SY0-601 practice questions 11–20

1. Question 11 · 856 in bank

   Due to unexpected circumstances, an IT company must vacate its main office, forcing all operations to alternate, off-site locations. Which of the following will the company MOST likely reference for guidance during this change?

   • AThe business continuity plan
   • BThe retention policy
   • CThe disaster recovery plan
   • DThe incident response plan

   Show answer

   Answer: A

   Explanation

   BCP is to empower an organization to keep crucial functions running during downtime. This, in turn, helps the organization respond quickly to an interruption, while creating resilient operational protocols.

   Source: Adapted from community discussion — stoneface

   Next question

2. Question 12 · 856 in bank

   While reviewing an alert that shows a malicious request on one web application, a cybersecurity analyst is alerted to a subsequent token reuse moments later on a different service using the same single sign-on method. Which of the following would BEST detect a malicious actor?

   • AUtilizing SIEM correlation engines
   • BDeploying Netflow at the network border
   • CDisabling session tokens for all sites
   • DDeploying a WAF for the web server

   Show answer

   Answer: A

   Explanation

   I think that SIEM correlation would be the best way to detect an attacker in this case. The initial compromise was a malicious request on a web server. Moments later the token created with SSO was used on another service, the question does not specify what type of service. Deploying a WAF on the web server will detect the attacker but only on that server. If the attacker issues the same malicious request to get another SSO token correlating that event with using that SSO token in other services would allows to detect the malicious activity. Correct me if I am wrong

   Source: Adapted from community discussion — stoneface

   Next question

3. Question 13 · 856 in bank

   Which of the following is an effective tool to stop or prevent the exfiltration of data from a network?

   • ADLP
   • BNIDS
   • CTPM
   • DFDE

   Show answer

   Answer: A

   Explanation

   DLP is a comprehensive security solution designed to identify, monitor, and protect sensitive data from unauthorized access, use, or exfiltration. It helps organizations prevent data breaches and leakage by monitoring data movement both within the network and when data is being transferred to external destinations, such as the internet. 1. Content inspection: DLP solutions inspect data in real-time and at rest to identify sensitive information, such as Personally Identifiable Information (PII), financial data, intellectual property, or other confidential information. 2. Policy-based controls: Organizations can define policies that specify how sensitive data should be handled and protected. DLP tools enforce these policies by taking appropriate actions when data matches predefined criteria, such as blocking, encrypting, or quarantining the data. 3. Network monitoring: DLP solutions monitor network traffic and endpoints to detect suspicious activities and potential data exfiltration attempts. 4. Data encryption: DLP tools can include encryption capabilities, which add an extra layer of protection to sensitive data, making it unreadable to unauthorized parties even if it is somehow intercepted.

   Source: Adapted from community discussion — Protract8593

   Next question

4. Question 14 · 856 in bank

   Two organizations plan to collaborate on the evaluation of new SIEM solutions for their respective companies. A combined effort from both organizations' SOC teams would speed up the effort. Which of the following can be written to document this agreement?

   • AMOU
   • BISA
   • CSLA
   • DNDA

   Show answer

   Answer: A

   Explanation

   MOU - Memorandum of Understanding MOA - Memorandum of Agreement A MOU is the initialization phase for two companies who plan to work together. It establishes what each company is looking to achieve/get out of the arrangement. It's not a signed contract. A MOA is a step above the MOU. It's a signed contract that indicates both parties understand and agree with the terms placed forward by both parties.

   Source: Adapted from community discussion — Gravoc

   References

   • nist.gov documentation

   Next question

5. Question 15 · 856 in bank

   The Chief Information Security Officer wants to prevent exfiltration of sensitive information from employee cell phones when using public USB power charging stations. Which of the following would be the BEST solution to implement?

   • ADLP
   • BUSB data blocker
   • CUSB OTG
   • DDisabling USB ports

   Show answer

   Answer: B

   Explanation

   The CompTia Sec+ Study Guide book literally talks about USB data blockers when using public charging stations. Y'all overthink way too much sometimes.

