SY0-601 practice questions 361–370

1. Question 361 · 856 in bank

   Which of the following identifies the point in time when an organization will recover data in the event of an outage?

   • AALE
   • BRPO
   • CMTBF
   • DARO

   Show answer

   Answer: B

   Explanation

   The point in time when an organization will recover data in the event of an outage is identified by the Recovery Point Objective (RPO). RPO is a metric that represents the maximum amount of data loss that an organization is willing to accept in the event of an outage. It specifies the point in time to which an organization must recover its data in order to resume business operations with acceptable data loss. For example, if an organization's RPO is 4 hours, then in the event of an outage, the organization must be able to recover its data to a point no more than 4 hours prior to the outage. This means that any data created or modified within the last 4 hours may be lost in the event of an outage. Other metrics listed in the question are: Annual Loss Expectancy (ALE) is the expected monetary loss from a risk in a year. Mean Time Between Failures (MTBF) is the average time between two failures of a system. Annualized Rate of Occurrence (ARO) is the estimated number of times a risk will occur in a year.

   Source: Adapted from community discussion — mouettespaghetti

   Next question

2. Question 362 · 856 in bank

   A police department is using the cloud to share information with city officials. Which of the following cloud models describes this scenario?

   • AHybrid
   • BPrivate
   • CPublic
   • DCommunity

   Show answer

   Answer: D

   Explanation

   -D The cloud model that describes the scenario where a police department is using the cloud to share information with city officials is the Community Cloud model. The Community Cloud model is a cloud infrastructure that is shared among organizations with similar interests, concerns or mission. In this model, the cloud infrastructure is used by a group of organizations to share information, resources, and services to achieve common goals.

   Source: Adapted from community discussion — mouettespaghetti

   Next question

3. Question 363 · 856 in bank

   A user reports that a bank’s website no longer displays a padlock symbol. A security analyst views the user's screen and notices the connection is using HTTP instead of HTTPS. Which of the following attacks is most likely occurring?

   • AMemory leak
   • BSSL stripping
   • CAPI
   • DPass the hash

   Show answer

   Answer: B

   Explanation

   SSL stripping is an attack that downgrades HTTPS connections to insecure HTTP connections. When an attacker is able to intercept network traffic between a client and server, they can remove the SSL/TLS encryption from the HTTPS connection and replace it with a plain HTTP connection, which does not provide any security for the user's sensitive data. This can be achieved through a number of techniques, such as man-in-the-middle (MITM) attacks or by using malicious software. When SSL stripping is successful, the padlock symbol indicating a secure HTTPS connection will not be displayed, as in the scenario described in the question.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 364 · 856 in bank

   A data center has experienced an increase in under-voltage events following electrical grid maintenance outside the facility. These events are leading to occasional losses of system availability. Which of the following would be the most cost-effective solution for the data center to implement?

   • AUninterruptible power supplies with battery backup
   • BManaged power distribution units to track these events
   • CA generator to ensure consistent, normalized power delivery
   • DDual power supplies to distribute the load more evenly

   Show answer

   Answer: A

   Explanation

   Uninterruptible power supplies with battery backup would be the most cost-effective solution for the data center to implement in order to deal with the increase in under-voltage events and occasional losses of system availability. The battery backup would provide short-term power during an outage or under-voltage event until power is restored or a generator is started. While managed power distribution units, a generator, and dual power supplies are all potential solutions, they are likely to be more expensive and may not be as effective in addressing under-voltage events.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 365 · 856 in bank

   A security architect is designing a remote access solution for a business partner. The business partner needs to access one Linux server at the company. The business partner wants to avoid managing a password for authentication and additional software installation. Which of the following should the architect recommend?

   • ASoft token
   • BSmart card
   • CCSR
   • DSSH key

   Show answer

   Answer: D

   Explanation

   D- An SSH key is an access credential in the SSH protocol. Its function is similar to that of user names and passwords, but the keys are primarily used for automated processes and for implementing single sign-on by system administrators and power users.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 366 · 856 in bank

   Which of the following describes the continuous delivery software development methodology?

   • AWaterfall
   • BSpiral
   • CV-shaped
   • DAgile

   Show answer

   Answer: D

   Explanation

   Answer: Agile Agile methodology is a way to manage a project by breaking it up into several phases. It involves constant collaboration with stakeholders and continuous improvement at every stage. Once the work begins, teams cycle through a process of planning, executing, and evaluating. ======================================= Helpful Info: Waterfall - A sequential development process that flows like a waterfall through all phases of a project (analysis, design, development, and testing, for example), with each phase completely wrapping up before the next phase begins.

   Source: Adapted from community discussion — rodwave

   Next question

7. Question 367 · 856 in bank

   A security analyst is assisting a team of developers with best practices for coding. The security analyst would like to defend against the use of SQL injection attacks. Which of the following should the security analyst recommend first?

   • ATokenization
   • BInput validation
   • CCode signing
   • DSecure cookies

   Show answer

   Answer: B

   Explanation

   B- A common source of SQL injection is maliciously crafted external input. As such, it's always a good practice to only accept approved input—an approach known as input validation. To protect against it, there are two variants of input validation: avoid list validation and preferlist validation.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

8. Question 368 · 856 in bank

   Cloud security engineers are planning to allow and deny access to specific features in order to increase data security. Which of the following cloud features is the most appropriate to ensure access is granted properly?

   • AAPI integrations
   • BAuditing
   • CResource policies
   • DVirtual networks

   Show answer

   Answer: C

   Explanation

   -C The most appropriate cloud feature to ensure access is granted properly is resource policies. Resource policies are a powerful tool for managing access to cloud resources. They allow cloud security engineers to specify permissions and restrictions at a granular level, controlling access to specific resources or actions within the cloud environment. By using resource policies, cloud security engineers can implement a fine-grained access control system that can help prevent unauthorized access to sensitive data. API integrations (option A) are used to connect different cloud services and applications, but they are not directly related to managing access to cloud resources. Auditing (option B) is used to track changes and access to cloud resources, but it does not directly control access to those resources. Virtual networks (option D) are used to isolate and secure network traffic within the cloud environment, but they are not directly related to managing access to cloud resources.

   Source: Adapted from community discussion — mouettespaghetti

   Next question

9. Question 369 · 856 in bank

   A security operations technician is searching the log named /var/messages for any events that were associated with a workstation with the IP address 10.1.1.1. Which of the following would provide this information?

   • Acat /var/messages | grep 10.1.1.1
   • Bgrep 10.1.1.1 | cat /var/messages
   • Cgrep /var/messages | cat 10.1.1.1
   • Dcat 10.1.1.1 | grep /var/messages

   Show answer

   Answer: A

   Explanation

   A. is indeed correct but if you don't want to look dumb just use grep command, cat is not needed : ' grep "10.1.1.1" /var/messages '

   Source: Adapted from community discussion — [Removed]

   Next question

10. Question 370 · 856 in bank

    A security analyst is investigating a report from a penetration test. During the penetration test, consultants were able to download sensitive data from a back-end server. The back-end server was exposing an API that should have only been available from the company's mobile application. After reviewing the back-end server logs, the security analyst finds the following entries:

    

    Which of the following is the most likely cause of the security control bypass?

    • AIP address allow list
    • BUser-agent spoofing
    • CWAF bypass
    • DReferrer manipulation

    Show answer

    Answer: B

    Explanation

    This question was on the exam fyi. I passed today with a 751 after failing the first time with a 722. These are a help resource

    Source: Adapted from community discussion — krayxay

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 361. 856 questions available.