SY0-601 practice questions 461–470

1. Question 461 · 856 in bank

   A company's help desk received several AV alerts indicating Mimikatz attempted to run on the remote systems. Several users also reported that the new company flash drives they picked up in the break room only have 512KB of storage. Which of the following is most likely the cause?

   • AThe GPO prevents the use of flash drives, which triggers a false positive AV indication and restricts the drives to only 512KB of storage.
   • BThe new flash drives need a driver that is being blocked by the AV software because the flash drives are not on the application's allow list, temporarily restricting the drives to 512KB of storage.
   • CThe new flash drives are incorrectly partitioned, and the systems are automatically trying to use an unapproved application to repartition the drives.
   • DThe GPO blocking the flash drives is being bypassed by a malicious flash drive that is attempting to harvest plaintext credentials from memory.

   Show answer

   Answer: D

   Explanation

   The GPO blocking the flash drives is being bypassed by a malicious flash drive that is attempting to harvest plaintext credentials from memory. The presence of Mimikatz alerts and reports of new company flash drives having only 512KB of storage indicate a potential security incident involving malicious activity. Mimikatz is a well-known tool used for extracting plaintext passwords and other sensitive information from memory, which could indicate an attempt to compromise the security of the systems. Additionally, the fact that the new flash drives have been tampered with and do not have their original storage capacity suggests that a malicious actor is using the flash drives to bypass the Group Policy Object (GPO) settings that block the use of flash drives. This could be an attempt to introduce malware or exfiltrate data using unauthorized hardware.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 462 · 856 in bank

   A company has installed badge readers for building access but is finding unauthorized individuals roaming the hallways. Which of the following is the most likely cause?

   • AShoulder surfing
   • BPhishing
   • CTailgating
   • DIdentity fraud

   Show answer

   Answer: C

   Explanation

   Tailgating, also known as piggybacking, is the act of an unauthorized individual following closely behind an authorized person to gain entry into a restricted area without their own valid access credentials. In this scenario, the badge readers are meant to control building access, but unauthorized individuals are gaining access by simply following authorized employees who use their badges to open doors. This practice compromises the security of the building and allows unauthorized people to roam the hallways. To prevent tailgating, employees should be trained to be vigilant about not allowing unauthorized individuals to follow them through access-controlled doors. Additionally, security measures like mantraps or turnstiles can be implemented to prevent tailgating incidents.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 463 · 856 in bank

   An organization routes all of its traffic through a VPN. Most users are remote and connect into a corporate data center that houses confidential information. There is a firewall at the internet border, followed by a DLP appliance, the VPN server, and the data center itself. Which of the following is the weakest design element?

   • AThe DLP appliance should be integrated into a NGFW.
   • BSplit-tunnel connections can negatively impact the DLP appliance's performance.
   • CEncrypted VPN traffic will not be inspected when entering or leaving the network.
   • DAdding two hops in the VPN tunnel may slow down remote connections.

   Show answer

   Answer: C

   Explanation

   In this scenario, the weakest design element is that encrypted VPN traffic will not be inspected when entering or leaving the network. Since the traffic is encrypted, the DLP (Data Loss Prevention) appliance will not be able to inspect the content of the data packets passing through the VPN tunnel. This lack of inspection can potentially allow malicious or unauthorized data to be transmitted without detection. To enhance security, it is essential to implement a solution that allows for the inspection of encrypted VPN traffic. One approach is to deploy a next-generation firewall (NGFW) with SSL/TLS decryption capabilities. The NGFW can decrypt the VPN traffic, inspect it for potential threats or sensitive data, and then re-encrypt it before sending it to its destination. By doing so, the organization can maintain security while still enabling remote users to access corporate resources through the VPN.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 464 · 856 in bank

   Which of the following is the best method for ensuring non-repudiation?

   • ASSO
   • BDigital certificate
   • CToken
   • DSSH key

   Show answer

   Answer: B

   Explanation

   Digital certificates are the best method for ensuring non-repudiation. A digital certificate is an electronic credential that binds an entity's identity to a public key. It is issued by a trusted third party known as a Certificate Authority (CA). When a user digitally signs a message or document using their private key, the recipient can verify the signature using the corresponding public key from the user's digital certificate. This process provides assurance that the sender of the message cannot later deny having sent it, thus ensuring non-repudiation.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 465 · 856 in bank

   Which of the following methods is the most effective for reducing vulnerabilities?

