SY0-601 practice questions 41–50

1. Question 41 · 856 in bank

   An attacker was eavesdropping on a user who was shopping online. The attacker was able to spoof the IP address associated with the shopping site. Later, the user received an email regarding the credit card statement with unusual purchases. Which of the following attacks took place?

   • AOn-path attack
   • BProtocol poisoning
   • CDomain hijacking
   • DBluejacking

   Show answer

   Answer: A

   Explanation

   No, spoofing an IP address and hijacking a domain are two different types of attacks. In a domain hijacking attack, the attacker gains control of a domain name and redirects users to a different site that appears to be the legitimate one. In the scenario you described, the attacker spoofed the IP address of the shopping site, which means they sent packets to the user's computer with a false source IP address, making it appear as if the packets were coming from the shopping site. This allowed the attacker to intercept and view the user's traffic, including their credit card information, without the user's knowledge. This is an example of an on-path attack or a man-in-the-middle attack.

   Source: Adapted from community discussion — princajen

   Next question

2. Question 42 · 856 in bank

   A company is considering transitioning to the cloud. The company employs individuals from various locations around the world. The company does not want to increase its on premises infrastructure blueprint and only wants to pay for additional compute power required. Which of the following solutions would BEST meet the needs of the company?

   • APrivate cloud
   • BHybrid environment
   • CManaged security service provider
   • DHot backup site

   Show answer

   Answer: B

   Explanation

   The important thing to notice is that B is "hybrid ENVIRONMENT" not "hybrid CLOUD". A hybrid environment is a mix of private network and cloud, while a hybrid cloud is a mix of private cloud and public cloud. This company wants to provide services in the cloud, but maintain their existing on prem environment... that's a hybrid environment.

   Source: Adapted from community discussion — Confuzed

   References

   • Google Cloud documentation

   Next question

3. Question 43 · 856 in bank

   After multiple on premises security solutions were migrated to the cloud, the incident response time increased. The analysts are spending a long time trying to trace information on different cloud consoles and correlating data in different formats. Which of the following can be used to optimize the incident response time?

   • ACASB
   • BVPC
   • CSWG
   • DCMS

   Show answer

   Answer: A

   Explanation

   Answer should be CASB. As per CompTIA Sec+ objectives, CMS is a content management system, not a cloud. CMP term is used for Cloud Management Platforms.

   Source: Adapted from community discussion — Kandy357

   Next question

4. Question 44 · 856 in bank

   Which of the following control types would be BEST to use in an accounting department to reduce losses from fraudulent transactions?

   • ARecovery
   • BDeterrent
   • CCorrective
   • DDetective

   Show answer

   Answer: D

   Explanation

   Detective controls – look for both fraudulent and unintentionally improper transactions after the fact. Examples of detective controls include reconciliations, variance analyses, physical inventories, audits, and continuous monitoring through data analytics.

   Source: Adapted from community discussion — okay123

   Next question

5. Question 45 · 856 in bank

   A company is receiving emails with links to phishing sites that look very similar to the company's own website address and content. Which of the following is the BEST way for the company to mitigate this attack?

   • ACreate a honeynet to trap attackers who access the VPN with credentials obtained by phishing.
   • BGenerate a list of domains similar to the company's own and implement a DNS sinkhole for each.
   • CDisable POP and IMAP on all Internet-facing email servers and implement SMTPS.
   • DUse an automated tool to flood the phishing websites with fake usernames and passwords.

   Show answer

   Answer: B

   Explanation

   DNS sinkhole prevents users from entering the site if they have a sinkhole for the domain name. So making a list of fake websites domain name and making a sinkhole will prevent access to these website if a user tried to search for it on accident.

   Source: Adapted from community discussion — Josh_Feng

   Next question

6. Question 46 · 856 in bank

   A security engineer is building a file transfer solution to send files to a business partner. The users would like to drop off the files in a specific directory and have the server send the file to the business partner. The connection to the business partner is over the internet and needs to be secure. Which of the following can be used?

