SY0-601 practice questions 391–400

1. Question 391 · 856 in bank

   A security investigation revealed that malicious software was installed on a server using a server administrator's credentials. During the investigation, the server administrator explained that Telnet was regularly used to log in. Which of the following most likely occurred?

   • AA spraying attack was used to determine which credentials to use
   • BA packet capture tool was used to steal the password
   • CA remote-access Trojan was used to install the malware
   • DA dictionary attack was used to log in as the server administrator

   Show answer

   Answer: B

   Explanation

   In this scenario, it is most likely that B. A packet capture tool was used to steal the password. Telnet is an unencrypted protocol that sends data, including login credentials, in clear text over the network. This means that anyone with access to the network traffic can use a packet capture tool to intercept and read the login credentials. In this case, an attacker could have used a packet capture tool to steal the server administrator’s password and then used it to log in and install the malicious software on the server.

   Source: Adapted from community discussion — fouserd

   Next question

2. Question 392 · 856 in bank

   Which of the following roles would most likely have direct access to the senior management team?

   • AData custodian
   • BData owner
   • CData protection officer
   • DData controller

   Show answer

   Answer: C

   Explanation

   C. Data protection officer is the role that is most likely to have direct access to the senior management team. A data protection officer (DPO) is a role established under the General Data Protection Regulation (GDPR) and is responsible for ensuring that an organization complies with data protection laws and regulations. The DPO is required to report to senior management and has direct access to them to ensure that data protection policies and procedures are followed and that the organization is in compliance with applicable regulations. The data custodian is responsible for the storage, maintenance, and protection of data, but typically does not have direct access to senior management. The data owner is responsible for the data itself, including determining who has access to it, but also does not necessarily have direct access to senior management. The data controller is responsible for ensuring that data is processed in compliance with applicable laws and regulations, but may not have direct access to senior management in all organizations.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 393 · 856 in bank

   Stakeholders at an organization must be kept aware of any incidents and receive updates on status changes as they occur. Which of the following plans would fulfill this requirement?

   • ACommunication plan
   • BDisaster recovery plan
   • CBusiness continuity plan
   • DRisk plan

   Show answer

   Answer: A

   Explanation

   A- A communication plan is the plan that would fulfill the requirement of keeping stakeholders at an organization aware of any incidents and receive updates on status changes as they occur. A communication plan is a document that outlines the procedures for communicating with internal and external stakeholders in the event of an incident, crisis, or other event that requires communication. The plan defines the roles and responsibilities of individuals and teams involved in the communication process, the methods of communication that will be used, and the timing and frequency of communication. The plan also includes contact information for key stakeholders and outlines the criteria for determining when communication is necessary.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 394 · 856 in bank

   An employee who is using a mobile device for work, is required to use a fingerprint to unlock the device. Which of the following is this an example of?

   • ASomething you know
   • BSomething you are
   • CSomething you have
   • DSomewhere you are

   Show answer

   Answer: B

   Explanation

   B- This is an example of "something you are". The use of a fingerprint to unlock a mobile device is a biometric authentication method that relies on unique physical characteristics of the user, in this case, their fingerprint. Biometric authentication falls under the category of "something you are" factor of authentication. The other factors of authentication are "something you know", such as a password or PIN, "something you have", such as a security token or smart card, and "somewhere you are", such as a location-based authentication.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 395 · 856 in bank

   Which of the following security controls can be used to prevent multiple people from using a unique card swipe and being admitted to a secure entrance?

   • AVisitor logs
   • BFaraday cages
   • CAccess control vestibules
   • DMotion detection sensors

   Show answer

   Answer: C

   Explanation

   C. Access control vestibules can be used to prevent multiple people from using a unique card swipe and being admitted to a secure entrance. An access control vestibule is a physical security measure that creates a buffer space between the exterior and interior of a building. It is typically a small room or hallway that has two doors: one leading to the outside and one leading to the inside of the building. To enter the building, a person must first swipe their access card to unlock the first door, and then wait for it to close before swiping the card again to unlock the second door. By requiring individuals to swipe their access card twice, access control vestibules prevent multiple people from entering the building using a single access card swipe. This helps to ensure that only authorized individuals are granted access to the secure entrance. Additionally, access control vestibules can be equipped with other security controls, such as cameras and intercoms, to enhance security and surveillance.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 396 · 856 in bank

   Unauthorized devices have been detected on the internal network. The devices' locations were traced to Ethernet ports located in conference rooms. Which of the following would be the best technical controls to implement to prevent these devices from accessing the internal network?

