SY0-601 practice questions 351–360

1. Question 351 · 856 in bank

   A security analyst reviews web server logs and notices the following line:

   

   Which of the following vulnerabilities is the attacker trying to exploit?

   • ASSRF
   • BCSRF
   • CXSS
   • DSQLi

   Show answer

   Answer: D

   Explanation

   Never heard of this before...again this came from Pentest+ "Union Query SQL Injection This type of injection builds two or more SELECT() statements that already exist within the application to create a single result in the application response. This is often useful in getting information from parts of the database that are not designed to be exposed to part of the application that allows user interaction. To perform a successful UNION attack, both queries must return the same number of columns and the data types in each column have to match. Another way is to use NULLs in a UNION SELECT statement until you have enough to match the queries and the error condition stops." -Pentest+ All-in-one Certification PT0-002 by Heather Linn & Raymond Nutting

   Source: Adapted from community discussion — LeonardSnart

   Next question

2. Question 352 · 856 in bank

   A user is having network connectivity issues when working from a coffee shop. The user has used the coffee shop as a workspace for several months without any issues. None of the other customers at the coffee shop are experiencing these issues. A help desk analyst at the user's company reviews the following Wi-Fi log:

   

   Which of the following best describes what is causing this issue?

   • AAnother customer has configured a rogue access point.
   • BThe coffee shop network is using multiple frequencies.
   • CA denial-of-service attack by disassociation is occurring.
   • DAn evil twin access point is being utilized.

   Show answer

   Answer: C

   Explanation

   Just passed the exam with a score of 800 on 10/28/23. About 90% of the questions are from here. This question is on the exam.

   Source: Adapted from community discussion — JT4

   Next question

3. Question 353 · 856 in bank

   Which of the following is a physical security control that ensures only the authorized user is present when gaining access to a secured area?

   • AA biometric scanner
   • BA smart card reader
   • CA PKI token
   • DA PIN pad

   Show answer

   Answer: A

   Explanation

   Where's the Access Control Vestibule? This is the only way to ensure ONLY the authorized user is present when accessing the area. This should be the answer CompTIA :P

   Source: Adapted from community discussion — foxana

   Next question

4. Question 354 · 856 in bank

   During a forensic investigation, a security analyst discovered that the following command was run on a compromised host: crackmapexec smb 192.168.10.232 -u localadmin -H 0A3CE8D07A46E5C51070F03593E0A5E6 Which of the following attacks occurred?

   • ABuffer overflow
   • BPass the hash
   • CSQL injection
   • DReplay attack

   Show answer

   Answer: B

   Explanation

   The command "crackmapexec smb" is used to perform password attacks against SMB protocol, which is used for file and printer sharing on Windows-based networks. The "-u" option specifies the username, while the "-H" option specifies the password hash. Therefore, the command is attempting to use a password hash to authenticate as the local administrator on the host with IP address 192.168.10.232. Based on this, the attack that occurred is Pass the Hash. This attack technique involves stealing password hashes from compromised machines and using them to authenticate to other machines on the network without knowing the actual passwords.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 355 · 856 in bank

   A security analyst is investigating some users who are being redirected to a fake website that resembles www.comptia.org. The following output was found on the naming server of the organization:

   

   Which of the following attacks has taken place?

   • ADomain reputation
   • BDomain hijacking
   • CDisassociation
   • DDNS poisoning

   Show answer

   Answer: D

   Explanation

   DNS server cache poisoning aims to corrupt the records held by the DNS server itself. This can be accomplished by performing DoS against the server that holds the authorized records for the domain, and then spoofing replies to requests from other name servers. Another attack involves getting the victim name server to respond to a recursive query from the attacking host. A recursive query compels the DNS server to query the authoritative server for the answer on behalf of the client.

   Source: Adapted from community discussion — stoneface

   Next question

6. Question 356 · 856 in bank

   A company is moving to new location. The systems administrator has provided the following server room requirements to the facilities staff: • Consistent power levels in case of brownouts or voltage spikes • A minimum of 30 minutes runtime following a power outage • Ability to trigger graceful shutdowns of critical systems Which of the following would BEST meet the requirements?

