SY0-601 practice questions 191–200

1. Question 191 · 856 in bank

   A company’s security team received notice of a critical vulnerability affecting a high-profile device within the web infrastructure. The vendor patch was just made available online but has not yet been regression tested in development environments. In the interim, firewall rules were implemented to reduce the access to the interface affected by the vulnerability. Which of the following controls does this scenario describe?

   • ADeterrent
   • BCompensating
   • CDetective
   • DPreventive

   Show answer

   Answer: B

   Explanation

   Compensating control looks to be correct here. Open to correction however A compensating control, also called an alternative control, is a mechanism that is put in place to satisfy the requirement for a security measure that is deemed too difficult or impractical to implement at the present time.

   Source: Adapted from community discussion — comeragh

   Next question

2. Question 192 · 856 in bank

   A security analyst is reviewing the following command-line output:

   

   Which of the following is the analyst observing?

   • AICMP spoofing
   • BURL redirection
   • CMAC address cloning
   • DDNS poisoning

   Show answer

   Answer: C

   Explanation

   The essential characteristic of ICMP spoofing is the use of fake source IP addresses in ICMP packets. That is not the case here. MAC address cloning involves configuring a network device to use a different MAC address than its original, factory-assigned address. This appears to be the case here

   Source: Adapted from community discussion — TheFivePips

   Next question

3. Question 193 · 856 in bank

   A company was recently breached, Part of the company’s new cybersecurity strategy is to centralize the logs from all security devices. Which of the following components forwards the logs to a central source?

   • ALog enrichment
   • BLog aggregation
   • CLog parser
   • DLog collector

   Show answer

   Answer: D

   Explanation

   Log collectors are pieces of software that function to gather data from multiple independent sources and feed it into a unified source such as a SIEM. Log aggregation is the process of combining logs together. This is done to allow different formats from different systems to work together.

   Source: Adapted from community discussion — Knowledge33

   Next question

4. Question 194 · 856 in bank

   Which of the following is the MOST likely reason for securing an air-gapped laboratory HVAC system?

   • ATo avoid data leakage
   • BTo protect surveillance logs
   • CTo ensure availability
   • DTo facilitate third-party access

   Show answer

   Answer: C

   Explanation

   Is it just me or are most of the questions worded this way: You are driving down the road and a car pulls out in front of you. What do you first notice on the car? A. License plate B. Trunk C. Rear lights D. Rear window

   Source: Adapted from community discussion — Hess5534

   Next question

5. Question 195 · 856 in bank

   A user forwarded a suspicious email to the security team. Upon investigation, a malicious URL was discovered. Which of the following should be done FIRST to prevent other users from accessing the malicious URL?

   • AConfigure the web content filter for the web address.
   • BReport the website to threat intelligence partners.
   • CSet the SIEM to alert for any activity to the web address.
   • DSend out a corporate communication to warn all users of the malicious email.

   Show answer

   Answer: A

   Explanation

   To prevent other users from accessing the malicious URL after it has been discovered, the FIRST action that should be taken is: A. Configure the web content filter for the web address. By configuring the web content filter to block or restrict access to the specific URL, organizations can proactively prevent users from accessing the malicious website. Web content filters can be implemented at various points within the network infrastructure, such as firewalls, proxy servers, or dedicated web filtering solutions. By adding the malicious URL to the blocklist or creating a rule to deny access to the URL, organizations can effectively prevent users from reaching the malicious website and potentially exposing themselves to further risks.

   Source: Adapted from community discussion — Irfaans91

   Next question

6. Question 196 · 856 in bank

   Select 2

   A systems analyst is responsible for generating a new digital forensics chain-of-custody form. Which of the following should the analyst include in this documentation? (Choose two.)

