SY0-601 practice questions 251–260

1. Question 251 · 856 in bank

   An organization wants to enable built-in FDE on all laptops. Which of the following should the organization ensure is installed on all laptops?

   • ATPM
   • BCA
   • CSAML
   • DCRL

   Show answer

   Answer: A

   Explanation

   The organization should ensure that a Trusted Platform Module (TPM) is installed on all laptops inorder to enable built-in Full Disk Encryption (FDE). TPM is a hardware-based security chip that storesencryption keys and helps to protect data from malicious attacks. It is important to ensure that theTPM is properly configured and enabled in order to get the most out of FDE.

   Source: Adapted from community discussion — Jibz18

   Next question

2. Question 252 · 856 in bank

   A security analyst needs to centrally manage credentials and permissions to the company’s network devices. The following security requirements must be met: • All actions performed by the network staff must be logged. • Per-command permissions must be possible. • The authentication server and the devices must communicate through TCP. Which of the following authentication protocols should the analyst choose?

   • AKerberos
   • BCHAP
   • CTACACS+
   • DRADIUS

   Show answer

   Answer: C

   Explanation

   TACACS+ is a widely used protocol for centrally managing credentials and permissions to network devices. It offers several features that align with the specified security requirements: Logging: TACACS+ supports extensive logging capabilities, allowing all actions performed by the network staff to be logged. This helps with audit trails, monitoring, and forensic analysis. Per-command permissions: TACACS+ provides granular control over access permissions, including per-command permissions. This means that administrators can define specific permissions for each command or operation that network staff can perform. It offers fine-grained access control for network devices. TCP communication: TACACS+ is designed to work over TCP (Transmission Control Protocol), which satisfies the requirement for communication between the authentication server and the network devices.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 253 · 856 in bank

   An organization recently released a software assurance policy that requires developers to run code scans each night on the repository. After the first night, the security team alerted the developers that more than 2,000 findings were reported and need to be addressed. Which of the following is the MOST likely cause for the high number of findings?

   • AThe vulnerability scanner was not properly configured and generated a high number of false positives.
   • BThird-party libraries have been loaded into the repository and should be removed from the codebase.
   • CThe vulnerability scanner found several memory leaks during runtime, causing duplicate reports for the same issue.
   • DThe vulnerability scanner was not loaded with the correct benchmarks and needs to be updated.

   Show answer

   Answer: A

   Explanation

   forgot to choose the answer lol. But for me it's A. Since it was just the first night of the vulnerability scan, definitely there would be a lot of false positives that the engineer who monitors this needs to address and modify so that the vulnerability scan can be more accurate.

   Source: Adapted from community discussion — seagnull

   Next question

4. Question 254 · 856 in bank

   An organization is concerned about intellectual property theft by employees who leave the organization. Which of the following should the organization MOST likely implement?

   • ACBT
   • BNDA
   • CMOU
   • DAUP

   Show answer

   Answer: B

   Explanation

   A Non-Disclosure Agreement is a legal contract between the organization and its employees that establishes confidentiality obligations. It is designed to protect sensitive and proprietary information from being disclosed or used without authorization, particularly when employees terminate their employment. By implementing NDAs, the organization can legally require employees to maintain the confidentiality of sensitive information, including intellectual property, both during their employment and after they leave the organization. NDAs typically outline the scope of the confidential information, specify the obligations of the employees, and define the consequences for violating the agreement, such as legal action or financial penalties.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 255 · 856 in bank

   An organization has decided to purchase an insurance policy because a risk assessment determined that the cost to remediate the risk is greater than the five- year cost of the insurance policy. The organization is enabling risk:

   • Aavoidance.
   • Bacceptance.
   • Cmitigation.
   • Dtransference.

   Show answer

   Answer: D

   Explanation

   Answer: Risk Transference Risk Transference is transferring risk to a third party such as a vendor. In cyber security, that can be through utilizing cyber-risk insurance. Cyber insurance generally covers a business' liability for a data breach involving sensitive customer information, such as account numbers, credit card numbers, health records etc. ============================================== Other Choices: Risk Avoidance - Strategy that eliminates risk by avoiding activities that would expose themselves to the risk. Risk Mitigation - the practice of reducing the impact of risks through preventative and reactive planning Risk Acceptance - When a business or individual accepts the potential loss from a risk. Generally occurs when the business or individual feels that the risk does not warrant the countermeasures.

   Source: Adapted from community discussion — rodwave

   Next question

6. Question 256 · 856 in bank

   A security analyst reviews web server logs and notices the following lines:

   

   Which of the following vulnerabilities is the attacker trying to exploit?

