SY0-601 practice questions 471–480

1. Question 471 · 856 in bank

   A security analyst reports a company policy violation in a case in which a large amount of sensitive data is being downloaded after hours from various mobile devices to an external site. Upon further investigation, the analyst notices that successful login attempts are being conducted with impossible travel times during the same time periods when the unauthorized downloads are occurring. The analyst also discovers a couple of WAPs are using the same SSID, but they have non-standard DHCP configurations and an overlapping channel. Which of the following attacks is being conducted?

   • AEvil twin
   • BJamming
   • CDNS poisoning
   • DBluesnarfing
   • EDDoS

   Show answer

   Answer: A

   Explanation

   In an Evil Twin attack, the attacker sets up a rogue wireless access point (WAP) with the same SSID as a legitimate WAP to mimic it and trick users into connecting to the rogue WAP. The rogue WAP is configured to perform various malicious activities, such as intercepting sensitive data, stealing credentials, and performing man-in-the-middle attacks. In this scenario, the large amount of sensitive data being downloaded from various mobile devices to an external site is likely being intercepted and exfiltrated by the attacker via the rogue WAP. The "impossible travel times" in successful login attempts indicate that the attacker is likely performing man-in-the-middle attacks, intercepting user login credentials, and using them to access the company's internal resources and download the sensitive data. The presence of two WAPs using the same SSID with non-standard DHCP configurations and overlapping channels suggests the existence of the rogue WAP, which is characteristic of an Evil Twin attack.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 472 · 856 in bank

   Several users have opened tickets with the help desk. The help desk has reassigned the tickets to a security analyst for further review. The security analyst reviews the following metrics:

   

   Which of the following is most likely the result of the security analyst's review?

   • AThe ISP is dropping outbound connections.
   • BThe user of the Sales-PC fell for a phishing attack
   • CCorporate PCs have been turned into a botnet.
   • DAn on-path attack is taking place between PCs and the router.

   Show answer

   Answer: C

   Explanation

   In your computer, in your computer Zombie, zombie, zombie-ie-ie What's in your computer, in your computer? Zombie, zombie, zombie-ie-ie-ie, oh

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 473 · 856 in bank

   An engineer needs to deploy a security measure to identify and prevent data tampering within the enterprise. Which of the following will accomplish this goal?

   • AAntivirus
   • BIPS
   • CFTP
   • DFIM

   Show answer

   Answer: D

   Explanation

   File Integrity Monitoring (FIM) is a security measure that helps identify and prevent data tampering within the enterprise. FIM systems monitor files and directories for any unauthorized changes, modifications, or tampering. When changes are detected, alerts or notifications are generated, allowing security teams to investigate and respond to potential security incidents. FIM is particularly useful for detecting unauthorized changes to critical system files, configurations, and sensitive data. It helps maintain the integrity of important files and ensures that they remain in their original state, protecting against unauthorized access or manipulation.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 474 · 856 in bank

   Which of the following mitigation techniques places devices in physically or logically separated networks and leverages policies to limit the types of communications that are allowed?

   • AHost-based firewalls
   • BAccess control list
   • CPort security
   • DLeast privilege

   Show answer

   Answer: B

   Explanation

   An access control list (ACL) is a set of rules or policies that can be applied to devices or networks to control the types of communications that are allowed or denied. It can be used to filter and restrict traffic based on various criteria such as source IP addresses, destination IP addresses, ports, protocols, and more. By applying ACLs, devices can be placed in logically separated networks and communication between them can be controlled based on the defined rules.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 475 · 856 in bank

   All security analysts' workstations at a company have network access to a critical server VLAN. The information security manager wants to further enhance the controls by requiring that all access to the secure VLAN be authorized only from a given single location. Which of the following will the information security manager most likely implement?

   • AA forward proxy server
   • BA jump server
   • CA reverse proxy server
   • DA stateful firewall server

   Show answer

   Answer: B

   Explanation

   A jump server, also known as a bastion host or a secure access server, is a dedicated server that serves as a single access point for administrators or authorized users to connect to other systems within a network. By requiring all access to the secure VLAN to go through the jump server, the information security manager can enforce a centralized and controlled access point. This ensures that all access to the secure VLAN is authorized and can be monitored or logged for security purposes. A jump server provides an additional layer of security and helps protect against unauthorized access.

   Source: Adapted from community discussion — sursur

   Next question

6. Question 476 · 856 in bank

   Which of the following best describes why a company would erase a newly purchased device and install its own image with an operating system and applications?