   Source: Adapted from community discussion — Blake89

   Next question

6. Question 16 · 856 in bank

   The board of directors at a company contracted with an insurance firm to limit the organization's liability. Which of the following risk management practices does this BEST describe?

   • ATransference
   • BAvoidance
   • CMitigation
   • DAcknowledgement

   Show answer

   Answer: A

   Explanation

   Transference is a risk management practice in which an organization shifts the financial burden of potential risks or losses to another party. In this scenario, by contracting with an insurance firm, the company is transferring the liability of certain risks to the insurance company. If an incident occurs that is covered by the insurance policy, the insurance company would bear the financial responsibility, thereby limiting the organization's liability.

   Source: Adapted from community discussion — Protract8593

   Next question

7. Question 17 · 856 in bank

   Which of the following is a risk that is specifically associated with hosting applications in the public cloud?

   • AUnsecured root accounts
   • BZero-day
   • CShared tenancy
   • DInsider threat

   Show answer

   Answer: C

   Explanation

   Shared Tenancy Vulnerabilities. In a multi-tenant environment, such as the cloud, a “container” vulnerability can allow an attacker to compromise containers of other tenants on the same host. Flaws in chip design can also result in the compromise of tenant information in the cloud through side-channel attacks.

   Source: Adapted from community discussion — IGUESS

   Next question

8. Question 18 · 856 in bank

   DDoS attacks are causing an overload on the cluster of cloud servers. A security architect is researching alternatives to make the cloud environment respond to load fluctuation in a cost-effective way. Which of the following options BEST fulfills the architect's requirements?

   • AAn orchestration solution that can adjust scalability of cloud assets
   • BUse of multipath by adding more connections to cloud storage
   • CCloud assets replicated on geographically distributed regions
   • DAn on-site backup that is displayed and only used when the load increases

   Show answer

   Answer: A

   Explanation

   A. An orchestration solution that can adjust scalability of cloud assets -> this is the correct answer IMO - this is what elasticity in cloud is all about, we are only creating new resources when there is a workload spike. B. Use of multipath by adding more connections to cloud storage -> this doest address the issue of dealing with the additional load on the servers C. Cloud assets replicated on geographically distributed regions -> hot or warm recovery sites ( not cost effective ) D. An on-site backup that is displayed and only used when the load increases ( not cost effective since the on-site will be always on behind the scenes)

   Source: Adapted from community discussion — stoneface

   Next question

9. Question 19 · 856 in bank

   Which of the following documents provides expectations at a technical level for quality, availability, and responsibilities?

   • AEOL
   • BSLA
   • CMOU
   • DEOSL

   Show answer

   Answer: B

   Explanation

   A document that provides expectations at a technical level for quality, availability, and responsibilities is a Service Level Agreement (SLA). An SLA is a contract between a service provider and a customer that specifies the level of service that the provider will deliver. This typically includes technical details such as uptime, response times, and performance criteria. The SLA is used to ensure that the customer receives the level of service that they have agreed to and that the provider is held accountable for meeting those expectations. Options A, C, and D are not related to the technical level of service expectations. EOL refers to the end of life for a product or service, MOU is a memorandum of understanding, and EOSL is the end of service life.

   Source: Adapted from community discussion — FMMIR

   Next question

10. Question 20 · 856 in bank

    Which of the following is an example of transference of risk?

    • APurchasing insurance
    • BPatching vulnerable servers
    • CRetiring outdated applications
    • DApplication owner risk sign-off

    Show answer

    Answer: A

    Explanation

    Answer: Purchasing Insurance Cyber insurance covers a business' liability for a data breach involving sensitive customer information like health records, credit card numbers, account numbers etc. A few things insurance generally handle are legal fees, notifying customers of the data breach, and repairing damaged systems. Risk transference is about assigning risk to a third-party. The risk here being the financial loss that can be incurred after a data breach from legal fees, repairing system etc. The organization is assigning this risk to an insurance company.

    Source: Adapted from community discussion — rodwave

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 11. 856 questions available.