   • AS/MIME
   • BLDAPS
   • CSSH
   • DSRTP

   Show answer

   Answer: C

   Explanation

   Answer: SSH - SSH or (Secure Shell) is a protocol that enables two computers to communicate securely by encrypting the connection. Since the question is looking to transfer files over the internet to a specific directory, the FTP protocol can be used for the file transfer itself. As SSH can be used with the FTP protocol, this allows for secure(SSH) file transfer(FTP) over the internet. ======================== Other Choices: S/MIME (Secure/Multipurpose internet Mail Extensions) - Digitally signs and encrypts the contents of email messages. LDAPS(Lightweight Directory Access Protocol) - Provides authentication for directory-based traffic SRTP (Secure Real-time Transport Protocol) - Provides authentication/encryption for transmitted audio and video traffic.

   Source: Adapted from community discussion — rodwave

   Next question

7. Question 47 · 856 in bank

   A SOC operator is receiving continuous alerts from multiple Linux systems indicating that unsuccessful SSH attempts to a functional user ID have been attempted on each one of them in a short period of time. Which of the following BEST explains this behavior?

   • ARainbow table attack
   • BPassword spraying
   • CLogic bomb
   • DMalware bot

   Show answer

   Answer: B

   Explanation

   Password spraying is a type of brute-force attack where the attacker attempts to gain unauthorized access to multiple accounts by trying a small number of commonly used passwords against many usernames. In this scenario, the continuous alerts from multiple Linux systems indicating unsuccessful SSH attempts to a functional user ID suggest that an attacker is trying different passwords against the same user ID on each system, which aligns with the behavior of a password spraying attack. The attacker is not attempting to guess different usernames but is trying a limited set of passwords against the same user ID on multiple systems.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

8. Question 48 · 856 in bank

   A tax organization is working on a solution to validate the online submission of documents. The solution should be carried on a portable USB device that should be inserted on any computer that is transmitting a transaction securely. Which of the following is the BEST certificate for these requirements?

   • AUser certificate
   • BSelf-signed certificate
   • CComputer certificate
   • DRoot certificate

   Show answer

   Answer: A

   Explanation

   I'm going to give details of what is the use of each one, because I'm tired that are not giving the right answer: User Certificate: User certificates specify which resources a given user can have access to. They are sometimes used on devices that several users share. When different users log in, their profile and certificate are automatically loaded, granting them access to their required information. Self-signed certificate: A self-signed certificate is one that is not signed by a CA at all – neither private nor public. In this case, the certificate is signed with its own private key, instead of requesting it from a public or a private CA (Certificate Authority). Root Certificate: Root certificates are the cornerstone of authentication and security in software and on the Internet. They're issued by a certified authority (CA) and, essentially, verify that the software/website owner is who they say they are. So for this verification I'm completely 100% sure is A: User certificate

   Source: Adapted from community discussion — EubertT

   References

   • Microsoft Learn

   Next question

9. Question 49 · 856 in bank

   A routine audit of medical billing claims revealed that several claims were submitted without the subscriber's knowledge. A review of the audit logs for the medical billing company's system indicated a company employee downloaded customer records and adjusted the direct deposit information to a personal bank account. Which of the following does this action describe?

   • AInsider threat
   • BSocial engineering
   • CThird-party risk
   • DData breach

   Show answer

   Answer: A

   Explanation

   are you deliberately trying to cause people to fail this exam? While a data breach did occur, it was accomplished by an EMPLOYEE, so Insider Threat is the correct answer here.

   Source: Adapted from community discussion — P_man

   Next question

10. Question 50 · 856 in bank

    A recent audit cited a risk involving numerous low-criticality vulnerabilities created by a web application using a third-party library. The development staff state there are still customers using the application even though it is end of life and it would be a substantial burden to update the application for compatibility with more secure libraries. Which of the following would be the MOST prudent course of action?

    • AAccept the risk if there is a clear road map for timely decommission.
    • BDeny the risk due to the end-of-life status of the application.
    • CUse containerization to segment the application from other applications to eliminate the risk.
    • DOutsource the application to a third-party developer group.

    Show answer

    Answer: A

    Explanation

    Prudent: acting with or showing care and thought for the future. in this case C is not much of a prudent course of action, A specifies a "clear road for timely decommission" hence it being a better choice. Along with it being low risk it's a clear A.

    Source: Adapted from community discussion — scarceanimal

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 41. 856 questions available.