SY0-601 practice questions 201–210

1. Question 201 · 856 in bank

   During a security incident investigation, an analyst consults the company’s SIEM and sees an event concerning high traffic to a known, malicious command-and-control server. The analyst would like to determine the number of company workstations that may be impacted by this issue. Which of the following can provide this information?

   • AWAF logs
   • BDNS logs
   • CSystem logs
   • DApplication logs

   Show answer

   Answer: B

   Explanation

   Answer: DNS DNS logs can contain a record for every query and response. It can show the IP addresses and domain names that your system should/shouldn't be communicating with, it can reveal malware calling out to its command-and-control server, or data transfers to non-company locations. This is one of the reasons why DNS logs are some of the most valuable logs to import into a SIEM system.

   Source: Adapted from community discussion — rodwave

   Next question

2. Question 202 · 856 in bank

   A company has a flat network that is deployed in the cloud. Security policy states that all production and development servers must be segmented. Which of the following should be used to design the network to meet the security requirements?

   • ACASB
   • BVPC
   • CPerimeter network
   • DWAF

   Show answer

   Answer: B

   Explanation

   A Virtual Private Cloud (VPC) is a logical network environment provided by a cloud service provider that allows users to create and control their own isolated network within the cloud infrastructure. It provides the ability to segment and isolate different components of the network, such as production and development servers, based on security requirements. By using a VPC, the company can create separate subnets within the cloud environment and define access controls between them. This allows for the segmentation of production and development servers, ensuring that they are logically separated and isolated from each other.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 203 · 856 in bank

   A new plug-and-play storage device was installed on a PC in the corporate environment. Which of the following safeguards will BEST help to protect the PC from malicious files on the storage device?

   • AChange the default settings on the PC.
   • BDefine the PC firewall rules to limit access.
   • CEncrypt the disk on the storage device.
   • DPlug the storage device in to the UPS.

   Show answer

   Answer: A

   Explanation

   A Change default settings refers to disabling autorun. What is encryption going to prevent in this scenario? Case in point, enable BitLocker or FileVault on your OS drive and then plug a USB flash drive into the computer. Can the USB drive communicate with the encrypted OS drive? Yes. Can they see each other's files? Yes. So what does this prevent? Nothing. Encryption would be great if someone were to remove the drive from your computer and try to read the data off of it. But when you're actively using the computer, the drive is UNLOCKED.

   Source: Adapted from community discussion — JakeBusey

   Next question

4. Question 204 · 856 in bank

   A company is adopting a BYOD policy and is looking for a comprehensive solution to protect company information on user devices. Which of the following solutions would BEST support the policy?

   • AMobile device management
   • BFull-device encryption
   • CRemote wipe
   • DBiometrics

   Show answer

   Answer: A

   Explanation

   Mobile device management (MDM) would be the best solution to support a BYOD (Bring Your Own Device) policy and protect company information on user devices. MDM allows the company to manage and secure the devices that employees bring into the corporate environment. It provides capabilities such as enforcing security policies, configuring device settings, managing applications, and remotely monitoring and managing devices.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 205 · 856 in bank

   A company wants to modify its current backup strategy to minimize the number of backups that would need to be restored in case of data loss. Which of the following would be the BEST backup strategy to implement?

   • AIncremental backups followed by differential backups
   • BFull backups followed by incremental backups
   • CDelta backups followed by differential backups
   • DIncremental backups followed by delta backups
   • EFull backups followed by differential backups

   Show answer

   Answer: E

   Explanation

   The correct answer here is to use differential backup. When using this type of back up, there are two alternatives: 1 - Something bricks on the day of the full backup, you need only that full backup to restore your system. 2 - Something bricks after the day when a full backup is conducted. In that case you only need two things, the full backup and the most recent differential backup. With incremental you need your full backup followed by every single backup made since then till the point of failiure.

   Source: Adapted from community discussion — Ranaer

   Next question

6. Question 206 · 856 in bank

   The compliance team requires an annual recertification of privileged and non-privileged user access. However, multiple users who left the company six months ago still have access. Which of the following would have prevented this compliance violation?

   • AAccount audits
   • BAUP
   • CPassword reuse
   • DSSO

   Show answer

   Answer: A

   Explanation

   A. Account audits would have prevented this compliance violation by periodically reviewing the access permissions of users and removing those who are no longer with the company. An annual account audit would have identified the users who left the company six months ago and their access could have been revoked to ensure compliance with the recertification requirement. The account audit would have verified the accuracy of the access control lists and ensured that all access privileges are in line with current business requirements.

   Source: Adapted from community discussion — ronniehaang

   Next question

7. Question 207 · 856 in bank

   A company recently experienced a data breach and the source was determined to be an executive who was charging a phone in a public area. Which of the following would MOST likely have prevented this breach?

   • AA firewall
   • BA device pin
   • CA USB data blocker
   • DBiometrics

   Show answer

   Answer: C

   Explanation

   A USB data blocker allows you to plug into Wi-Fi hotspots and USB charging ports safely. These solutions eliminate the risk of infecting your phone, laptop, or tablet with malware, and also prevent hackers from install and running malicious code on your system. Its DEF C!

   Source: Adapted from community discussion — okay123

   Next question

8. Question 208 · 856 in bank

   The manager who is responsible for a data set has asked a security engineer to apply encryption to the data on a hard disk. The security engineer is an example of a __________.

   • Adata controller.
   • Bdata owner.
   • Cdata custodian.
   • Ddata processor.

   Show answer

   Answer: C

   Explanation

   As Comptia Guide mention. Data custodian—this role handles managing the system on which the data assets are stored. This includes responsibility for enforcing access control, encryption, and backup/recovery measures

   Source: Adapted from community discussion — asum

   Next question

9. Question 209 · 856 in bank

   An organization with a low tolerance for user inconvenience wants to protect laptop hard drives against loss or data theft. Which of the following would be the MOST acceptable?

   • ASED
   • BHSM
   • CDLP
   • DTPM

   Show answer

   Answer: A

   Explanation

   A. SED (self-encrypting drive) would be the most acceptable option for an organization with a low tolerance for user inconvenience that wants to protect laptop hard drives against loss or data theft. SEDs are hardware-based encryption devices that automatically encrypt data on a hard drive without requiring any additional input or configuration from the user. This means that the user does not have to perform any additional steps to encrypt their data, which can help to prevent data loss or theft. By contrast, other options like HSM (hardware security module), DLP (data loss prevention), and TPM (trusted platform module) may require more user involvement and may not be as convenient for users.

   Source: Adapted from community discussion — FMMIR

   Next question

10. Question 210 · 856 in bank

    A technician was dispatched to complete repairs on a server in a data center. While locating the server, the technician entered a restricted area without authorization. Which of the following security controls would BEST prevent this in the future?

    • AUse appropriate signage to mark all areas.
    • BUtilize cameras monitored by guards.
    • CImplement access control vestibules.
    • DEnforce escorts to monitor all visitors.

    Show answer

    Answer: C

    Explanation

    How would the guard know every individual and their access rights? The access control vestibule (AKA Mantrap) seems to be more appropriate to me.

    Source: Adapted from community discussion — Mamun1

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 201. 856 questions available.