SY0-601 practice questions 221–230

1. Question 221 · 856 in bank

   A Chief Security Officer is looking for a solution that can provide increased scalability and flexibility for back-end infrastructure, allowing it to be updated and modified without disruption to services. The security architect would like the solution selected to reduce the back-end server resources and has highlighted that session persistence is not important for the applications running on the back-end servers. Which of the following would BEST meet the requirements?

   • AReverse proxy
   • BAutomated patch management
   • CSnapshots
   • DNIC teaming

   Show answer

   Answer: A

   Explanation

   its the way to distribute load across different servers, at the same time you can remove from the cluster each server that you want to update.

   Source: Adapted from community discussion — Ribeiro19

   References

   • Microsoft Learn

   Next question

2. Question 222 · 856 in bank

   Which of the following would BEST provide a systems administrator with the ability to more efficiently identify systems and manage permissions and policies based on location, role, and service level?

   • AStandard naming conventions
   • BDomain services
   • CBaseline configurations
   • DDiagrams

   Show answer

   Answer: A

   Explanation

   Quoting from the official guide below. A standard naming convention for hardware assets, and for digital assets such as accounts and virtual machines, makes the environment more consistent. This means that errors are easier to spot and that it is easier to automate through scripting. The naming strategy should allow administrators to identify the type and function of any particular resource or location at any point in the CMDB or network directory. Each label should conform to rules for host and DNS names.

   Source: Adapted from community discussion — yoloson

   Next question

3. Question 223 · 856 in bank

   Select 2

   A security analyst is hardening a network infrastructure. The analyst is given the following requirements: • Preserve the use of public IP addresses assigned to equipment on the core router. • Enable "in transport" encryption protection to the web server with the strongest ciphers. Which of the following should the analyst implement to meet these requirements? (Choose two.)

   • AConfigure VLANs on the core router.
   • BConfigure NAT on the core router.
   • CConfigure BGP on the core router.
   • DEnable AES encryption on the web server.
   • EEnable 3DES encryption on the web server.
   • FEnable TLSv2 encryption on the web server.

   Show answer

   Answer: BF

   Explanation

   B. Configure NAT on the core router: By configuring Network Address Translation (NAT) on the core router, the analyst can preserve the use of public IP addresses assigned to equipment. NAT allows for the translation of private IP addresses to public IP addresses and vice versa, enabling devices with private IP addresses to communicate with devices on the internet using the public IP addresses assigned to the core router. F. Enable TLSv2 encryption on the web server: To enable "in transport" encryption protection to the web server with the strongest ciphers, the analyst should enable TLSv2 encryption. TLS (Transport Layer Security) is a cryptographic protocol that provides secure communication over networks. By enabling TLSv2 with strong ciphers, the web server can establish encrypted connections and protect the data transmitted between the server and clients.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 224 · 856 in bank

   A security analyst is investigating an incident to determine what an attacker was able to do on a compromised laptop. The analyst reviews the following SIEM log:

   

   Which of the following describes the method that was used to compromise the laptop?

   • AAn attacker was able to move laterally from PC1 to PC2 using a pass-the-hash attack.
   • BAn attacker was able to bypass application whitelisting by emailing a spreadsheet attachment with an embedded PowerShell in the file.
   • CAn attacker was able to install malware to the C:\asdf234 folder and use it to gain administrator rights and launch Outlook.
   • DAn attacker was able to phish user credentials successfully from an Outlook user profile

   Show answer

   Answer: B

   Explanation

   The first event says that .exe file was blocked. The second event says that PowerShell process started and initiated by outlook. So an email attachment is most likely the case. Among all available options B is talking about attachment. It is not known that is Spreadsheet but it is the only correct option.

   Source: Adapted from community discussion — Blueteam

   Next question

5. Question 225 · 856 in bank

   A security analyst discovers that a company's username and password database was posted on an Internet forum. The usernames and passwords are stored in plain text. Which of the following would mitigate the damage done by this type of data exfiltration in the future?

   • ACreate DLP controls that prevent documents from leaving the network.
   • BImplement salting and hashing.
   • CConfigure the web content filter to block access to the forum.
   • DIncrease password complexity requirements.

   Show answer

   Answer: B

   Explanation

   To mitigate the damage done by this type of data exfiltration in the future, the analyst should implement salting and hashing (choice B). Salting and hashing are techniques used to protect the security of passwords stored in a database. Salting involves adding random data, known as a "salt," to each password before it is hashed. This makes it more difficult for attackers to crack the passwords by using pre-computed hash tables, known as "rainbow tables." Hashing involves applying a one-way mathematical function, known as a "hash algorithm," to the salted password to produce a fixed-length output, known as a "hash value." This makes it impossible to determine the original password from the hash value, even if the attacker has access to the database. By implementing salting and hashing, the company can ensure that its passwords are protected even if the database is compromised

   Source: Adapted from community discussion — FMMIR

   Next question

6. Question 226 · 856 in bank

   Joe, an employee, receives an email stating he won the lottery. The email includes a link that requests a name, mobile phone number, address, and date of birth be provided to confirm Joe’s identity before sending him the prize. Which of the following BEST describes this type of email?

