SY0-601 practice questions 211–220

1. Question 211 · 856 in bank

   After segmenting the network, the network manager wants to control the traffic between the segments. Which of the following should the manager use to control the network traffic?

   • AA DMZ
   • BA VPN
   • CA VLAN
   • DAn ACL

   Show answer

   Answer: D

   Explanation

   The network manager should use an Access Control List (ACL) to control the traffic between the segments. An ACL is a network filter that can be used to control the flow of network traffic based on various criteria, such as the source or destination of the traffic, the type of traffic, or the port number. By configuring an ACL, the network manager can specify which types of traffic are allowed to pass between the network segments and which are not. This will help to prevent unauthorized or malicious traffic from passing between the segments and potentially compromising the network. A DMZ, VPN, or VLAN would not be appropriate for controlling the traffic between the segments in this scenario.

   Source: Adapted from community discussion — FMMIR

   Next question

2. Question 212 · 856 in bank

   Which of the following BEST describes when an organization utilizes a ready-to-use application from a cloud provider?

   • AIaaS
   • BSaaS
   • CPaaS
   • DXaaS

   Show answer

   Answer: B

   Explanation

   Exam taken on 10th Dec 2023 This question was on the exam! I selected B My exam had 78 questions, and I scored 782. Pass mark was 750 As much as I hate this dump, it's a real treasure trove for learning/preparations! 90% of the questions from the exam are from here The PBQ's I had were: - configuring the network diagram - configuring the firewall - data classification Good luck to you all and see you on the other side!

   Source: Adapted from community discussion — mycoffeenameisTom

   Next question

3. Question 213 · 856 in bank

   Which of the following BEST helps to demonstrate integrity during a forensic investigation?

   • AEvent logs
   • BEncryption
   • CHashing
   • DSnapshots

   Show answer

   Answer: C

   Explanation

   Hashing is a cryptographic technique that generates a unique fixed-size string of characters (hash value) based on the input data. The hash function takes the original data and produces a hash value that is unique to that specific data. Even a slight change in the input data will result in a significantly different hash value. Hashing is commonly used in forensic investigations to verify the integrity of digital evidence. During a forensic investigation, investigators can calculate the hash value of a file or a set of data using a specific hashing algorithm (such as MD5, SHA-1, SHA-256). The calculated hash value can then be compared with the original hash value to verify if the data has remained unchanged or if any tampering has occurred. By comparing the hash values, investigators can demonstrate the integrity of the evidence by showing that the original data has not been modified since the hash values match. If the hash values differ, it indicates that the data has been altered or tampered with, raising concerns about the integrity of the evidence.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 214 · 856 in bank

   Which of the following would be MOST effective to contain a rapidly spreading attack that is affecting a large number of organizations?

   • AMachine learning
   • BDNS sinkhole
   • CBlocklist
   • DHoneypot

   Show answer

   Answer: B

   Explanation

   The question states that the attack is happening, DNS Sink hole is a disruption technique that can be used to disrupt malware transmission at the very point of connection. Moreover, it can route suspect traffic to a different network, such as a honeynet, where it can be analyzed. See the following link: https://resources.infosecinstitute.com/topic/dns-sinkhole-can-protect-malware/

   Source: Adapted from community discussion — Lv2023

   Next question

5. Question 215 · 856 in bank

   A network administrator has been alerted that web pages are experiencing long load times. After determining it is not a routing or DNS issue, the administrator logs in to the router, runs a command, and receives the following output: CPU 0 percent busy, from 300 sec ago 1 sec ave: 99 percent busy 5 sec ave: 97 percent busy 1 min ave: 83 percent busy Which of the following is the router experiencing?

   • ADDoS attack
   • BMemory leak
   • CBuffer overflow
   • DResource exhaustion

   Show answer

   Answer: D

   Explanation

   The router is experiencing a resource exhaustion issue. The output from the command indicates that the CPU is consistently busy, with a 1-second average of 99 percent busy and a 1-minute average of 83 percent busy. This indicates that the router is struggling to keep up with the demands placed on it, potentially due to a high volume of traffic or other factors. As a result, web pages are experiencing long load times. This is an example of resource exhaustion, where the router's resources are being overwhelmed and are unable to meet the demands placed on them. A DDoS attack, memory leak, or buffer overflow would not typically cause the symptoms described in the scenario.

