SY0-601 practice questions 331–340

1. Question 331 · 856 in bank

   A company wants to deploy PKI on its internet-facing website. The applications that are currently deployed are: • www.company.com (main website) • contactus.company.com (for locating a nearby location) • quotes.company.com (for requesting a price quote) The company wants to purchase one SSL certificate that will work for all the existing applications and any future applications that follow the same naming conventions, such as store.company.com. Which of the following certificate types would BEST meet the requirements?

   • ASAN
   • BWildcard
   • CExtended validation
   • DSelf-signed

   Show answer

   Answer: B

   Explanation

   A wildcard certificate is a type of SSL certificate that can secure a domain and its unlimited number of subdomains. It is identified by a wildcard character () in the domain name, which represents any subdomain. In this case, the company can use a wildcard certificate for ".company.com," which would cover the main website (www.company.com), the contactus subdomain (contactus.company.com), the quotes subdomain (quotes.company.com), and any future subdomains that follow the same naming conventions, such as store.company.com.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 332 · 856 in bank

   Which of the following describes a social engineering technique that seeks to exploit a person's sense of urgency?

   • AA phishing email stating a cash settlement has been awarded but will expire soon
   • BA smishing message stating a package is scheduled for pickup
   • CA vishing call that requests a donation be made to a local charity
   • DA SPIM notification claiming to be undercover law enforcement investigating a cybercrime

   Show answer

   Answer: A

   Explanation

   The social engineering technique that seeks to exploit a person's sense of urgency is described in option A. By stating that a cash settlement has been awarded but will expire soon, the attacker creates a sense of urgency and tries to manipulate the recipient into taking immediate action without thoroughly considering the authenticity or legitimacy of the email. This technique aims to pressure the target into making a hasty decision or divulging sensitive information.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 333 · 856 in bank

   Which of the following statements BEST describes zero-day exploits?

   • AWhen a zero-day exploit is discovered, the system cannot be protected by any means.
   • BZero-day exploits have their own scoring category in CVSS.
   • CA zero-day exploit is initially undetectable, and no patch for it exists.
   • DDiscovering zero-day exploits is always performed via bug bounty programs.

   Show answer

   Answer: C

   Explanation

   I'll go with C. A says it can be protected by ANY means which is not true, sure the exploit itself doesn't have a patch yet but we can isolate the effected system or have some kind of compensating control in place.

   Source: Adapted from community discussion — varun0

   Next question

4. Question 334 · 856 in bank

   A security analyst is concerned about traffic initiated to the dark web from the corporate LAN. Which of the following networks should the analyst monitor?

   • ASFTP
   • BAIS
   • CTor
   • DIoC

   Show answer

   Answer: C

   Explanation

   Hi guys i passed my exam today i had 80 questions in exam the majority were from here my advice is to pay attention to details and meomrizing the questions isnt enouph bce they might twisted anyway goodluck to everyone ;) you can do it

   Source: Adapted from community discussion — rf18

   Next question

5. Question 335 · 856 in bank

   A security analyst is reviewing logs on a server and observes the following output:

   

   Which of the following is the security analyst observing?

   • AA rainbow table attack
   • BA password-spraying attack
   • CA dictionary attack
   • DA keylogger attack

   Show answer

   Answer: C

   Next question

6. Question 336 · 856 in bank

   A company is launching a website in a different country in order to capture user information that a marketing business can use. The company itself will not be using the information. Which of the following roles is the company assuming?

   • AData owner
   • BData processor
   • CData steward
   • DData collector

   Show answer

   Answer: B

   Explanation

   Are you too dumb to search the objectives yourself that you have to use gpt? These are the objectives: • Roles and responsibilities - Data owners - Data controller - Data processor - Data custodian/steward - Data protection officer (DPO) You can ask chatgpt to tell you if Data Collector is included in the objectives. Who knows? XD

   Source: Adapted from community discussion — foxana

   Next question

7. Question 337 · 856 in bank

   An organization would like to remediate the risk associated with its cloud service provider not meeting its advertised 99.999% availability metrics. Which of the following should the organization consult for the exact requirements for the cloud provider?

   • ASLA
   • BBPA
   • CNDA
   • DMOU

   Show answer

   Answer: A

   Explanation

   A service-level agreement (SLA) defines the level of service expected by a customer from a supplier, laying out the metrics by which that service is measured, and the remedies or penalties, if any, should the agreed-on service levels not be achieved.

   Source: Adapted from community discussion — NeoSam999

   Next question

8. Question 338 · 856 in bank

   Which of the following secure application development concepts aims to block verbose error messages from being shown in a user’s interface?

   • AOWASP
   • BObfuscation/camouflage
   • CTest environment
   • DPrevention of information exposure

   Show answer

   Answer: D

   Explanation

   Prevention of information exposure. This concept focuses on ensuring that sensitive information, such as stack traces, debug output, and detailed error messages, are not disclosed to unauthorized parties through the user interface.

   Source: Adapted from community discussion — sdc939

   Next question

9. Question 339 · 856 in bank

   If a current private key is compromised, which of the following would ensure it cannot be used to decrypt all historical data?

   • APerfect forward secrecy
   • BElliptic-curve cryptography
   • CKey stretching
   • DHomomorphic encryption

   Show answer

   Answer: A

   Explanation

   Just passed the exam with a score of 800 on 10/28/23. About 90% of the questions are from here. This question is on the exam.

   Source: Adapted from community discussion — JT4

   Next question

10. Question 340 · 856 in bank

    An organization has expanded its operations by opening a remote office. The new office is fully furnished with office resources to support up to 50 employees working on any given day. Which of the following VPN solutions would BEST support the new office?

    • AAlways-on
    • BRemote access
    • CSite-to-site
    • DFull tunnel

    Show answer

    Answer: C

    Explanation

    A) Always on: VPN that doesn't require user interaction, you are always connected B) Remote access: to connect to a private net over untrusted public networks C Site-to-site: connect to local area net, ideal for business and government, specially if it has multiple offices (CORRECT ANSWER) D) Full tunnel: route all internet traffic from the device through VPN, regardless of the source or destination

    Source: Adapted from community discussion — LeDarius3762

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 331. 856 questions available.