SY0-601 practice questions 491–500

1. Question 491 · 856 in bank

   To reduce costs and overhead, an organization wants to move from an on-premises email solution to a cloud-based email solution. At this time, no other services will be moving. Which of the following cloud models would best meet the needs of the organization?

   • AMaaS
   • BIaaS
   • CSaaS
   • DPaaS

   Show answer

   Answer: C

   Explanation

   Passed my test this week. I highly recommend going through all of these questions from front to back multiple times and place close attention to the PBQs here, also read the discussions to get an understanding of things. I studied for about two weeks and was good. I also was kicked out of my exam midway through (some blocked process started running) and had over 20 unanswered questions and still passed. If I can do it, anyone reading this can do it.

   Source: Adapted from community discussion — CJfromVA

   Next question

2. Question 492 · 856 in bank

   A software development manager wants to ensure the authenticity of the code created by the company. Which of the following options is the most appropriate?

   • ATesting input validation on the user input fields
   • BPerforming code signing on company-developed software
   • CPerforming static code analysis on the software
   • DEnsuring secure cookies are used

   Show answer

   Answer: B

   Explanation

   Code signing is a cryptographic process where a digital signature is applied to software to verify its authenticity and integrity. When the software is signed, it provides a way for users or systems to confirm that the code has not been tampered with since it was signed by the trusted entity (in this case, the company). This helps prevent unauthorized modifications and ensures that the code being executed is from a legitimate source. Performing code signing is an essential practice in software development, particularly for software that will be distributed or downloaded by end-users. It helps build trust with users and ensures they can verify that the software they are running is from a trusted source and has not been altered by malicious actors.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 493 · 856 in bank

   An organization is having difficulty correlating events from its individual AV, EDR, DLP, SWG, WAF, MDM, HIPS, and CASB systems. Which of the following is the best way to improve the situation?

   • ARemove expensive systems that generate few alerts.
   • BModify the systems to alert only on critical issues.
   • CUtilize a SIEM to centralize logs and dashboards.
   • DImplement a new syslog/NetFlow appliance.

   Show answer

   Answer: C

   Explanation

   A SIEM is a centralized solution that aggregates and correlates log data from multiple security devices, applications, and systems in real-time. It provides a unified view of security events and alerts, making it easier for security analysts to detect and respond to security incidents. With a SIEM, the organization can create custom dashboards, perform advanced analytics, and automate incident response workflows.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 494 · 856 in bank

   A company's end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server. Which of the following best describes what the security analyst is seeing?

   • AConcurrent session usage
   • BSecure DNS cryptographic downgrade
   • COn-path resource consumption
   • DReflected denial of service

   Show answer

   Answer: D

   Explanation

   In a reflected denial of service (DoS) attack, the attacker sends requests to a large number of public servers, spoofing the source IP address to make it appear as if the requests are coming from the target server. These public servers, acting as amplifiers, then send the responses back to the target server, overwhelming it with inbound traffic. In this case, the DNS server is receiving a flood of inbound traffic due to the DNS requests being amplified by other servers. The DNS server's CPU, disk, and memory usage are minimal because it is only processing legitimate DNS queries sent to it. However, the network interface is overwhelmed with amplified responses, causing the end users to be unable to reach external websites.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 495 · 856 in bank

   An audit identified PII being utilized in the development environment of a critical application. The Chief Privacy Officer (CPO) is adamant that this data must be removed; however, the developers are concerned that without real data they cannot perform functionality tests and search for specific data. Which of the following should a security professional implement to best satisfy both the CPO's and the development team's requirements?

   • AData purge
   • BData encryption
   • CData masking
   • DData tokenization

   Show answer

   Answer: C

   Explanation

   This is interesting as this is a question that's already presented in earlier questions of this collection. However, anonymization is presented in the older question; here it is not. Moreover, data masking is present in both. I'm going with C

   Source: Adapted from community discussion — TreeeSon

   References

   • AWS documentation

   Next question

6. Question 496 · 856 in bank

   A security analyst is investigating a malware incident at a company. The malware is accessing a command-and-control website at www.comptia.com. All outbound Internet traffic is logged to a syslog server and stored in /logfiles/messages. Which of the following commands would be best for the analyst to use on the syslog server to search for recent traffic to the command-and-control website?