   Source: Adapted from community discussion — FMMIR

   Next question

6. Question 216 · 856 in bank

   Select 2

   The Chief Executive Officer (CEO) of an organization would like staff members to have the flexibility to work from home anytime during business hours, including during a pandemic or crisis. However, the CEO is concerned that some staff members may take advantage of the flexibility and work from high-risk countries while on holiday or outsource work to a third-party organization in another country. The Chief Information Officer (CIO) believes the company can implement some basic controls to mitigate the majority of the risk. Which of the following would be BEST to mitigate the CEO's concerns? (Choose two.)

   • AGeolocation
   • BTime-of-day restrictions
   • CCertificates
   • DTokens
   • EGeotagging
   • FRole-based access controls

   Show answer

   Answer: AB

   Explanation

   A. Geolocation: Implementing geolocation controls can help restrict access based on the physical location of the users. By defining approved locations or blocking high-risk countries, the organization can ensure that remote work is limited to authorized regions. B. Time-of-day restrictions: Enforcing time-of-day restrictions can limit remote access to specific business hours or predefined timeframes. This control ensures that employees cannot work from any location outside of designated working hours.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 217 · 856 in bank

   While checking logs, a security engineer notices a number of end users suddenly downloading files with the .tar.gz extension. Closer examination of the files reveals they are PE32 files. The end users state they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an external email containing an infected MHT file with an href link a week prior. Which of the following is MOST likely occurring?

   • AA RAT was installed and is transferring additional exploit tools.
   • BThe workstations are beaconing to a command-and-control server.
   • CA logic bomb was executed and is responsible for the data transfers.
   • DA fileless virus is spreading in the local network environment

   Show answer

   Answer: A

   Explanation

   A. A RAT was installed and is transferring additional exploit tools. “Remote Access Trojan A remote access Trojan (RAT) is a type of malware that allows attackers to control systems from remote locations. It is often delivered via drive-by downloads or malicious attachments in email. Once installed on a system, attackers can then access the infected computer at any time and install additional malware if desired. A growing trend is for attackers to deliver trojans as Portable Executable (PE) files in 32-bit (PE32) and 64-bit (PE64) formats. They often compress the PE files using compression tools, such as tar (sometimes called tarball). Tar files have the .tar.gz file extension.” Excerpt From CompTIA Security+ Get Certified Get Ahead: SY0-601 Study Guide Darril Gibson https://itunes.apple.com/WebObjects/MZStore.woa/wa/viewBook?id=0 This material may be protected by copyright.

   Source: Adapted from community discussion — SophyQueenCR82

   Next question

8. Question 218 · 856 in bank

   A business is looking for a cloud service provider that offers a la carte services, including cloud backups, VM elasticity, and secure networking. Which of the following cloud service provider types should the business engage?

   • AIaaS
   • BPaaS
   • CXaaS
   • DSaaS

   Show answer

   Answer: C

   Explanation

   Didn't know french is one of the requirements for the exam. No problem, I'll just use my translator... oh right, I can't have one on the exam. Screw you comptia.

   Source: Adapted from community discussion — Afel_Null

   Next question

9. Question 219 · 856 in bank

   A research company discovered that an unauthorized piece of software has been detected on a small number of machines in its lab. The researchers collaborate with other machines using port 445 and on the Internet using port 443. The unauthorized software is starting to be seen on additional machines outside of the lab and is making outbound communications using HTTPS and SMB. The security team has been instructed to resolve the problem as quickly as possible while causing minimal disruption to the researchers. Which of the following contains the BEST course of action in this scenario?

   • AUpdate the host firewalls to block outbound SMB.
   • BPlace the machines with the unapproved software in containment.
   • CPlace the unauthorized application in a blocklist.
   • DImplement a content filter to block the unauthorized software communication.

   Show answer

   Answer: C

   Explanation

   I'm guessing C. A isn't correct since we're asked not to disrupt researchers who are using SMB. B would again disrupt and D doesn't really make sense.

   Source: Adapted from community discussion — HL2020

   Next question

10. Question 220 · 856 in bank

    A security analyst has been reading about a newly discovered cyberattack from a known threat actor. Which of the following would BEST support the analyst's review of the tactics, techniques, and protocols the threat actor was observed using in previous campaigns?

    • ASecurity research publications
    • BThe MITRE ATT&CK framework
    • CThe Diamond Model of Intrusion Analysis
    • DThe Cyber Kill Chain

    Show answer

    Answer: B

    Explanation

    The MITRE ATT&CK Framework was created by MITRE in 2013 to document attacker tactics and techniques based on real-world observations. This index continues to evolve with the threat landscape and has become a renowned knowledge base for the industry to understand attacker models, methodologies, and mitigation.

    Source: Adapted from community discussion — FMMIR

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 211. 856 questions available.