SY0-601 practice questions 431–440

1. Question 431 · 856 in bank

   A technician is setting up a new firewall on a network segment to allow web traffic to the internet while hardening the network. After the firewall is configured, users receive errors stating the website could not be located. Which of the following would best correct the issue?

   • ASetting an explicit deny to all traffic using port 80 instead of 443
   • BMoving the implicit deny from the bottom of the rule set to the top
   • CConfiguring the first line in the rule set to allow all traffic
   • DEnsuring that port 53 has been explicitly allowed in the rule set

   Show answer

   Answer: D

   Explanation

   Port 53 is used for DNS (Domain Name System) traffic, which is essential for translating human-readable domain names into IP addresses that computers can understand. When users receive errors stating the website could not be located, it indicates a DNS resolution problem. This issue is likely caused by the firewall blocking DNS traffic (port 53) between the internal network and the internet. To correct the issue, the technician should ensure that port 53 (DNS) has been explicitly allowed in the firewall rule set to permit DNS traffic to pass through the firewall and enable proper name resolution for web browsing.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 432 · 856 in bank

   An organization has hired a red team to simulate attacks on its security posture. Which of the following will the blue team do after detecting an IoC?

   • AReimage the impacted workstations.
   • BActivate runbooks for incident response.
   • CConduct forensics on the compromised system.
   • DConduct passive reconnaissance to gather information.

   Show answer

   Answer: B

   Explanation

   What??? The whole point of having red team sims is to practice incident response? If your first move is forensics then the red team will own your whole network before you even know what is going on

   Source: Adapted from community discussion — daddylonglegs

   References

   • nist.gov documentation

   Next question

3. Question 433 · 856 in bank

   A systems administrator works for a local hospital and needs to ensure patient data is protected and secure. Which of the following data classifications should be used to secure patient data?

   • APrivate
   • BCritical
   • CSensitive
   • DPublic

   Show answer

   Answer: C

   Explanation

   In the context of securing patient data in a hospital setting, the most appropriate data classification to use is "Sensitive." Patient data is considered sensitive information that must be protected from unauthorized access, disclosure, or alteration. It often contains personally identifiable information (PII) and protected health information (PHI), which is subject to strict privacy regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States. Safeguarding sensitive data is crucial to maintaining patient privacy and complying with relevant data protection laws and regulations.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 434 · 856 in bank

   A small business uses kiosks on the sales floor to display product information for customers. A security team discovers the kiosks use end-of-life operating systems. Which of the following is the security team most likely to document as a security implication of the current architecture?

   • APatch availability
   • BProduct software compatibility
   • CEase of recovery
   • DCost of replacement

   Show answer

   Answer: A

   Explanation

   The security team is most likely to document "Patch availability" as a security implication of the current architecture. End-of-life operating systems are no longer supported by the vendor, which means they do not receive regular security updates or patches. This lack of patch availability leaves the kiosks vulnerable to known and potentially exploitable security vulnerabilities. Attackers can target these vulnerabilities to compromise the kiosks and gain unauthorized access to the systems or customer information. It is crucial for the security team to highlight the risk associated with using end-of-life operating systems and recommend upgrading to a supported and more secure operating system to mitigate potential security threats.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 435 · 856 in bank

   During a security incident, the security operations team identified sustained network traffic from a malicious IP address: 10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization's network. Which of the following fulfills this request?

   • Aaccess-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
   • Baccess-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
   • Caccess-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
   • Daccess-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32

   Show answer

   Answer: B

   Explanation

   The correct firewall rule to block the malicious IP address 10.1.4.9 from accessing the organization's network is: B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0 In this rule, the source IP address 10.1.4.9 is denied access to any destination IP address (0.0.0.0/0) in the organization's network. This effectively blocks the malicious IP address from accessing any resources within the network.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 436 · 856 in bank

   Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?

   • APreparation
   • BRecovery
   • CLessons learned
   • DAnalysis

   Show answer

   Answer: A

   Explanation

   During the "Preparation" phase of the incident response process, roles and responsibilities are defined, and the incident response plan is developed. This includes identifying and assigning specific roles to team members, establishing communication channels, and clarifying responsibilities for each member of the incident response team. This phase ensures that everyone involved in incident response knows their duties and is prepared to respond effectively when an incident occurs.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 437 · 856 in bank

   An administrator is reviewing a single server's security logs and discovers the following:

   

   Which of the following best describes the action captured in this log file?

   • ABrute-force attack
   • BPrivilege escalation
   • CFailed password audit
   • DForgotten password by the user

   Show answer

   Answer: A

   Explanation

   A brute force attack is a type of cyberattack in which an attacker systematically tries all possible combinations of passwords or encryption keys until the correct one is found. It is a straightforward and time-consuming attack method that relies on the attacker's ability to repeatedly attempt different combinations until the correct one is guessed.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

8. Question 438 · 856 in bank

   Which of the following can be used to identify potential attacker activities without affecting production servers?

   • AHoneypot
   • BVideo surveillance
   • CZero trust
   • DGeofencing

   Show answer

   Answer: A

   Explanation

   A honeypot is a cybersecurity strategy used to identify potential attacker activities without affecting production servers. It involves setting up a decoy system or network with the appearance of being a valuable target to attackers. The honeypot is designed to attract and lure attackers, allowing security teams to monitor their actions, study their techniques, and gather information about their tactics without putting the actual production environment at risk. By analyzing the activities of attackers on the honeypot, security professionals can gain insights into potential threats, vulnerabilities, and attack patterns. It provides an opportunity to detect and understand new and emerging threats before they impact the organization's critical systems and data.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 439 · 856 in bank

   A company wants the ability to restrict web access and monitor the websites that employees visit. Which of the following would best meet these requirements?

   • AInternet proxy
   • BVPN
   • CWAF
   • DFirewall

   Show answer

   Answer: A

   Explanation

   For those wondering why it is not WAF, i rationalise it as the following: WAF defends against malicious incoming requests/traffic which is not the case here. The company does not have the web servers of websites employees visit on the internet so WAF is not the right defense mechanism.

   Source: Adapted from community discussion — je123

   Next question

10. Question 440 · 856 in bank

    A security analyst notices an unusual amount of traffic hitting the edge of the network. Upon examining the logs, the analyst identifies a source IP address and blocks that address from communicating with the network. Even though the analyst is blocking this address, the attack is still ongoing and coming from a large number of different source IP addresses. Which of the following describes this type of attack?

    • ADDoS
    • BPrivilege escalation
    • CDNS poisoning
    • DBuffer overflow

    Show answer

    Answer: A

    Explanation

    The scenario described in the question is indicative of a Distributed Denial of Service (DDoS) attack. In a DDoS attack, the attacker floods a target system or network with a massive amount of traffic, overwhelming its resources and causing services to become unavailable to legitimate users. In this case, the security analyst identified and blocked a specific source IP address involved in the attack, but the attack is still ongoing from multiple other source IP addresses. DDoS attacks typically involve a large number of compromised or maliciously controlled devices (such as botnets) that are distributed across various locations, making it difficult to stop the attack by simply blocking individual sources.

    Source: Adapted from community discussion — ApplebeesWaiter1122

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 431. 856 questions available.