SY0-601 practice questions 231–240

1. Question 231 · 856 in bank

   A vulnerability has been discovered and a known patch to address the vulnerability does not exist. Which of the following controls works BEST until a proper fix is released?

   • ADetective
   • BCompensating
   • CDeterrent
   • DCorrective

   Show answer

   Answer: B

   Explanation

   Compensating controls are alternative security measures that are implemented in the absence of a specific control or when the existing control is insufficient to mitigate a risk. These controls provide an alternative means of reducing the risk or addressing the vulnerability until a proper fix or patch is available. They are designed to compensate for the lack of a primary control and help maintain an acceptable level of security. By implementing compensating controls, organizations can mitigate the risks associated with the vulnerability and protect their systems and data until a patch or fix is released. These controls may include additional monitoring, enhanced access controls, increased logging and auditing, or other measures that provide an equivalent level of protection.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 232 · 856 in bank

   While reviewing pcap data, a network security analyst is able to locate plaintext usernames and passwords being sent from workstations to network switches. Which of the following is the security analyst MOST likely observing?

   • ASNMP traps
   • BA Telnet session
   • CAn SSH connection
   • DSFTP traffic

   Show answer

   Answer: B

   Explanation

   Telnet is a network protocol that allows for remote terminal access and management of network devices. It is an older and less secure protocol compared to SSH (Secure Shell), which is commonly used for secure remote access. Telnet transmits data, including usernames and passwords, in plaintext, making it vulnerable to interception and eavesdropping. In a Telnet session, when a user enters their credentials (username and password), the information is sent in clear text over the network. This means that anyone with access to the network traffic can easily capture and read the transmitted data, including the usernames and passwords. Therefore, if the security analyst is able to locate plaintext usernames and passwords being sent from workstations to network switches in the pcap data, it is highly likely that they are observing a Telnet session.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 233 · 856 in bank

   Which of the following would detect intrusions at the perimeter of an airport?

   • ASignage
   • BFencing
   • CMotion sensors
   • DLighting
   • EBollards

   Show answer

   Answer: C

   Explanation

   Seriously, how does Bollards get identified as the correct answer on this site? It doesn't detect, it deters. It's a post.

   Source: Adapted from community discussion — ender1701

   Next question

4. Question 234 · 856 in bank

   An attacker replaces a digitally signed document with another version that goes unnoticed. Upon reviewing the document’s contents, the author notices some additional verbiage that was not originally in the document but cannot validate an integrity issue. Which of the following attacks was used?

   • ACryptomalware
   • BHash substitution
   • CCollision
   • DPhishing

   Show answer

   Answer: C

   Explanation

   A collision attack involves finding two different inputs that produce the same hash value. In the context of this question, the attacker has likely found a way to generate a modified document that produces the same hash value as the original document, allowing them to replace the original document with the modified version without invalidating the digital signature. This manipulation goes unnoticed since the modified document appears to have the same integrity as the original, but with additional verbiage added. It's important to note that collision attacks are rare and usually require significant computational resources and expertise to execute successfully. However, when they occur, they can undermine the integrity and trustworthiness of digital signatures and cryptographic systems.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 235 · 856 in bank

   A security analyst notices that specific files are being deleted each time a systems administrator is on vacation. Which of the following BEST describes the type of malware that is running?

   • AFileless virus
   • BLogic bomb
   • CKeylogger
   • DRansomware

   Show answer

   Answer: B

   Explanation

   A logic bomb is a type of malware that is programmed to execute a malicious action when specific conditions are met. In this case, the logic bomb is triggered whenever the systems administrator is on vacation, causing specific files to be deleted. The purpose of a logic bomb is often to cause damage or disruption to a system or organization at a specific time or under certain circumstances. Fileless viruses, on the other hand, are malware that reside in a system's memory and do not leave traditional traces on disk, making them more difficult to detect. Keyloggers are designed to record keystrokes and capture sensitive information, while ransomware encrypts files and demands a ransom for their release. Neither of these options aligns with the given scenario.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 236 · 856 in bank

   Which of the following involves the inclusion of code in the main codebase as soon as it is written?

   • AContinuous monitoring
   • BContinuous deployment
   • CContinuous validation
   • DContinuous integration

   Show answer

   Answer: D

   Explanation

   Continuous validation - is a method that lets you constantly monitor new code, testing it against criteria for functionality, security, and performance Continuous integration - is the practice of automating the integration of code changes from multiple contributors into a single software project Continuous integration puts a great emphasis on testing automation to check that the application is not broken whenever new commits are integrated into the main branch. Continuous delivery - is an extension of continuous integration since it automatically deploys all code changes to a testing and/or production environment after the build stage. Continuous monitoring - is an approach where an organization constantly monitors its IT systems and networks to detect security threats, performance issues, or non-compliance problems in an automated manner. Going with D. Continuous Integration

   Source: Adapted from community discussion — hsdj

   Next question

7. Question 237 · 856 in bank

   Which of the following can reduce vulnerabilities by avoiding code reuse?

   • AMemory management
   • BStored procedures
   • CNormalization
   • DCode obfuscation

   Show answer

   Answer: D

   Explanation

   Code obfuscation is a technique used to make code more difficult to understand or reverse engineer. It involves transforming the code in a way that retains its functionality but makes it harder for an attacker to analyze and exploit any vulnerabilities present. One aspect of code obfuscation is to avoid code reuse, where common code patterns or functions are deliberately modified or transformed to make them less recognizable.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

8. Question 238 · 856 in bank

   The technology department at a large global company is expanding its Wi-Fi network infrastructure at the headquarters building. Which of the following should be closely coordinated between the technology, cybersecurity, and physical security departments? Select 1

   • AAuthentication protocol
   • BEncryption type
   • CWAP placement
   • DVPN configuration

   Show answer

   Answer: C

   Explanation

   WAP (Wireless Access Point) placement is an aspect that should be closely coordinated between the technology, cybersecurity, and physical security departments when expanding a Wi-Fi network infrastructure. The physical placement of WAPs is crucial to ensure optimal coverage, minimize interference, and maintain security. Coordinating WAP placement involves determining the strategic locations for deploying access points, considering factors such as coverage area, signal strength, potential obstructions, and the physical security of the access points themselves. The technology department would handle the technical aspects, the cybersecurity department would provide input on security considerations, and the physical security department would contribute to ensuring the physical protection of the WAPs and preventing unauthorized access or tampering.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 239 · 856 in bank

   Which of the following is an example of risk avoidance?

   • AInstalling security updates directly in production to expedite vulnerability fixes
   • BBuying insurance to prepare for financial loss associated with exploits
   • CNot installing new software to prevent compatibility errors
   • DNot taking preventive measures to stop the theft of equipment

   Show answer

   Answer: C

   Explanation

   This question reflects well what the new exam questions are! Totally pointless and ridiculous. Installing updates in production = idiocy. Purchase of insurance = transfer. Not taking action = ridiculous.

   Source: Adapted from community discussion — [Removed]

   Next question

10. Question 240 · 856 in bank

    A security administrator needs to block a TCP connection using the corporate firewall. Because this connection is potentially a threat, the administrator does not want to send back an RST. Which of the following actions in the firewall rule would work BEST?

    • ADrop
    • BReject
    • CLog alert
    • DPermit

    Show answer

    Answer: A

    Explanation

    "In the Drop action, no message is sent describing why the package was dropped. In the Reject action, a message is sent to the source describing the reason for the rejection"

    Source: Adapted from community discussion — [Removed]

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 231. 856 questions available.