   • AThe order of volatility
   • BA CRC32 checksum
   • CThe provenance of the artifacts
   • DThe vendor’s name
   • EThe date and time
   • FA warning banner

   Show answer

   Answer: CE

   Explanation

   A systems analyst should include the following information in the new digital forensics chain-of-custody form: E. The date and time C. The provenance of the artifacts Explanation: A digital forensics chain-of-custody form is a document that provides a clear and complete record of the sequence of events that occurs from the time a digital artifact is collected until it is analyzed and used as evidence. The form should include the date and time when the artifact was collected, so that the exact time it was obtained can be determined. Additionally, the form should include information about the provenance of the artifact, such as its origin and any steps that have been taken to maintain its integrity. The order of volatility, a CRC32 checksum, the vendor’s name, and a warning banner are not essential components of a digital forensics chain-of-custody form.

   Source: Adapted from community discussion — ronniehaang

   References

   • nist.gov documentation

   Next question

7. Question 197 · 856 in bank

   Select 2

   An organization is migrating several SaaS applications that support SSO. The security manager wants to ensure the migration is completed securely. Which of the following application integration aspects should the organization consider before focusing into underlying implementation details? (Choose two.)

   • AThe back-end directory source
   • BThe identity federation protocol
   • CThe hashing method
   • DThe encryption method
   • EThe registration authority
   • FThe certificate authority

   Show answer

   Answer: AB

   Explanation

   The organization should consider the identity federation protocol and the back-end directory source before focusing into underlying implementation details during migration of several SaaS applications that support SSO. A. Identity Federation Protocol: The identity federation protocol helps in establishing trust between different organizations and systems for secure exchange of identity information between them. This helps to securely integrate multiple applications that support SSO and facilitates secure authentication of the users. B. Back-end Directory Source: A back-end directory source is used to store user identities and credentials and to perform authentication of the users. The organization needs to consider the integration of back-end directory sources of the SaaS applications with its existing infrastructure, to ensure secure and seamless migration of the SaaS applications.

   Source: Adapted from community discussion — ronniehaang

   Next question

8. Question 198 · 856 in bank

   A security analyst has been tasked with finding the maximum amount of data loss that can occur before ongoing business operations would be impacted. Which of the following terms BEST defines this metric?

   • AMTTR
   • BRTO
   • CRPO
   • DMTBF

   Show answer

   Answer: C

   Explanation

   *MTTR - Mean Time To Repair - how much time this takes to recover, on average *RTO - Recovery Time Objective - your goal for amount of time to recover *RPO - Recovery Point Objective - your goal for acceptable amount of data loss *MTBF - Mean Time Between Failures - how much time between failures, on average It's RPO

   Source: Adapted from community discussion — NerdAlert

   Next question

9. Question 199 · 856 in bank

   An engineer recently deployed a group of 100 web servers in a cloud environment. Per the security policy, all web-server ports except 443 should be disabled. Which of the following can be used to accomplish this task?

   • AApplication allow list
   • BSWG
   • CHost-based firewall
   • DVPN

   Show answer

   Answer: C

   Explanation

   Not A or D. Was not sure whether it should be B or C until I read the definition of SWGs in the official guide from CompTIA. "An on-premises SWG is a proxy-based firewall, content filter, and intrusion detection/prevention system that mediates user access to Internet sites and services"

   Source: Adapted from community discussion — YusufMadkour

   References

   • comptia.org documentation

   Next question

10. Question 200 · 856 in bank

    The IT department's on-site developer has been with the team for many years. Each time an application is released, the security team is able to identify multiple vulnerabilities. Which of the following would BEST help the team ensure the application is ready to be released to production?

    • ALimit the use of third-party libraries.
    • BPrevent data exposure queries.
    • CObfuscate the source code.
    • DSubmit the application to QA before releasing it.

    Show answer

    Answer: D

    Explanation

    Quality Assurance (QA) teams typically have a broader responsibility that includes both maintaining quality standards and conducting security checks. While the primary focus of QA is to ensure that the software or application meets quality standards, this encompasses various aspects, including functionality, performance, usability, and security.QA teams often work alongside development teams to perform thorough testing of the software throughout its development lifecycle. This testing includes identifying and addressing security vulnerabilities, as well as other issues that could affect the software's quality and performance.

    Source: Adapted from community discussion — sujon_london

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 191. 856 questions available.