   • AMaintaining a standby, gas-powered generator
   • BUsing large surge suppressors on computer equipment
   • CConfiguring managed PDUs to monitor power levels
   • DDeploying an appropriately sized, network-connected UPS device

   Show answer

   Answer: D

   Explanation

   Deploying an appropriately sized, network-connected UPS device would best meet the requirements as it can provide consistent power levels in case of brownouts or voltage spikes, a minimum of 30 minutes runtime following a power outage, and ability to trigger graceful shutdowns of critical systems. Surge suppressors may be used to protect computer equipment from power spikes, but do not provide power during an outage. A standby, gas-powered generator may provide power during an outage, but may not be cost-effective or efficient for the given requirements. Configuring managed PDUs to monitor power levels can help in monitoring power usage, but does not provide power during outages.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 357 · 856 in bank

   Which of the following would provide guidelines on how to label new network devices as part of the initial configuration?

   • AIP schema
   • BApplication baseline configuration
   • CStandard naming convention policy
   • DWireless LAN and network perimeter diagram

   Show answer

   Answer: C

   Explanation

   A Standard Naming Convention Policy would provide guidelines on how to label new network devices as part of the initial configuration. This policy outlines the rules and conventions for naming devices on a network to ensure consistency and ease of identification.

   Source: Adapted from community discussion — fouserd

   Next question

8. Question 358 · 856 in bank

   A systems engineer thinks a business system has been compromised and is being used to exfiltrate data to a competitor. The engineer contacts the CSIRT. The CSIRT tells the engineer to immediately disconnect the network cable and to not do anything else. Which of the following is the most likely reason for this request?

   • AThe CSIRT thinks an insider threat is attacking the network.
   • BOutages of business-critical systems cost too much money.
   • CThe CSIRT does not consider the systems engineer to be trustworthy.
   • DMemory contents, including fileless malware, are lost when the power is turned off.

   Show answer

   Answer: D

   Explanation

   Memory contents including files and malware are lost when the power is turned off. This is because memory is a volatile storage device that requires constant power to retain data. If a system has been compromised and is being used to exfiltrate data to a competitor, the CSIRT may want to preserve the memory contents for forensic analysis and evidence collection. Therefore, the CSIRT may tell the engineer to immediately disconnect the network cable and not do anything else to prevent further data loss or tampering. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://resources.infosecinstitute.com/topic/memory-acquisition-and-analysis/

   Source: Adapted from community discussion — ApplebeesWaiter1122

   References

   • comptia.org documentation
   • comptia.org documentation

   Next question

9. Question 359 · 856 in bank

   Which of the following best describes the situation where a successfully onboarded employee who is using a fingerprint reader is denied access at the company's main gate?

   • ACrossover error rate
   • BFalse match rate
   • CFalse rejection
   • DFalse positive

   Show answer

   Answer: C

   Explanation

   Speaker verification systems are evaluated using two types of errors—false rejection rate (FRR) and false acceptance rate (FAR). False rejection occurs when the system rejects a valid speaker, and false acceptance when the system accepts an imposter speaker.

   Source: Adapted from community discussion — mohamedhayya19

   Next question

10. Question 360 · 856 in bank

    Which of the following should customers who are involved with UI developer agreements be concerned with when considering the use of these products on highly sensitive projects?

    • AWeak configurations
    • BIntegration activities
    • CUnsecure user accounts
    • DOutsourced code development

    Show answer

    Answer: D

    Explanation

    I totally feel you mate, I am a non-English speaker, I think CompTIA meant below, Which one of the 4 multiple choices, should customers (who are involved with UI developer agreements) be concerned with when considering the use of these products (I don't know, what products they are talking about??) on highly sensitive projects? God knows, what CompTIA is thinking, while writing this question.

    Source: Adapted from community discussion — WinEH

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 351. 856 questions available.