   • ASpear phishing
   • BWhaling
   • CPhishing
   • DVishing

   Show answer

   Answer: C

   Explanation

   C. Phishing Phishing is a type of cyberattack where the attacker sends a fraudulent email, message, or communication to individuals in order to trick them into revealing sensitive information, such as personal details, passwords, or financial information. In this scenario, the email claiming that Joe won the lottery and requesting personal information is an example of phishing. The attacker is attempting to deceive Joe into providing his personal information under false pretenses.

   Source: Adapted from community discussion — je123

   Next question

7. Question 227 · 856 in bank

   A company deployed a WiFi access point in a public area and wants to harden the configuration to make it more secure. After performing an assessment, an analyst identifies that the access point is configured to use WPA3, AES, WPS, and RADIUS. Which of the following should the analyst disable to enhance the access point security?

   • AWPA3
   • BAES
   • CRADIUS
   • DWPS

   Show answer

   Answer: D

   Explanation

   Wifi Protected Setup - Even though WPS offers this convenience, it is appallingly insecure. Wireless networks with WPS enabled are highly vulnerable to cybersecurity threats. Attackers can easily target the WPS function to steal network passwords, regardless of how complex the password is.

   Source: Adapted from community discussion — sauna28

   Next question

8. Question 228 · 856 in bank

   Which of the following would be used to find the MOST common web-application vulnerabilities?

   • AOWASP
   • BMITRE ATT&CK
   • CCyber Kill Chain
   • DSDLC

   Show answer

   Answer: A

   Explanation

   Anything related to WEB APPLICATION SECURITY = OWASP The Open Web Application Security Project (FRAMEWORK) is an online community that produces freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security. The Open Web Application Security Project provides free and open resources. • MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary’s lifecycle and the platforms they are known to target. ATT&CK is useful for understanding security risk against known adversary behavior, for planning security improvements, and verifying defenses work as expected.

   Source: Adapted from community discussion — sauna28

   Next question

9. Question 229 · 856 in bank

   A network engineer is troubleshooting wireless network connectivity issues that were reported by users. The issues are occurring only in the section of the building that is closest to the parking lot. Users are intermittently experiencing slow speeds when accessing websites and are unable to connect to network drives. The issues appear to increase when laptop users return to their desks after using their devices in other areas of the building. There have also been reports of users being required to enter their credentials on web pages in order to gain access to them. Which of the following is the MOST likely cause of this issue?

   • AAn external access point is engaging in an evil-twin attack.
   • BThe signal on the WAP needs to be increased in that section of the building.
   • CThe certificates have expired on the devices and need to be reinstalled.
   • DThe users in that section of the building are on a VLAN that is being blocked by the firewall

   Show answer

   Answer: A

   Explanation

   The most likely cause of this issue is an external access point engaging in an evil-twin attack (choice A). An evil-twin attack is a type of wireless network security attack in which an attacker sets up a fake wireless access point (WAP) that has the same name and security settings as a legitimate WAP. When users attempt to connect to the legitimate WAP, they may unknowingly connect to the fake WAP instead, which allows the attacker to intercept and potentially modify their network traffic. This type of attack is particularly likely to be successful in areas where there are multiple WAPs, such as in the section of the building closest to the parking lot, where users may be returning to their desks after using their devices elsewhere in the building. The intermittent slow speeds and inability to connect to network drives, as well as the reports of users being required to re-enter their credentials on web pages, are all symptoms of an evil-twin attack.

   Source: Adapted from community discussion — FMMIR

   Next question

10. Question 230 · 856 in bank

    A security administrator suspects there may be unnecessary services running on a server. Which of the following tools will the administrator MOST likely use to confirm the suspicions?

    • ANmap
    • BWireshark
    • CAutopsy
    • DDNSEnum

    Show answer

    Answer: A

    Explanation

    Goodluck guys! I passed yesterday after reviewing here. Figured I'd come back for an update since others haven't. I'd say 50-60%+ of my questions came from here, but a lot of those were ones without clear answers (ex, questions with multiple answers at or near 50/50). This guide is more of a study sheet vs an answer key. Dont go with the admin selected answer and USE THE DISCUSSIONS as well as some external material to find the correct answers. Pay attention to PBQ's! I had 4 and 3/4 came from here.

    Source: Adapted from community discussion — [Removed]

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 221. 856 questions available.