SY0-601 practice questions 381–390

1. Question 381 · 856 in bank

   A cybersecurity analyst at Company A is working to establish a secure communication channel with a counterpart at Company B, which is 3,000 miles (4,828 kilometers) away. Which of the following concepts would help the analyst meet this goal in a secure manner?

   • ADigital signatures
   • BKey exchange
   • CSalting
   • DPPTP

   Show answer

   Answer: B

   Explanation

   Key exchange (also key establishment) is a method in cryptography by which cryptographic keys are exchanged between two parties, allowing use of a cryptographic algorithm. If the sender and receiver wish to exchange encrypted messages, each must be equipped to encrypt messages to be sent and decrypt messages received. The nature of the equipping they require depends on the encryption technique they might use. If they use a code, both will require a copy of the same codebook. If they use a cipher, they will need appropriate keys. If the cipher is a symmetric key cipher, both will need a copy of the same key. If it is an asymmetric key cipher with the public/private key property, both will need the other's public key.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 382 · 856 in bank

   A security analyst is reviewing computer logs because a host was compromised by malware. After the computer was infected it displayed an error screen and shut down. Which of the following should the analyst review first to determine more information?

   • ADump file
   • BSystem log
   • CWeb application log
   • DSecurity log

   Show answer

   Answer: A

   Explanation

   A dump file is the first thing that a security analyst should review to determine more information about a compromised device that displayed an error screen and shut down. A dump file is a file that contains a snapshot of the memory contents of a device at the time of a system crash or error. A dump file can help a security analyst analyze the cause and source of the crash or error, as well as identify any malicious code or activity that may have triggered it. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/introduction-to-crash-dump-files

   Source: Adapted from community discussion — Jacksoms

   References

   • comptia.org documentation
   • comptia.org documentation
   • Microsoft Learn

   Next question

3. Question 383 · 856 in bank

   A security architect is working on an email solution that will send sensitive data. However, funds are not currently available in the budget for building additional infrastructure. Which of the following should the architect choose?

   • APOP
   • BIPSec
   • CIMAP
   • DPGP

   Show answer

   Answer: D

   Explanation

   PGP is short for Pretty Good Privacy, a security program that enables users to communicate securely by decrypting and encrypting messages, authenticating messages through digital signatures, and encrypting files. It was one of the first freely available forms of public-key cryptography software.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 384 · 856 in bank

   A user reset the password for a laptop but has been unable to log in to it since then. In addition, several unauthorized emails were sent on the user’s behalf recently. The security team investigates the issue and identifies the following findings: • Firewall logs show excessive traffic from the laptop to an external site. • Unknown processes were running on the laptop. • RDP connections that appeared to be authorized were made to other network devices from the laptop. • High bandwidth utilization alerts from that user's username. Which of the following is most likely installed on the laptop?

   • AWorm
   • BKeylogger
   • CTrojan
   • DLogic bomb

   Show answer

   Answer: C

   Explanation

   CHANGING MY ANSWER TO C A Trojan is a type of malware that disguises itself as legitimate software to gain access to a system and carry out malicious activities. The firewall logs show excessive traffic from the laptop to an external site, indicating that the laptop is communicating with a remote server or command and control center. The presence of unknown processes and unauthorized RDP connections also suggest that the laptop has been compromised and is being controlled by an attacker. A keylogger is a type of malware that records keystrokes, while a worm is a self-replicating malware that spreads through a network. A logic bomb is a type of malware that is triggered by a specific event or condition. While these types of malware may also be present on the laptop, they are less likely to explain the symptoms described in the scenario. My Pen Tester friend also agrees it is C

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 385 · 856 in bank

   Select 2

   A systems administrator is required to enforce MFA for corporate email account access, relying on the possession factor. Which of the following authentication methods should the systems administrator choose? (Choose two.)

   • APassphrase
   • BTime-based one-time password
   • CFacial recognition
   • DRetina scan
   • EHardware token
   • FFingerprints

   Show answer

   Answer: BE

   Explanation

   The question only specifies "possession," so we should be thinking about 'something you have.' Answers C, D, and F are all 'something you are,' so those are out. B and E are both 'something you have.' Even though the question specifies that MFA is being implemented, we are not asked to determine the scope of the MFA -- it only mentions possession. The question doesn't mention 'something you know' just like it doesn't mention 'something you are.' Based on that deduction, I am inclined to rule out A on the same basis for ruling out C, D, and E. If i am wrong and we are supposed to outline the full scope of the MFA, why would we select 'something you know' (answer A) over 'something you are' (C, D, F) when there is no mention of either in the question?