   • AToken reuse
   • BSQLi
   • CCSRF
   • DXSS

   Show answer

   Answer: D

   Explanation

   The main difference between XSS and CSRF can be summarized as follows: XSS involves injecting and executing malicious scripts in a victim's browser when interacting with a compromised website, while CSRF tricks the victim's browser into performing unwanted actions on a target website where the victim is authenticated. XSS exploits the vulnerability in the website's input validation and output encoding, while CSRF exploits the trust between the user's browser and the target website. XSS impacts the user's browser, while CSRF impacts the target website and its users.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 257 · 856 in bank

   A network manager is concerned that business may be negatively impacted if the firewall in its data center goes offline. The manager would like to implement a high availability pair to:

   • Adecrease the mean time between failures.
   • Bremove the single point of failure.
   • Ccut down the mean time to repair.
   • Dreduce the recovery time objective.

   Show answer

   Answer: B

   Explanation

   C- Remove the single point of failure, is the correct choice. By deploying a high availability (HA) pair of firewalls, the network manager ensures that if one firewall goes offline or experiences a failure, the other firewall can seamlessly take over the traffic processing and maintain uninterrupted network connectivity. This redundancy eliminates the single point of failure and improves the overall reliability and availability of the network.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

8. Question 258 · 856 in bank

   A major manufacturing company updated its internal infrastructure and just recently started to allow OAuth applications to access corporate data. Data leakage is now being reported. Which of the following MOST likely caused the issue?

   • APrivilege creep
   • BUnmodified default settings
   • CTLS protocol vulnerabilities
   • DImproper patch management

   Show answer

   Answer: B

   Explanation

   B. Unmodified default settings In OAuth2 there is the concept of "scope". The .default scope can be used in any OAuth 2.0 flow and to initiate admin consent. Its use is required in the On-Behalf-Of flow and client credentials flow. Clients can't combine static (.default) consent and dynamic consent in a single request. https://learn.microsoft.com/en-us/azure/active-directory/develop/scopes-oidc Scope is a mechanism in OAuth 2.0 to limit an application's access to a user's account. An application can request one or more scopes, this information is then presented to the user in the consent screen, and the access token issued to the application will be limited to the scopes granted. OAuth does not define any particular values for scopes, since it is highly dependent on the service's internal architecture and needs. https://oauth.net/2/scope/ What is OAuth2 scope? OAuth 2.0 scopes provide a way to limit the amount of access that is granted to an access token.

   Source: Adapted from community discussion — ganymede

   References

   • Microsoft Learn

   Next question

9. Question 259 · 856 in bank

   While preparing a software inventory report, a security analyst discovers an unauthorized program installed on most of the company’s servers. The program utilizes the same code signing certificate as an application deployed to only the accounting team. After removing the unauthorized program, which of the following mitigations should the analyst implement to BEST secure the server environment?

   • ARevoke the code signing certificate used by both programs.
   • BBlock all unapproved file hashes from installation
   • CAdd the accounting application file hash to the allowed list.
   • DUpdate the code signing certificate for the approved application.

   Show answer

   Answer: A

   Explanation

   Prevents unauthorized use: Revoking the code signing certificate renders it invalid and prevents both the unauthorized program and the approved application from using the certificate for signing their code. This ensures that only trusted and authorized software can be installed and executed on the servers. Maintains trust in the approved application: By revoking the code signing certificate used by both programs, the analyst ensures that the approved application's certificate is no longer associated with the unauthorized program. This maintains the integrity and trustworthiness of the approved application, safeguarding it against potential reputational damage due to the unauthorized program's activities.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

10. Question 260 · 856 in bank

    A security analyst is reviewing the latest vulnerability scan report for a web server following an incident. The vulnerability report showed no concerning findings. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is available for the vulnerability. Which of the following is the MOST likely cause?

    • ASecurity patches failed to install due to a version incompatibility.
    • BAn adversary altered the vulnerability scan reports.
    • CA zero-day vulnerability was used to exploit the web server.
    • DThe scan reported a false negative for the vulnerability.

    Show answer

    Answer: D

    Explanation

    Given that the vulnerability used to exploit the server is present in historical vulnerability scan reports and a patch is available, it suggests that the vulnerability has been known and detectable in the past. Therefore, it is more likely that the latest scan report produced a false negative and failed to identify the vulnerability. While it is possible for an adversary to tamper with vulnerability scan reports, it is less likely in this case since the vulnerability is present in historical scan reports. The scenario indicates that the vulnerability was known prior to the incident.

    Source: Adapted from community discussion — ApplebeesWaiter1122

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 251. 856 questions available.