SY0-601 practice questions 511–520

1. Question 511 · 856 in bank

   A security analyst discovers that one of the web APIs is being abused by an unknown third party. Logs indicate that the third party is attempting to manipulate the parameters being passed to the API endpoint. Which of the following solutions would best help to protect against the attack?

   • ADLP
   • BSIEM
   • CNIDS
   • DWAF

   Show answer

   Answer: D

   Explanation

   A Web Application Firewall (WAF) is a security solution specifically designed to protect web applications and APIs from various attacks, including those that attempt to manipulate parameters and exploit vulnerabilities in the application layer. It sits between the clients (users or third parties) and the web server, inspecting the HTTP/HTTPS traffic and filtering out malicious requests. In this scenario, the security analyst has identified that the web API is being abused by an unknown third party attempting to manipulate the parameters being passed to the API endpoint. A WAF would be able to analyze and validate the incoming requests to the API, blocking any requests that contain suspicious or malicious parameters. It can enforce security policies, perform input validation, and protect against common web application attacks like SQL injection, cross-site scripting (XSS), and parameter tampering.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 512 · 856 in bank

   An application owner reports suspicious activity on an internal financial application from various internal users within the past 14 days. A security analyst notices the following: • Financial transactions were occurring during irregular time frames and outside of business hours by unauthorized users. • Internal users in question were changing their passwords frequently during that time period. • A jump box that several domain administrator users use to connect to remote devices was recently compromised. • The authentication method used in the environment is NTLM. Which of the following types of attacks is most likely being used to gain unauthorized access?

   • APass-the-hash
   • BBrute-force
   • CDirectory traversal
   • DReplay

   Show answer

   Answer: A

   Explanation

   Pass-the-hash is an attack technique used to gain access to a system by using the hash value of a user's password, rather than the actual password itself. This attack is particularly effective against systems using NTLM authentication, where the hash of a user's password can be captured and then reused to authenticate as that user without knowing the actual password. The compromise of the jump box used by domain administrator users could also be an indication that the attacker gained access to privileged credentials and is using pass-the-hash to move laterally through the network.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 513 · 856 in bank

   During an incident, an EDR system detects an increase in the number of encrypted outbound connections from multiple hosts. A firewall is also reporting an increase in outbound connections that use random high ports. An analyst plans to review the correlated logs to find the source of the incident. Which of the following tools will best assist the analyst?

   • AA vulnerability scanner
   • BA NGFW
   • CThe Windows Event Viewer
   • DA SIEM

   Show answer

   Answer: D

   Explanation

   A SIEM is a centralized logging and monitoring solution that collects, analyzes, and correlates log data from various sources within an organization's network and security infrastructure. It helps security analysts to gain visibility into security events and incidents by aggregating and correlating logs from multiple systems and devices. In the scenario described, the EDR system and firewall are both generating logs that provide valuable information about the incident. By using a SIEM, the analyst can collect and correlate the logs from these different sources to get a comprehensive view of the incident. The SIEM will help the analyst identify patterns, anomalies, and potential indicators of compromise that may not be immediately apparent when reviewing individual logs in isolation.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 514 · 856 in bank

   A company recently suffered a breach in which an attacker was able to access the internal mail servers and directly access several user inboxes. A large number of email messages were later posted online. Which of the following would best prevent email contents from being released should another breach occur?

   • AImplement S/MIME to encrypt the emails at rest.
   • BEnable full disk encryption on the mail servers.
   • CUse digital certificates when accessing email via the web.
   • DConfigure web traffic to only use TLS-enabled channels.

   Show answer

   Answer: A

   Explanation

   S/MIME (Secure/Multipurpose Internet Mail Extensions) is a technology that provides end-to-end encryption for email messages. When S/MIME is implemented, email messages are encrypted while at rest on the email server, making it difficult for an attacker to access the content even if they gain unauthorized access to the mail servers. Therefore, implementing S/MIME to encrypt the emails at rest would be the best option to prevent email contents from being released in case of another breach.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 515 · 856 in bank

   A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering. Which of the following teams will conduct this assessment activity?

