SY0-601 practice questions 441–450

1. Question 441 · 856 in bank

   A company needs to centralize its logs to create a baseline and have visibility on its security events. Which of the following technologies will accomplish this objective?

   • ASecurity information and event management
   • BA web application firewall
   • CA vulnerability scanner
   • DA next-generation firewall

   Show answer

   Answer: A

   Explanation

   Security information and event management (SIEM) is the technology that will accomplish the objective of centralizing logs to create a baseline and gain visibility on security events. SIEM is a comprehensive approach to security management that involves the collection, aggregation, analysis, and correlation of log data from various sources throughout an organization's IT infrastructure. It allows security teams to monitor, detect, and respond to security incidents effectively. A SIEM system can collect log data from various sources, such as firewalls, network devices, servers, applications, and endpoints, and then normalize and correlate this data to provide a centralized view of security events and activities. It can help identify suspicious or anomalous behavior, detect security incidents, and provide real-time alerts for potential threats.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 442 · 856 in bank

   Two organizations are discussing a possible merger. Both organizations' Chief Financial Officers would like to safely share payroll data with each other to determine if the pay scales for different roles are similar at both organizations. Which of the following techniques would be best to protect employee data while allowing the companies to successfully share this information?

   • APseudo-anonymization
   • BTokenization
   • CData masking
   • DEncryption

   Show answer

   Answer: A

   Explanation

   My thinking: Pseudo-anonymization specifically replaces PII, but keeps everything else the same, so comparisons can be made on the real data that matters. Tokenization replaces the data with random strings, so no comparisons can be done. Data masking makes the values fictitious, so the comparisons would be inaccurate. Developers just need data, fictitious or not, so masking works for them.

   Source: Adapted from community discussion — MrKyle

   Next question

3. Question 443 · 856 in bank

   A security analyst is reviewing application logs to determine the source of a breach and locates the following log: https://www.comptia.com/login.php?id='%20or%20'1'1='1 Which of the following has been observed?

   • ADLL Injection
   • BAPI attack
   • CSQLi
   • DXSS

   Show answer

   Answer: C

   Explanation

   SQLi (SQL injection) has been observed. SQL injection is a type of cyber attack that involves injecting malicious code into a database through a vulnerable web application. The malicious code is typically designed to manipulate or extract data from the database, allowing the attacker to gain unauthorized access to sensitive information. The log provided in the question appears to be a URL for a login page, with a string of text appended to the end. This string includes the text "or '1'1='1", which is a common syntax used in SQL injection attacks. This indicates that an SQL injection attack may have been attempted or successfully carried out against the website.

   Source: Adapted from community discussion — Proctored_Expert

   Next question

4. Question 444 · 856 in bank

   An amusement park is implementing a biometric system that validates customers' fingerprints to ensure they are not sharing tickets. The park's owner values customers above all and would prefer customers' convenience over security. For this reason, which of the following features should the security team prioritize FIRST?

   • ALow FAR
   • BLow efficacy
   • CLow FRR
   • DLow CER

   Show answer

   Answer: C

   Explanation

   Answer: Low FRR There are two main metrics that are used to determine the performance of biometrics: 1. FAR (False Acceptance Rate) 2. FRR (False Rejection Rate) False Acceptance Rate (FAR) is a metric for bio-metric performance that determines the number of instances where unauthorized persons were incorrectly authorized. False Rejection Rate (FRR) is a metric that determines the number of instances where an authorized person are incorrectly rejected. If the emphasis is security, then making sure the False Acceptance Rate is low as a low FAR rate means a lower possibility for someone to be authorized who shouldn't. If the emphasis is convenience, then you'd want to make sure the False Rejection Rate is low as a low FRR means a lower possibility for someone to be rejected who should be authorized.

   Source: Adapted from community discussion — rodwave

   Next question

5. Question 445 · 856 in bank

   A large retail store's network was breached recently, and this news was made public. The store did not lose any intellectual property, and no customer information was stolen. Although no fines were incurred as a result, the store lost revenue after the breach. Which of the following is the most likely reason for this issue?

   • AEmployee training
   • BLeadership changes
   • CReputation damage
   • DIdentity theft

   Show answer

   Answer: C

   Explanation

   The most likely reason for the retail store's revenue loss after the breach is C. Reputation damage. Even though no intellectual property or customer information was stolen, the fact that the breach became public knowledge could have significantly damaged the store's reputation. Customers may lose trust in the store's ability to protect their data and personal information, leading to a decline in sales and customer loyalty. A damaged reputation can result in negative publicity, reduced customer confidence, and a decrease in the store's overall market value, all of which can impact the company's revenue and profitability.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 446 · 856 in bank

   A government organization is developing an advanced Al defense system. Developers are using information collected from third-party providers. Analysts are noticing inconsistencies in the expected progress of the Al learning and attribute the outcome to a recent attack on one of the suppliers. Which of the following is the most likely reason for the inaccuracy of the system?