   Source: Adapted from community discussion — slapster

   Next question

6. Question 386 · 856 in bank

   Which of the following best describes a technique that compensates researchers for finding vulnerabilities?

   • APenetration testing
   • BCode review
   • CWardriving
   • DBug bounty

   Show answer

   Answer: D

   Explanation

   I wish all Comptia questions were like this. Bug bounty is the technique that compensates researchers for finding vulnerabilities. It is a program offered by companies, organizations, or software developers to incentivize ethical hackers or security researchers to find and report vulnerabilities in their systems, products, or services. The bug bounty program specifies the types of vulnerabilities that are eligible, the rewards for finding and reporting them, and the rules and guidelines that the researchers must follow. Bug bounty programs are becoming increasingly popular as a way to improve the security of software and systems and to reduce the risk of cyber attacks.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 387 · 856 in bank

   Which of the following biometric authentication methods is the most accurate?

   • AGait
   • BRetina
   • CSignature
   • DVoice

   Show answer

   Answer: B

   Explanation

   Does anyone actually use gait analysis? I just imagine you hurt your leg and develop a limp and all the sudden can't get into work anymore.

   Source: Adapted from community discussion — rline63

   Next question

8. Question 388 · 856 in bank

   A company suspects that some corporate accounts were compromised. The number of suspicious logins from locations not recognized by the users is increasing. Employees who travel need their accounts protected without the risk of blocking legitimate login requests that may be made over new sign-in properties. Which of the following security controls can be implemented?

   • AEnforce MFA when an account request reaches a risk threshold.
   • BImplement geofencing to only allow access from headquarters.
   • CEnforce time-based login requests that align with business hours.
   • DShift the access control scheme to a discretionary access control.

   Show answer

   Answer: A

   Explanation

   Answer: Enforce MFA when an account request reaches a risk threshold. This is likely the most convenient implementation that would work for all employees as an additional element(s) would need to be needed for authentication/authorization. ======================== (B) - Implementing geofencing to only allow access from headquarters might stop the suspicious logins, however, it would be inconvenient for employees not physically located near headquarters such as the traveling employees. (C) Enforcing time-based login requests to align with business hours could also be inconvenient for traveling/global employees that work in different times compared the business's normal business hours. (D) With Discretionary access control, the owner of a resource can decide who can have access to the resource and you can modify the access at anytime. The option to shift the access control scheme to a discretionary access control wouldn't really address the login issue either if the account of someone who is authorized to access a resource was compromised. The attacker can still access the resource using their credentials.

   Source: Adapted from community discussion — rodwave

   Next question

9. Question 389 · 856 in bank

   A security team will be outsourcing several key functions to a third party and will require that: • Several of the functions will carry an audit burden • Attestations will be performed several times a year • Reports will be generated on a monthly basis Which of the following best describes the document that is used to define these requirements and stipulate how and when they are performed by the third party?

   • AMOU
   • BAUP
   • CSLA
   • DMSA

   Show answer

   Answer: C

   Explanation

   A service-level agreement (SLA) defines the level of service expected by a customer from a supplier, laying out the metrics by which that service is measured, and the remedies or penalties, if any, should the agreed-on service levels not be achieved

   Source: Adapted from community discussion — will305

   Next question

10. Question 390 · 856 in bank

    Select 3

    A small, local company experienced a ransomware attack. The company has one web-facing server and a few workstations. Everything is behind an ISP firewall. A single web-facing server is set up on the router to forward all polls so that the server is viewable from the internet. The company uses an older version of third-party software to manage the website. The assets were never patched. Which of the following should be done to prevent an attack like this from happening again? (Choose three.)

    • Ainstall DLP software to prevent data loss
    • BUse the latest version of software
    • CInstall a SIEM device
    • DImplement MDM
    • EImplement a screened subnet for the web server
    • FInstall an endpoint security solution
    • GUpdate the website certificate and revoke the existing ones
    • HDeploy additional network sensors

    Show answer

    Answer: BEF

    Explanation

    B. Use the latest version of software: The company should upgrade to the latest version of the third-party software that is used to manage the website. Older versions of software often have known vulnerabilities that can be exploited by attackers. Upgrading to the latest version can help ensure that the company is using software that has the latest security patches and fixes. E. Implement a screened subnet for the web server: The company should implement a screened subnet, also known as a DMZ (demilitarized zone), to separate the web-facing server from the internal network. This will provide an additional layer of security by limiting the potential attack surface and reducing the risk of lateral movement by attackers. F. Install an endpoint security solution: An endpoint security solution should be installed on all workstations to protect against malware and ransomware. This can include anti-virus software, host-based firewalls, and other endpoint security controls.

    Source: Adapted from community discussion — fouserd

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 381. 856 questions available.