   • AInstalling a new operating system thoroughly tests the equipment
   • BRemoving unneeded applications reduces the system's attack surface
   • CReimaging a system creates an updated baseline of the computer image
   • DWiping the device allows the company to evaluate its performance

   Show answer

   Answer: B

   Explanation

   Why would you build an updated baseline config of a fresh untouched device. B; Removing unneeded applications reduces the system's attack surface. This choice suggests that by wiping a device and installing a clean image, a company removes potentially unnecessary software, reducing vulnerabilities and the chance of a successful cyber attack. This is a genuine security concern, especially when considering "bloatware" and other pre-installed software that might have known vulnerabilities or introduce unnecessary risks.

   Source: Adapted from community discussion — [Removed]

   Next question

7. Question 477 · 856 in bank

   A security analyst has identified malware spreading through the corporate network and has activated the CSIRT. Which of the following should the analyst do NEXT?

   • AReview how the malware was introduced to the network.
   • BAttempt to quarantine all infected hosts to limit further spread.
   • CCreate help desk tickets to get infected systems reimaged.
   • DUpdate all endpoint antivirus solutions with the latest updates.

   Show answer

   Answer: B

   Explanation

   Answer: Attempt to quarantine all infected hosts to limit further spread. As soon as the malware was identified, the incident response begins. The steps for incident response are: 1. Preparation - Preparing for an attack and how to respond 2. Identification - Identifying the threat 3. Containment - Containing the threat 4. Eradication - Removing the threat 5. Recovery - Recovering affected systems 6. Lessons Learned - Evaluating the incident response, see where there can be improvements for a future incident. In the scenario, the malware has already been identified, which means that we are past the Identification step. The next step would be to begin containment as to limit the amount of damage the malware can cause, so, quarantining infected hosts would be the best option here.

   Source: Adapted from community discussion — rodwave

   Next question

8. Question 478 · 856 in bank

   A backdoor was detected on the containerized application environment. The investigation detected that a zero-day vulnerability was introduced when the latest container image version was downloaded from a public registry. Which of the following is the best solution to prevent this type of incident from occurring again?

   • AEnforce the use of a controlled trusted source of container images.
   • BDeploy an IPS solution capable of detecting signatures of attacks targeting containers.
   • CDefine a vulnerability scan to assess container images before being introduced on the environment.
   • DCreate a dedicated VPC for the containerized environment.

   Show answer

   Answer: A

   Explanation

   Enforcing the use of a controlled and trusted source of container images is the best solution to prevent incidents like the one described. When using containerized applications, it is crucial to ensure that the container images come from trusted sources, such as a private container registry, where the images are scanned for vulnerabilities and controlled by the organization. This way, the risk of downloading images with zero-day vulnerabilities or other malicious code from public registries is minimized.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 479 · 856 in bank

   An external forensics investigator has been hired to investigate a data breach at a large enterprise with numerous assets. It is known that the breach started in the perimeter network and moved to the sensitive information, generating multiple logs as the attacker traversed through the network. Which of the following will best assist with this investigation?

   • APerform a vulnerability scan to identify the weak spots.
   • BUse a packet analyzer to investigate the NetFlow traffic.
   • CCheck the SIEM to review the correlated logs.
   • DRequire access to the routers to view current sessions.

   Show answer

   Answer: C

   Explanation

   A SIEM (Security Information and Event Management) system collects and aggregates logs from various sources across an enterprise's network and IT infrastructure. It can correlate and analyze these logs to identify security incidents and provide a comprehensive view of activities across the network. In the case of a data breach investigation, the SIEM can be a valuable tool to review the logs generated during the attack and trace the attacker's activities from the perimeter network to the sensitive information.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

10. Question 480 · 856 in bank

    A Chief Information Security Officer (CISO) needs to create a policy set that meets international standards for data privacy and sharing. Which of the following should the CISO read and understand before writing the policies?

    • APCI DSS
    • BGDPR
    • CNIST
    • DISO 31000

    Show answer

    Answer: B

    Explanation

    I understand why you may think it should be NIST and not GDPR, however, I need to point out the fact that many seem to focus on the wrong keyword. I believe the right keyword here is "Data privacy and sharing" NOT "International" NIST: is responsible for developing cybersecurity standards across U.S. Federal Government GDPR is concerned MAINLY with data and its privacy, sharing, processing and everything that has to do with sensitive data. This is my reasoning. Best of luck to you all. In stoneface we trust

    Source: Adapted from community discussion — david124

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 471. 856 questions available.