SY0-601 practice questions 451–460

1. Question 451 · 856 in bank

   An organization's corporate offices were destroyed due to a natural disaster, so the organization is now setting up offices in a temporary work space. Which of the following will the organization most likely consult?

   • AThe business continuity plan
   • BThe risk management plan
   • CThe communication plan
   • DThe incident response plan

   Show answer

   Answer: A

   Explanation

   When an organization faces a disruptive event such as a natural disaster that impacts its normal operations, the business continuity plan (BCP) is the most likely plan to be consulted. The business continuity plan outlines the strategies, processes, and procedures that need to be followed to ensure essential business functions can continue or be rapidly resumed during and after the disaster or disruptive event. It addresses how the organization will recover and restore critical business operations and services in an alternative workspace or temporary location.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 452 · 856 in bank

   Security analysts notice a server login from a user who has been on vacation for two weeks. The analysts confirm that the user did not log in to the system while on vacation. After reviewing packet capture logs, the analysts notice the following:

   

   Which of the following occurred?

   • AA buffer overflow was exploited to gain unauthorized access.
   • BThe user’s account was compromised, and an attacker changed the login credentials.
   • CAn attacker used a pass-the-hash attack to gain access.
   • DAn insider threat with username smithJA logged in to the account.

   Show answer

   Answer: C

   Explanation

   A Pass-the-Hash (PtH) attack is a technique where an attacker captures a password hash (as opposed to the password characters) and then passes it through for authentication into a system.

   Source: Adapted from community discussion — JT4

   Next question

3. Question 453 · 856 in bank

   A security analyst is taking part in an evaluation process that analyzes and categorizes threat actors of real-world events in order to improve the incident response team's process. Which of the following is the analyst most likely participating in?

   • AMITRE ATT&CK
   • BWalk-through
   • CRed team
   • DPurple team
   • ETAXII

   Show answer

   Answer: A

   Explanation

   MITRE ATT&CK is a knowledge base that describes the actions and techniques used by threat actors during different stages of the cyberattack lifecycle. It is widely used in cybersecurity for threat intelligence, incident response, and identifying and categorizing the tactics, techniques, and procedures (TTPs) of real-world threat actors. In the given scenario, the analyst is likely participating in the process of analyzing and categorizing threat actors based on real-world events using the MITRE ATT&CK framework. This analysis helps improve the incident response team's understanding of various threat actors' behaviors and tactics, which, in turn, assists in enhancing the incident response process and overall cybersecurity posture.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 454 · 856 in bank

   A network manager wants to protect the company's VPN by multifactor authentication that uses: • Something you know • Something you have • Somewhere you are Which of the following would accomplish the manager's goal?

   • ADomain name. PKI, GeoIP lookup
   • BVPN IP address, company ID. partner site
   • CPassword, authentication token, thumbprint
   • DCompany URL, TLS certificate, home address

   Show answer

   Answer: C

   Explanation

   The "THUMBPRINT" does not meet the "somewhere you are" requirement. Do not confuse "something you are" with "somewhere you are"

   Source: Adapted from community discussion — RichMe

   Next question

5. Question 455 · 856 in bank

   Which of the following organizations sets frameworks and controls for optimal security configuration on systems?

   • AISO
   • BGDPR
   • CPCI DSS
   • DNIST

   Show answer

   Answer: D

   Explanation

   Both ISO and NIST have Frameworks for standards. when searching parts of the question "sets frameworks and controls for optimal security configuration" only NIST came up specifically. I personally hate these type of questions as I would utilize both to build from.

   Source: Adapted from community discussion — Tjank

   Next question

6. Question 456 · 856 in bank

   Which of the following terms should be included in a contract to help a company monitor the ongoing security maturity of a new vendor?

   • AA right-to-audit clause allowing for annual security audits
   • BRequirements for event logs to be kept for a minimum of 30 days
   • CIntegration of threat intelligence in the company's AV
   • DA data-breach clause requiring disclosure of significant data loss

   Show answer

   Answer: A

   Explanation

   The right-to-audit clause in a contract would enable the company to perform annual security audits on the vendor. This clause gives the company the ability to monitor the ongoing security practices and maturity of the vendor. By conducting security audits, the company can assess the vendor's compliance with security requirements, identify potential security risks, and ensure that the vendor is implementing appropriate security measures. This is a common practice to maintain oversight and ensure security alignment between the company and its vendors.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 457 · 856 in bank

   Which of the following cloud models provides clients with servers, storage, and networks but nothing else?

   • ASaaS
   • BPaaS
   • CIaaS
   • DDaaS

   Show answer

   Answer: C

   Explanation

   Passed the exam, Mar. 11, 2024. This was on the exam. Around 50% were from these questions. You should know the definition for concepts like data owner, controller, and so on.

   Source: Adapted from community discussion — pgarden007

   Next question

8. Question 458 · 856 in bank

   A marketing coordinator is trying to access a social media application on a company laptop but is getting blocked. The coordinator opens a help desk ticket to report the issue. Which of the following documents should a security analyst review to determine whether accessing social media applications on a company device is permitted?

   • AIncident response policy
   • BBusiness continuity policy
   • CChange management policy
   • DAcceptable use policy

   Show answer

   Answer: D

   Explanation

   The acceptable use policy (AUP) defines the rules and guidelines for using company resources, including computers, laptops, and other devices. It typically specifies what activities are allowed and prohibited on company devices, such as accessing social media applications. By reviewing the AUP, a security analyst can determine whether accessing social media applications on a company device is permitted or not.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 459 · 856 in bank

   Law enforcement officials sent a company a notification that states electronically stored information and paper documents cannot be destroyed. Which of the following explains this process?

   • AData breach notification
   • BAccountability
   • CLegal hold
   • DChain of custody

   Show answer

   Answer: C

   Explanation

   A legal hold is a process in which an organization is required to preserve all relevant electronically stored information (ESI) and paper documents that may be related to a pending or anticipated legal action. It is typically initiated by law enforcement or legal authorities when there is an investigation, lawsuit, or audit involving the organization. During a legal hold, the organization is prohibited from destroying or altering any potentially relevant data or documents to ensure that evidence is preserved and available for the legal process.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

10. Question 460 · 856 in bank

    A company wants to deploy decoy systems alongside production systems in order to entice threat actors and to learn more about attackers. Which of the following best describes these systems?

    • ADNS sinkholes
    • BHoneypots
    • CVirtual machines
    • DNeural networks

    Show answer

    Answer: B

    Explanation

    Honeypots are decoy systems or resources intentionally set up by an organization to attract and monitor unauthorized users, attackers, or malware. These systems are isolated from the production network and have no legitimate purpose, making any activity on them highly suspicious. The primary goal of honeypots is to gather information about the tactics, techniques, and procedures used by attackers and to learn more about their motives and potential threats to the organization.

    Source: Adapted from community discussion — ApplebeesWaiter1122

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 451. 856 questions available.