   • ANAC
   • BDLP
   • CIDS
   • DMFA

   Show answer

   Answer: A

   Explanation

   A- Network Access Control (NAC) would be the best technical control to implement to prevent unauthorized devices from accessing the internal network via Ethernet ports located in conference rooms. NAC is a security solution that controls access to network resources based on the user's identity, device, and security posture. It verifies that the device attempting to connect to the network complies with security policies and meets certain security standards. If the device does not meet the requirements, access is denied or limited. By implementing NAC, the organization can ensure that only authorized devices are allowed to connect to the network through the Ethernet ports in conference rooms. NAC can authenticate devices and users, check their security posture, and apply network access policies based on the results of the authentication and security checks. This can help prevent unauthorized access and potential security breaches caused by rogue devices.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 397 · 856 in bank

   A Chief Information Security Officer (CISO) wants to implement a new solution that can protect against certain categories of websites whether the employee is in the office or away. Which of the following solutions should the CISO implement?

   • AWAF
   • BSWG
   • CVPN
   • DHIDS

   Show answer

   Answer: B

   Explanation

   For those who have the same confusion as i did regarding WAF vs SWG, this is how i rationalised: WAF primarily focuses on protecting the web application against application layer attacks (SQLi,XSS,CSRF,SSRF etc), not controlling or filtering access to external websites based on categories. Secure Web Gateway (SWG) on the other hand, are specifically designed to enforce web access policies and control what websites users can access.

   Source: Adapted from community discussion — je123

   Next question

8. Question 398 · 856 in bank

   A security analyst is using OSINT to gather information to verify whether company data is available publicly. Which of the following is the best application for the analyst to use?

   • AtheHarvester
   • BCuckoo
   • CNmap
   • DNessus

   Show answer

   Answer: A

   Explanation

   OSINT stands for Open Source Intelligence and refers to the practice of collecting information from published or otherwise publicly available sources. OSINT tools are utilities that either seek out information from public sources or organize that data into a meaningful format that identifies deeper information in the form of a collection than can be gleaned from individual data instances. In this context, theHarvester would be the best application for the analyst to use as it is an OSINT tool designed to gather information about company data that may be available publicly.

   Source: Adapted from community discussion — fouserd

   Next question

9. Question 399 · 856 in bank

   An organization wants to participate in threat intelligence information sharing with peer groups. Which of the following would MOST likely meet the organization's requirement?

   • APerform OSINT investigations.
   • BSubscribe to threat intelligence feeds.
   • CSubmit RFCs.
   • DImplement a TAXII server.

   Show answer

   Answer: D

   Explanation

   A TAXII server is a client that exchanges standardized and anonymized cyber threat intelligence among users. It works as a venue for sharing and collecting Indicators of compromise, which have been anonymized to protect privacy.

   Source: Adapted from community discussion — Boogie_79

   Next question

10. Question 400 · 856 in bank

    A network engineer receives a call regarding multiple LAN-connected devices that are on the same switch. The devices have suddenly been experiencing speed and latency issues while connecting to network resources. The engineer enters the command show mac address-table and reviews the following output:

    

    Which of the following best describes the attack that is currently in progress'?

    • AMAC flooding
    • BEvil twin
    • CARP poisoning
    • DDHCP spoofing

    Show answer

    Answer: A

    Explanation

    Both A and C could be plausible answers given different circumstances. In the context of the question, MAC flooding seems more likely for a few reasons. In a MAC flooding attack, the attacker tries to overwhelm the switch's MAC address table with many different MAC addresses, often fake or spoofed, in an attempt to make the switch behave like a hub and broadcast all traffic. In the output provided, we see a single MAC address (00-04-18-EB-14-30) appearing on two different ports, which could be an indication of such an attack. ARP poisoning, on the other hand, involves sending spoofed ARP messages over a local area network. This could also be a possibility, but the question does not provide direct evidence of this. In an ARP poisoning attack, we would expect to see MACs associated with IPs they shouldn't be, but the output provided doesn't include any IP addresses, so it's difficult to identify ARP poisoning based on the information given. Given these considerations, the evidence provided in the question makes A (MAC flooding) a more likely answer.

    Source: Adapted from community discussion — justauser

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 391. 856 questions available.