for building and testing software applications. They often use dummy or sample data, and are usually installed locally on a system where code can be easily accessed and modified during the development process. This allows developers to test and debug their code without affecting the production environment. Production environments, on the other hand, are the live environments where software applications are deployed and used by end-users. They typically use real data and are not intended for testing or development purposes. Test and staging environments are also used for testing and debugging, but they are typically more similar to production environments in terms of the data and configurations they use. These environments are often used to perform final testing before deploying an application to the production environment.

   Source: Adapted from community discussion — FMMIR

   Next question

9. Question 169 · 856 in bank

   An analyst receives multiple alerts for beaconing activity for a host on the network. After analyzing the activity, the analyst observes the following activity: * A user enters comptia.org into a web browser. * The website that appears is not the comptia.org site. * The website is a malicious site from the attacker. * Users in a different office are not having this issue. Which of the following types of attacks was observed?

   • AOn-path attack
   • BDNS poisoning
   • CLocator (URL) redirection
   • DDomain hijacking

   Show answer

   Answer: B

   Explanation

   This is the reason why the answer is 100% B : A. On Path Attack - sits in the middle of two stations changing data that comes across the path. - This is not the answer. B. DNS Poisining - Hacker reroutes traffic from legitimate site to fake version. This is what happened here. When user when to CompTIA.org, he went to fake version because legitimate DNS address/records/info for that site was changed at his site specifically. - This is the correct answer. C. Locator (URL) redirection - clicks on link and is redirected to malicious website. A URL was not clicked on in this question. A domain was typed in: Comptia.org. And also redirection was not described in this question. This is not the answer. D. Domain Higjacking - Website address is completely stolen by another party. The question clearly states that "users from a different office are not having this problem". If the users were having the problem, then this would mean that that the website was stolen. But because other users at other locations are not having the problem: This is not the answer. B. DNS Poisoning is the Only Correct Answer 100%

   Source: Adapted from community discussion — mike47

   Next question

10. Question 170 · 856 in bank

    Which of the following in the incident response process is the BEST approach to improve the speed of the identification phase?

    • AActivate verbose logging in all critical assets.
    • BTune monitoring in order to reduce false positive rates.
    • CRedirect all events to multiple syslog servers.
    • DIncrease the number of sensors present on the environment.

    Show answer

    Answer: B

    Explanation

    In the incident response process the identification phase is used to recognize whether an event that occurs should be classified as an incident. Therefor false positive tuning would increase the identification time, as A and D would give you more insides, but also more FP and there fore it makes it harder to identify real incidents...I´ll go with "B"

    Source: Adapted from community discussion — Sir_Learnalot

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 161. 856 questions available.