   • AJoining an information-sharing organization
   • BUsing a scan-patch-scan process
   • CImplementing a bug bounty program
   • DPatching low-scoring vulnerabilities first

   Show answer

   Answer: B

   Explanation

   Vulnerability scanning: Conducting regular vulnerability scans to identify potential security weaknesses in the organization's systems, networks, and applications. Patching: Addressing the identified vulnerabilities by applying the necessary security patches and updates to the affected systems. Patching helps to close the known security holes that could be exploited by attackers. Re-scanning: After applying the patches, conducting another round of vulnerability scanning to verify that the identified vulnerabilities have been properly addressed and that the systems are no longer at risk.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 466 · 856 in bank

   An organization discovered files with proprietary financial data have been deleted. The files have been recovered from backup, but every time the Chief Financial Officer logs in to the file server, the same files are deleted again. No other users are experiencing this issue. Which of the following types of malware is MOST likely causing this behavior?

   • ALogic bomb
   • BCryptomalware
   • CSpyware
   • DRemote access Trojan

   Show answer

   Answer: A

   Explanation

   Answer: Logic Bomb A logic bomb is inserted code that will intentionally set off a malicious function when specified conditions are met. In this question, the logic bomb could be related to when the CFO logs in as no other user is experiencing this issue. ================================== Helpful info: Cryptomalware - A type of ransomware that will encrypt user's files and demand a random Spyware - a form of malware that hides on your device, monitors activity and steals sensitive information. Remote Access Trojan (RAT) - malware an attacker uses to remotely control an infected computer

   Source: Adapted from community discussion — rodwave

   Next question

7. Question 467 · 856 in bank

   An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to remote work. The organization is looking for a software solution that will allow it to reduce traffic on the VPN and internet circuit, while still providing encrypted tunnel access to the data center and monitoring of remote employee internet traffic. Which of the following will help achieve these objectives?

   • ADeploying a SASE solution to remote employees
   • BBuilding a load-balanced VPN solution with redundant internet
   • CPurchasing a low-cost SD-WAN solution for VPN traffic
   • DUsing a cloud provider to create additional VPN concentrators

   Show answer

   Answer: A

   Explanation

   SASE (Secure Access Service Edge) is a comprehensive networking and security approach that combines wide-area networking (WAN) capabilities with security features. It provides secure access to applications and data, including encrypted tunnel access to the data center, while also offering monitoring capabilities for remote employee internet traffic. By implementing a SASE solution, the organization can reduce traffic on the VPN and internet circuit by routing traffic intelligently through the cloud, closer to the users. This approach helps optimize performance and security, addressing the scaling issues effectively.

   Source: Adapted from community discussion — sursur

   Next question

8. Question 468 · 856 in bank

   Which of the following is the best reason to complete an audit in a banking environment?

   • ARegulatory requirement
   • BOrganizational change
   • CSelf-assessment requirement
   • DService-level requirement

   Show answer

   Answer: A

   Explanation

   Banks operate in a highly regulated industry, and regulatory bodies impose various requirements to ensure compliance, security, and transparency. Audits are often mandated by regulatory authorities to assess the bank's adherence to regulations, identify any non-compliance issues, and ensure the protection of customer assets and sensitive information. Completing audits helps banks meet regulatory requirements, maintain their license to operate, and avoid potential penalties or legal consequences.

   Source: Adapted from community discussion — sursur

   Next question

9. Question 469 · 856 in bank

   After a recent ransomware attack on a company's system, an administrator reviewed the log files. Which of the following control types did the administrator use?

   • ACompensating
   • BDetective
   • CPreventive
   • DCorrective

   Show answer

   Answer: B

   Explanation

   The administrator used detective controls by reviewing the log files after the ransomware attack. Detective controls are designed to detect and identify potential security incidents or policy violations that may have occurred within an organization's systems or network. In this case, the log files were analyzed to identify signs of the ransomware attack and understand how the incident occurred. Detective controls help in identifying security breaches or other issues so that appropriate actions can be taken to respond to and mitigate the impact of the incident. They are an essential part of a comprehensive cybersecurity strategy, alongside preventive and corrective controls.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

10. Question 470 · 856 in bank

    A technician needs to apply a high-priority patch to a production system. Which of the following steps should be taken first?

    • AAir gap the system.
    • BMove the system to a different network segment.
    • CCreate a change control request.
    • DApply the patch to the system.

    Show answer

    Answer: C

    Explanation

    Before applying a high-priority patch to a production system, it is essential to follow proper change management procedures. Creating a change control request allows the organization to document and track the proposed change, assess its potential impact, and get approval from relevant stakeholders. This process ensures that the patching procedure is well-documented, planned, and communicated to all necessary parties, reducing the risk of unexpected issues or disruptions to the production environment. After the change control request is approved and the necessary preparations are made, the technician can proceed with applying the patch to the production system.

    Source: Adapted from community discussion — ApplebeesWaiter1122

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 461. 856 questions available.