   • Ahead -500 www.comptia.com | grep /logfiles/messages
   • Bcat /logfiles/messages | tail -500 www.comptia.com
   • Ctail -500 /logfiles/messages | grep www.comptia.com
   • Dgrep -500 /logfiles/messages | cat www.comptia.com

   Show answer

   Answer: C

   Explanation

   tail -500 /logfiles/messages: This command will show the last 500 lines from the /logfiles/messages file. Since outbound Internet traffic is logged, the most recent events are likely to be at the end of the log file. grep www.comptia.com: This command will filter the output of the tail command and display only the lines that contain the string "www.comptia.com," which represents the command-and-control website.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 497 · 856 in bank

   A systems administrator set up an automated process that checks for vulnerabilities across the entire environment every morning. Which of the following activities is the systems administrator conducting?

   • AScanning
   • BAlerting
   • CReporting
   • DArchiving

   Show answer

   Answer: A

   Explanation

   Scanning involves using automated tools to actively check the entire environment for vulnerabilities. The process typically involves using vulnerability scanning tools to identify and assess potential security weaknesses in the network, systems, and applications. The scan may include checks for known security vulnerabilities, misconfigurations, outdated software versions, and other potential issues that could be exploited by attackers. By performing regular vulnerability scanning, the systems administrator can proactively identify and address security risks, allowing them to take appropriate measures to patch or mitigate vulnerabilities before they can be exploited by malicious actors. Scanning is an essential part of a proactive security posture and helps ensure that the organization's systems and data remain secure and protected from potential threats.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

8. Question 498 · 856 in bank

   An engineer is setting up a VDI environment for a factory location, and the business wants to deploy a low-cost solution to enable users on the shop floor to log in to the VDI environment directly. Which of the following should the engineer select to meet these requirements?

   • ALaptops
   • BContainers
   • CThin clients
   • DWorkstations

   Show answer

   Answer: C

   Explanation

   A thin client is a cost-effective hardware device that is used to access a virtual desktop infrastructure (VDI) environment. It is designed to have minimal processing power and storage since most of the computing tasks are handled by the central VDI server. Thin clients are ideal for scenarios where users need simple access to a VDI session without the need for high-end computing resources. In a factory environment, where users on the shop floor require basic VDI access, thin clients can provide a low-cost and efficient solution.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 499 · 856 in bank

   A recent security breach exploited software vulnerabilities in the firewall and within the network management solution. Which of the following will MOST likely be used to identify when the breach occurred through each device?

   • ASIEM correlation dashboards
   • BFirewall syslog event logs
   • CNetwork management solution login audit logs
   • DBandwidth monitors and interface sensors

   Show answer

   Answer: A

   Explanation

   A SIEM (Security Information and Event Management) system is designed to collect, analyze, and correlate log and event data from various devices and applications across the network. In the context of the given scenario, a SIEM system would be the most appropriate tool to identify when the breach occurred through each device (firewall and network management solution). In contrast, SIEM correlation dashboards can aggregate and correlate logs from multiple sources, allowing security analysts to piece together the timeline of events and detect anomalies and potential breaches more effectively. This makes it the most appropriate option for identifying when the breach occurred through each device in the given scenario, according to the CompTIA Security+ SY0-601 exam objectives.

   Source: Adapted from community discussion — Protract8593

   Next question

10. Question 500 · 856 in bank

    A systems administrator receives the following alert from a file integrity monitoring tool: The hash of the cmd.exe file has changed. The systems administrator checks the OS logs and notices that no patches were applied in the last two months. Which of the following most likely occurred?

    • AThe end user changed the file permissions.
    • BA cryptographic collision was detected.
    • CA snapshot of the file system was taken.
    • DA rootkit was deployed.

    Show answer

    Answer: D

    Explanation

    When a file integrity monitoring tool detects a change in the hash of a critical system file like "cmd.exe," it could indicate that a rootkit has been deployed. Rootkits are malicious software designed to hide their presence on a system by modifying critical files and processes, including system utilities like "cmd.exe." By changing the hash of the file, the rootkit aims to evade detection by security tools that rely on file integrity checks. Rootkits often have the capability to tamper with system logs and other monitoring mechanisms, making them difficult to detect using traditional methods.

    Source: Adapted from community discussion — ApplebeesWaiter1122

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 491. 856 questions available.