SY0-601 practice questions 481–490

1. Question 481 · 856 in bank

   During an internal penetration test, a security analyst identified a network device that had accepted cleartext authentication and was configured with a default credential. Which of the following recommendations should the security analyst make to secure this device?

   • AConfigure SNMPv1.
   • BConfigure SNMPv2c.
   • CConfigure SNMPv3.
   • DConfigure the default community string.

   Show answer

   Answer: C

   Explanation

   C. Configure SNMPv3. In this scenario, the security analyst discovered a network device with cleartext authentication and a default credential. To secure the device, the best recommendation is to configure SNMPv3. SNMP (Simple Network Management Protocol) is commonly used for network monitoring and management. SNMPv1 and SNMPv2c use cleartext authentication, which means that the credentials are transmitted without encryption, making them vulnerable to eavesdropping and potential credential theft. SNMPv3 is the most secure version of SNMP and provides several security features, including data encryption, message integrity, and authentication. It uses technologies such as HMAC (Hash-based Message Authentication Code) and encryption algorithms to protect sensitive information, making it the preferred choice when securing network devices and preventing unauthorized access or misuse.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 482 · 856 in bank

   Developers are writing code and merging it into shared repositories several times a day, where it is tested automatically. Which of the following concepts does this best represent?

   • AFunctional testing
   • BStored procedures
   • CElasticity
   • DContinuous integration

   Show answer

   Answer: D

   Explanation

   Continuous Integration is a software development practice where code changes are integrated into a shared code repository frequently, typically several times a day. Each integration triggers an automated build and testing process to detect integration issues and identify bugs or conflicts early in the development cycle. Continuous Integration aims to improve software quality, increase the speed of development, and reduce the risk of integration problems by automating the process of code integration and testing. It helps teams to catch and fix issues quickly, maintain a reliable codebase, and ensure that new code is continuously integrated into the existing codebase. Continuous Integration is a crucial aspect of modern software development methodologies, such as Agile and DevOps, which focus on iterative development and frequent releases of software updates. It enables teams to work collaboratively, deliver code changes more efficiently, and achieve faster and more reliable development cycles

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 483 · 856 in bank

   A large financial services firm recently released information regarding a security breach within its corporate network that began several years before. During the time frame in which the breach occurred, indicators show an attacker gained administrative access to the network through a file downloaded from a social media site and subsequently installed it without the user's knowledge. Since the compromise, the attacker was able to take command and control of the computer systems anonymously while obtaining sensitive corporate and personal employee information. Which of the following methods did the attacker most likely use to gain access?

   • AA bot
   • BA fileless virus
   • CA logic bomb
   • DA RAT

   Show answer

   Answer: D

   Explanation

   Given the scenario described, the most likely method the attacker used to gain access to the network is a Remote Access Trojan (RAT). A RAT is a type of malware that provides an attacker with unauthorized remote access to a victim's computer system. RATs can be delivered in various ways, including through email attachments, malicious downloads, or social engineering techniques. In this case, the attacker likely used a RAT that was delivered through the file downloaded from the social media site. Once the RAT was executed on the victim's system, it provided the attacker with administrative access, enabling them to take command and control of the computer systems and collect sensitive information.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 484 · 856 in bank

   Recent changes to a company's BYOD policy require all personal mobile devices to use a two-factor authentication method that is not something you know or have. Which of the following will meet this requirement?

   • AFacial recognition
   • BSix-digit PIN
   • CPKI certificate
   • DSmart card

   Show answer

   Answer: A

   Explanation

   A. Facial recognition - Something you are, even though you have a face not are a face B. Six-digit PIN - Something you know C. PKI certificate - Something you have D. Smart card - Something you have

   Source: Adapted from community discussion — CastratedMonk

   Next question

5. Question 485 · 856 in bank

   A critical file server is being upgraded, and the systems administrator must determine which RAID level the new server will need to achieve parity and handle two simultaneous disk failures. Which of the following RAID levels meets this requirement?

