SY0-601 practice questions 281–290

1. Question 281 · 856 in bank

   A network engineer and a security engineer are discussing ways to monitor network operations. Which of the following is the BEST method?

   • ADisable Telnet and force SSH.
   • BEstablish a continuous ping.
   • CUtilize an agentless monitor.
   • DEnable SNMPv3 with passwords.

   Show answer

   Answer: D

   Explanation

   Let me give you a little knowledge here...I think CompTIA would be looking for the answer of D - Enable SNMPv3 With passwords. The key reasons are: It explicitly meets the question's context of discussing from a "security plus" perspective. SNMPv3 is considered best practice and provides the security property of encryption specifically called out. While agentless monitoring sounds appealing, without details it creates uncertainty, whereas SNMPv3 is a known secure protocol. D balances the need for network monitoring functionality with optimizing the security posture by ensuring encryption.

   Source: Adapted from community discussion — thisguyfucks

   Next question

2. Question 282 · 856 in bank

   A security analyst is looking for a solution to help communicate to the leadership team the severity levels of the organization’s vulnerabilities. Which of the following would BEST meet this need?

   • ACVE
   • BSIEM
   • CSOAR
   • DCVSS

   Show answer

   Answer: D

   Explanation

   Just passed my exam today 22 March 2023 with 799 score. This platform has helped. This question was on the test. Right answer D.

   Source: Adapted from community discussion — Adji91

   Next question

3. Question 283 · 856 in bank

   A company is switching to a remote work model for all employees. All company and employee resources will be in the cloud. Employees must use their personal computers to access the cloud computing environment. The company will manage the operating system. Which of the following deployment models is the company implementing?

   • ACYOD
   • BMDM
   • CCOPE
   • DVDI

   Show answer

   Answer: D

   Explanation

   The answer cannot be C. By definition, COPE (corporate-owned personally enabled) is a business model in which an organization provides its employees with mobile computing devicesand allows the employees to use them as if they were personally owned notebook computers, tablets or smartphones. The question explicitly states that users must use their personal equipment, not company-provided. The only logical answer in that scenario is VDI (Virtual Desktop Infrastructure - a technology that refers to the use of virtual machines to provide and manage virtual desktops.)

   Source: Adapted from community discussion — VHuckle

   Next question

4. Question 284 · 856 in bank

   A security administrator needs to inspect in-transit files on the enterprise network to search for PII, credit card data, and classification words. Which of the following would be the BEST to use?

   • AIDS solution
   • BEDR solution
   • CHIPS software solution
   • DNetwork DLP solution

   Show answer

   Answer: D

   Explanation

   ust passed my exam today 22 March 2023 with 799 score. This platform has helped. This question was on the test. Right answer D.

   Source: Adapted from community discussion — Adji91

   Next question

5. Question 285 · 856 in bank

   The Chief Executive Officer announced a new partnership with a strategic vendor and asked the Chief Information Security Officer to federate user digital identities using SAML-based protocols. Which of the following will this enable?

   • ASSO
   • BMFA
   • CPKI
   • DDLP

   Show answer

   Answer: A

   Explanation

   Security Assertion Markup Language (SAML) is an Extensible Markup Language (XML)–based data format used for SSO on web browsers. Imagine two websites hosted by two different organizations. Normally, a user would have to provide different credentials to access either website. However, if the organizations trust each other, they can use SAML as a federated identity management system. Users authenticate with one website and are not required to authenticate again when accessing the second website.

   Source: Adapted from community discussion — LordJaraxxus

   Next question

6. Question 286 · 856 in bank

   An employee’s company account was used in a data breach. Interviews with the employee revealed: • The employee was able to avoid changing passwords by using a previous password again. • The account was accessed from a hostile, foreign nation, but the employee has never traveled to any other countries. Which of the following can be implemented to prevent these issues from reoccurring? (Choose two.)