   • AImproper algorithms security
   • BTainted training data
   • CFileless virus
   • DCryptomalware

   Show answer

   Answer: B

   Explanation

   The most likely reason for the inaccuracy of the advanced AI defense system is B. Tainted training data. Tainted training data refers to the situation where the data used to train the AI system is corrupted or influenced by malicious actors. In this case, the third-party providers might have provided data that was compromised or manipulated by attackers, leading to inconsistencies in the expected progress of the AI learning. If the training data contains incorrect or malicious information, the AI system's ability to accurately detect and defend against threats can be compromised. This is a common challenge in AI development, and ensuring the integrity and security of the training data is crucial to building effective AI defense systems.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 447 · 856 in bank

   A company's help desk has received calls about the wireless network being down and users being unable to connect to it. The network administrator says all access points are up and running. One of the help desk technicians notices the affected users are working in a building near the parking lot. Which of the following is the most likely reason for the outage?

   • ASomeone near the building is jamming the signal.
   • BA user has set up a rogue access point near the building.
   • CSomeone set up an evil twin access point in the affected area.
   • DThe APs in the affected area have been unplugged from the network.

   Show answer

   Answer: A

   Explanation

   The most likely reason for the wireless network outage in the affected building near the parking lot is that someone is jamming the wireless signal. Jamming is a deliberate attempt to disrupt wireless communication by transmitting interference on the same frequency as the wireless network, causing the access points and clients to experience connectivity issues. Jamming can be carried out using various devices that emit radio frequency signals, interfering with the normal operation of wireless devices. This interference prevents legitimate users from connecting to the wireless network and disrupts the communication between access points and clients.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

8. Question 448 · 856 in bank

   Which of the following can best protect against an employee inadvertently installing malware on a company system?

   • AHost-based firewall
   • BSystem isolation
   • CLeast privilege
   • DApplication allow list

   Show answer

   Answer: D

   Explanation

   D. Application allow list CompTIA Security+ emphasizes the importance of application control and whitelisting as a strong security practice. An application allow list ensures that only approved and authorized applications can run on a system, effectively preventing the execution of unauthorized or potentially malicious software. This practice aligns with the principle of minimizing attack surfaces and reducing the risk of malware infections caused by inadvertently installing unapproved software. While the principle of least privilege (Option C) is also an important security principle, it focuses on restricting user permissions to the minimum necessary level. Application allow lists provide more direct protection against unauthorized software execution in the context of malware prevention.

   Source: Adapted from community discussion — Chillbuddy

   Next question

9. Question 449 · 856 in bank

   Select 2

   An information security officer at a credit card transaction company is conducting a framework-mapping exercise with the internal controls. The company recently established a new office in Europe. To which of the following frameworks should the security officer map the existing controls? (Choose two.)

   • AISO
   • BPCIDSS
   • CSOC
   • DGDPR
   • ECSA
   • FNIST

   Show answer

   Answer: BD

   Explanation

   B. PCIDSS (Payment Card Industry Data Security Standard): If the credit card transaction company processes credit card payments, compliance with PCI DSS is essential. This framework sets the security standards for protecting cardholder data, and mapping controls to PCI DSS helps ensure the company's payment processing operations are secure and compliant. D. GDPR (General Data Protection Regulation): This framework is essential when the company establishes an office in Europe since it governs the protection of personal data of EU citizens. Compliance with GDPR is crucial to ensure the company handles customer data appropriately and adheres to European data protection laws.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

10. Question 450 · 856 in bank

    A customer called a company's security team to report that all invoices the customer has received over the last five days from the company appear to have fraudulent banking details. An investigation into the matter reveals the following: • The manager of the accounts payable department is using the same password across multiple external websites and the corporate account. • One of the websites the manager used recently experienced a data breach. • The manager's corporate email account was successfully accessed in the last five days by an IP address located in a foreign country. Which of the following attacks has most likely been used to compromise the manager's corporate account?

    • ARemote access Trojan
    • BBrute-force
    • CDictionary
    • DCredential stuffing
    • EPassword spraying

    Show answer

    Answer: D

    Explanation

    "Credential stuffing is a type of cyberattack in which the attacker collects stolen account credentials, typically consisting of lists of usernames or email addresses and the corresponding passwords (often from a data breach), and then uses the credentials to gain unauthorized access to user accounts"

    Source: Adapted from community discussion — CastratedMonk

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 441. 856 questions available.