   • ARAID 0+1
   • BRAID 2
   • CRAID 5
   • DRAID 6

   Show answer

   Answer: D

   Explanation

   RAID 6 is a fault-tolerant RAID level that provides dual parity, which means it can withstand the failure of two disks simultaneously without data loss. It is achieved by distributing two sets of parity information across the disks. This level of fault tolerance makes RAID 6 suitable for critical systems where data integrity and high availability are crucial.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 486 · 856 in bank

   A company must ensure sensitive data at rest is rendered unreadable. Which of the following will the company most likely use?

   • AHashing
   • BTokenization
   • CEncryption
   • DSegmentation

   Show answer

   Answer: C

   Explanation

   Encryption is the process of converting plaintext data into ciphertext using an algorithm and encryption key. It ensures that sensitive data stored at rest (e.g., on hard drives, databases, or storage devices) is rendered unreadable to unauthorized users or attackers. Only those with the appropriate decryption key can transform the ciphertext back into readable plaintext.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 487 · 856 in bank

   A security assessment found that several embedded systems are running unsecure protocols. These systems were purchased two years ago, and the company that developed them is no longer in business. Which of the following constraints best describes the reason the findings cannot be remediated?

   • AInability to authenticate
   • BImplied trust
   • CLack of computing power
   • DUnavailable patch

   Show answer

   Answer: D

   Explanation

   The reason the findings cannot be remediated is due to the unavailability of patches. Since the company that developed the embedded systems is no longer in business, there is no one to provide updates, including security patches, for the systems. This lack of support leaves the systems vulnerable to the unsecure protocols they are running, and there is no feasible way to update or patch them to address the security issues.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

8. Question 488 · 856 in bank

   During an incident response, an analyst applied rules to all inbound traffic on the border firewall and implemented ACLs on each critical server. Following an investigation, the company realizes it is still vulnerable because outbound traffic is not restricted, and the adversary is able to maintain a presence in the network. In which of the following stages of the Cyber Kill Chain is the adversary currently operating?

   • AReconnaissance
   • BCommand and control
   • CActions on objective
   • DExploitation

   Show answer

   Answer: B

   Explanation

   Command and control (C2)—establishment of outbound communications from a victim system for secure communications between victim and adversary systems. Compromised hosts typically beacon out and await further instruction or exploit when higher order interaction or data exchange is required. This is the hallmark of advanced persistent threat (APT) attacks and data exfiltration.

   Source: Adapted from community discussion — stoneface

   Next question

9. Question 489 · 856 in bank

   A security engineer is concerned about using an agent on devices that relies completely on defined known-bad signatures. The security engineer wants to implement a tool with multiple components including the ability to track, analyze, and monitor devices without reliance on definitions alone. Which of the following solutions best fits this use case?

   • AEDR
   • BDLP
   • CNGFW
   • DHIPS

   Show answer

   Answer: A

   Explanation

   Endpoint Detection and Response (EDR) * Monitor every application action and block malicious actions * Perform a root cause analysis * Isolate a system from the rest of the network * Delete something to roll back to a previously good configuration * The above can be completed by API. A. EDR

   Source: Adapted from community discussion — Gamsje

   Next question

10. Question 490 · 856 in bank

    A user's login credentials were recently compromised. During the investigation, the security analyst determined the user input credentials into a pop-up window when prompted to confirm the username and password. However, the trusted website does not use a pop-up for entering user credentials. Which of the following attacks occurred?

    • ACross-site scripting
    • BSQL injection
    • CDNS poisoning
    • DCertificate forgery

    Show answer

    Answer: A

    Explanation

    The scenario described is indicative of a cross-site scripting (XSS) attack. In an XSS attack, an attacker injects malicious scripts into a trusted website, which then executes those scripts in the browsers of unsuspecting users. This can happen when the website fails to properly validate and sanitize user input, allowing the attacker to inject malicious code. In this case, the pop-up window used to collect user credentials is not a legitimate part of the trusted website's design. The attacker has injected a script that creates the pop-up and tricks the user into entering their login credentials into the fake form. The credentials are then captured and sent to the attacker, compromising the user's account. To prevent XSS attacks, web applications should implement proper input validation and output encoding to ensure that user-supplied data is treated as data and not executable code. Additionally, using security mechanisms like Content Security Policy (CSP) and sanitizing user input can help protect against XSS vulnerabilities.

    Source: Adapted from community discussion — ApplebeesWaiter1122

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 481. 856 questions available.