   • AWhite
   • BPurple
   • CBlue
   • DRed

   Show answer

   Answer: D

   Explanation

   Here are some of the tasks that the red team might perform during the assessment: Conduct penetration testing of the organization's systems and networks. Conduct social engineering attacks against the organization's employees. Perform physical security testing of the organization's facilities. Analyze the results of the assessment and make recommendations for improving the organization's security posture.

   Source: Adapted from community discussion — sujon_london

   Next question

6. Question 516 · 856 in bank

   Which of the following exercises should an organization use to improve its incident response process?

   • ATabletop
   • BReplication
   • CFailover
   • DRecovery

   Show answer

   Answer: A

   Explanation

   A Tabletop exercise is a type of simulation-based training exercise where key personnel come together in a classroom or conference room setting to discuss and practice their response to various simulated scenarios. It involves discussing hypothetical incidents and their potential impacts on the organization, as well as going through the steps of the incident response process, including identification, containment, eradication, recovery, and lessons learned. Tabletop exercises are valuable for testing the effectiveness of the incident response plan, identifying gaps in processes, and improving communication and coordination among different teams involved in incident response. It allows participants to think through complex scenarios in a safe and controlled environment without real-world consequences.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 517 · 856 in bank

   An attacker is attempting to harvest user credentials on a client's website. A security analyst notices multiple attempts of random usernames and passwords. When the analyst types in a random username and password, the logon screen displays the following message: The username you entered does not exist. Which of the following should the analyst recommend be enabled?

   • AInput valuation
   • BObfuscation
   • CError handling
   • DUsername lockout

   Show answer

   Answer: C

   Explanation

   lol what a bad question. improper error handling is the issue here. but error handling has already been enabled. its just that it is of a bad design. We should be able to note down bad questions asked during the exam and request for an official response from COMPTIA. I am just going to protest the bad language and pick C.

   Source: Adapted from community discussion — je123

   Next question

8. Question 518 · 856 in bank

   An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?

   • AException
   • BSegmentation
   • CRisk transfer
   • DCompensating controls

   Show answer

   Answer: D

   Explanation

   D Compensating controls, because the legacy system is probably hard to secure by design, so other solutions had to be implemented Segmentation would be separation from other systems, seems a valid answer but not the best in this context

   Source: Adapted from community discussion — cwamboo

   Next question

9. Question 519 · 856 in bank

   Which of the following describes the ability of code to target a hypervisor from inside a guest OS?

   • AFog computing
   • BVM escape
   • CSoftware-defined networking
   • DImage forgery
   • EContainer breakout

   Show answer

   Answer: B

   Explanation

   VM escape, also known as virtual machine escape or hypervisor escape, refers to the ability of code running within a virtual machine (guest OS) to break out of the virtualized environment and access the underlying hypervisor or host operating system. This could potentially allow an attacker to gain unauthorized access to the host system, compromising the entire virtualization infrastructure. It is a significant security concern in virtualized environments because compromising the hypervisor can lead to the compromise of all the virtual machines running on that host, effectively bypassing the isolation and security measures provided by virtualization.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

10. Question 520 · 856 in bank

    A local server recently crashed and the team is attempting to restore the server from a backup. During the restore process, the team notices the file size of each daily backup is large and will run out of space at the current rate. The current solution appears to do a full backup every night. Which of the following would use the least amount of storage space for backups?

    • AA weekly, incremental backup with daily differential backups
    • BA weekly, full backup with daily snapshot backups
    • CA weekly, full backup with daily differential backups
    • DA weekly, full backup with daily incremental backups

    Show answer

    Answer: D

    Explanation

    "As the week progresses, the incremental backups stay about the same size." "As the week progresses, the differential backup steadily grows in size." -Security+ SY0-601 Get Certified Get Ahead by Darril Gibson

    Source: Adapted from community discussion — LeonardSnart

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 511. 856 questions available.