SY0-601 practice questions 271–280

1. Question 271 · 856 in bank

   A company uses specially configured workstations for any work that requires administrator privileges to its Tier 0 and Tier 1 systems. The company follows a strict process to harden systems immediately upon delivery. Even with these strict security measures in place, an incident occurred from one of the workstations. The root cause appears to be that the SoC was tampered with or replaced. Which of the following MOST likely occurred?

   • AFileless malware
   • BA downgrade attack
   • CA supply-chain attack
   • DA logic bomb
   • EMisconfigured BIOS

   Show answer

   Answer: C

   Explanation

   I believe SoC here is used for "System on a chip". This indicates to me that the only reasonable answer is supply-chain attack.

   Source: Adapted from community discussion — Ranaer

   Next question

2. Question 272 · 856 in bank

   Audit logs indicate an administrative account that belongs to a security engineer has been locked out multiple times during the day. The security engineer has been on vacation for a few days. Which of the following attacks can the account lockout be attributed to?

   • ABackdoor
   • BBrute-force
   • CRootkit
   • DTrojan

   Show answer

   Answer: B

   Explanation

   A brute-force attack is a method used by attackers to gain unauthorized access to an account or system by systematically attempting various combinations of usernames and passwords until the correct one is found. In this case, the administrative account belonging to the security engineer has been repeatedly locked out, indicating that multiple incorrect login attempts have been made. Since the security engineer has been on vacation, it is unlikely that they are the ones attempting to log in with incorrect credentials. Therefore, it suggests that an attacker is systematically trying different combinations of usernames and passwords to gain access to the administrative account.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 273 · 856 in bank

   A security analyst is reviewing the output of a web server log and notices a particular account is attempting to transfer large amounts of money:

   

   Which of the following types of attacks is MOST likely being conducted?

   • ASQLi
   • BCSRF
   • CSpear phishing
   • DAPI

   Show answer

   Answer: B

   Explanation

   B. CSRF What is a CSRF attack? Cross site request forgery (CSRF) is a vulnerability where an attacker performs actions while impersonating another user. For example, transferring funds to an attacker's account, changing a victim's email address, or they could even just redirect a pizza to an attacker's address!

   Source: Adapted from community discussion — SophyQueenCR82

   Next question

4. Question 274 · 856 in bank

   After installing a patch on a security appliance, an organization realized a massive data exfiltration had occurred. Which of the following BEST describes the incident?

   • ASupply chain attack
   • BRansomware attack
   • CCryptographic attack
   • DPassword attack

   Show answer

   Answer: A

   Explanation

   COMPTIA, whats wrong with you? It's not possible to determine the exact cause of the data exfiltration based on the information provided.

   Source: Adapted from community discussion — sdc939

   Next question

5. Question 275 · 856 in bank

   Select 2

   A security analyst reviews web server logs and notices the following lines:

   

   Which of the following vulnerabilities has the attacker exploited? (Choose two.)

   • ARace condition
   • BLFI
   • CPass the hash
   • DXSS
   • ERFI
   • FDirectory traversal

   Show answer

   Answer: BF

   Explanation

   lol in Q330 we had to chose XSS out of answers now we have same Q with more options smh Xss isnt even considerad in this one LFI lol

   Source: Adapted from community discussion — rf18

   Next question

6. Question 276 · 856 in bank

   An information security manager for an organization is completing a PCI DSS self-assessment for the first time. Which of the following is the MOST likely reason for this type of assessment?

   • AAn international expansion project is currently underway.
   • BOutside consultants utilize this tool to measure security maturity.
   • CThe organization is expecting to process credit card information.
   • DA government regulator has requested this audit to be completed.

   Show answer

   Answer: C

   Explanation

   PCI DSS is a set of security standards designed to protect cardholder data and ensure secure payment card processing. It applies to organizations that store, process, or transmit cardholder data, including those involved in accepting and processing credit card payments. Compliance with PCI DSS is mandatory for any organization that handles payment card information. Completing a PCI DSS self-assessment helps organizations assess their compliance with the standard and identify any gaps or vulnerabilities in their payment card processing environment. It allows the organization to evaluate their security controls, policies, and procedures related to cardholder data protection and make necessary improvements to ensure compliance.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 277 · 856 in bank

   A security analyst wants to reference a standard to develop a risk management program. Which of the following is the BEST source for the analyst to use?

   • ASSAE SOC 2
   • BISO 31000
   • CNIST CSF
   • DGDPR

   Show answer

   Answer: B

   Explanation

   ISO 31000 The ISO 31000 Risk Management framework is an international standard that provides businesses with guidelines and principles for risk management from the International Organization for Standardization. Regulatory compliance initiatives are usually specific to a particular country and applicable to certain sized businesses or businesses in specific industries. However, ISO 31000 is designed to be used in organizations of any size. Its concepts work equally well in the public and the private sector, in large or small businesses and nonprofit organizations.

   Source: Adapted from community discussion — stoneface

   Next question

8. Question 278 · 856 in bank

   Physical access to the organization's servers in the data center requires entry and exit through multiple access points: a lobby, an access control vestibule, three doors leading to the server floor, a door to the server floor itself, and eventually to a caged area solely for the organization’s hardware. Which of the following controls is described in this scenario?

   • ACompensating
   • BDeterrent
   • CPreventive
   • DDetective

   Show answer

   Answer: C

   Explanation

   I passed my sec + today!!!!! I found this site 3 days ago, I was able to review 465 question before taking my exam, this site is the truth.

   Source: Adapted from community discussion — TOMSLICK

   Next question

9. Question 279 · 856 in bank

   A new security engineer has started hardening systems. One of the hardening techniques the engineer is using involves disabling remote logins to the NAS. Users are now reporting the inability to use SCP to transfer files to the NAS, even though the data is still viewable from the users’ PCs. Which of the following is the MOST likely cause of this issue?

   • ATFTP was disabled on the local hosts.
   • BSSH was turned off instead of modifying the configuration file.
   • CRemote login was disabled in the networkd.conf instead of using the sshd.conf.
   • DNetwork services are no longer running on the NAS.

   Show answer

   Answer: B

   Explanation

   The most likely cause of the issue is that SSH was turned off instead of modifying the configuration file. SSH (Secure Shell) is a commonly used protocol for securely accessing and managing remote systems, including network-attached storage (NAS) devices. Disabling remote logins to the NAS would most likely involve modifying the configuration file for the SSH service (sshd.conf), not disabling SSH itself. If SSH was turned off, it would prevent users from accessing the NAS over the network, including using SCP (Secure Copy Protocol) to transfer files. This would result in the inability to use SCP to transfer files to the NAS, even though the data is still viewable from the users’ PCs.

   Source: Adapted from community discussion — sdc939

   Next question

10. Question 280 · 856 in bank

    An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has been given the documentation only available to the customers of the applications. Which of the following BEST represents the type of testing that will occur?

    • ABug bounty
    • BBlack-box
    • CGray-box
    • DWhite-box

    Show answer

    Answer: C

    Explanation

    The BEST representation of the type of testing that will occur in this scenario is Gray-box testing. Gray-box testing is a testing approach that combines elements of both black-box and white-box testing. In gray-box testing, the tester has partial knowledge or limited access to the internal workings and details of the system being tested. In this case, the outside security firm has been given documentation that is only available to customers of the applications, indicating that they have some level of insight into the system.

    Source: Adapted from community discussion — ApplebeesWaiter1122

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 271. 856 questions available.