   • AGeographic dispersal
   • BPassword complexity
   • CPassword history
   • DGeotagging
   • EPassword lockout
   • FGeofencing

   Show answer

   Answer: C

   Explanation

   Question states to choose 2. Correct answer is CF. C - User bypassed changing passwords by using a previously used pwd. F - User has never travelled to another country, so geofencing will limit access to current location.

   Source: Adapted from community discussion — VHuckle

   Next question

7. Question 287 · 856 in bank

   A large industrial system’s smart generator monitors the system status and sends alerts to third-party maintenance personnel when critical failures occur. While reviewing the network logs, the company’s security manager notices the generator’s IP is sending packets to an internal file server’s IP. Which of the following mitigations would be BEST for the security manager to implement while maintaining alerting capabilities?

   • ASegmentation
   • BFirewall allow list
   • CContainment
   • DIsolation

   Show answer

   Answer: A

   Explanation

   Containment and Isolation can be ruled out easily. We are left with A - segmentation and B - firewall allow list. I dont believe firewall will work, since IP addresses can be dynamic and change, which would render the report functionality useless, since it wouldnt be able to send data to the new addresses. Also firewalls tend to be placed between the internet and the inside network, thus it wouldnt prevent any traffic from being sent between hosts inside the network. Thats why I think A is more appropriate answer, but I am open for discussion.

   Source: Adapted from community discussion — Ranaer

   Next question

8. Question 288 · 856 in bank

   The Chief Information Security Officer (CISO) requested a report on potential areas of improvement following a security incident. Which of the following incident response processes is the CISO requesting?

   • ALessons learned
   • BPreparation
   • CDetection
   • DContainment
   • ERoot cause analysis

   Show answer

   Answer: A

   Explanation

   Answer: Lessons learned Lessons learned is the final step in the incident response where the organization reviews their incident response and prepare for a future attack. This is where you understand how/why an incident occurred, identify any weaknesses in your organization's practices, any positive elements or practices that went well, and things that could be done to prepare for a future incident. ========================= Incident Response - A set of instructions or procedures an IT staff follows to detect, respond to, recover and recover from a security incident. Phases in the Incident Response Plan 1. Preparation: The organization plans out how they will respond to attack, this can involve: 2. Identification: Detecting and determining whether an incident has occurred. 3. Containment: Once a threat has been identified, the organization must limit or prevent any further damage. 4. Eradication: The removal of the threat 5. Recovery: Restoring systems affected by the incident 6. Lessons Learned: Where the organization reviews their incident response and prepare for a future attack

   Source: Adapted from community discussion — rodwave

   Next question

9. Question 289 · 856 in bank

   Which of the following technologies is used to actively monitor for specific file types being transmitted on the network?

   • AFile integrity monitoring
   • BHoneynets
   • CTcpreplay
   • DData loss prevention

   Show answer

   Answer: D

   Explanation

   DLP solutions are designed to detect and prevent the unauthorized transmission of sensitive or confidential data. They monitor network traffic in real-time and inspect the content of files to identify specific file types, such as PII (Personally Identifiable Information), credit card numbers, or classified information. When a matching file type is detected, DLP solutions can take various actions, such as blocking the transmission, alerting security personnel, or applying encryption measures.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

10. Question 290 · 856 in bank

    As part of the building process for a web application, the compliance team requires that all PKI certificates are rotated annually and can only contain wildcards at the secondary subdomain level. Which of the following certificate properties will meet these requirements?

    • AHTTPS://*.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022
    • BHTTPS://app1.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022
    • CHTTPS://*.app1.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022
    • DHTTPS://*.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2023

    Show answer

    Answer: C

    Explanation

    Answer: A. HTTPS://*.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022. The question asks for the secondary subdomain. If the the domain is comptia.org then the SECONDARY subdomain would be the wildcard in HTTPS://*.comptia.org. In Answer C the domain goes three levels deep HTTPS://*.app1.comptia.org. And in D , Although the wildcard placement is correct the dates are two years instead of 1 year.

    Source: Adapted from community discussion — Binx

    References

    • comptia.org documentation
    • comptia.org documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 281. 856 questions available.