SY0-601 practice questions 541–550

1. Question 541 · 856 in bank

   A bakery has a secret recipe that it wants to protect. Which of the following objectives should be added to the company’s security awareness training?

   • AInsider threat detection
   • BRisk analysis
   • CPhishing awareness
   • DBusiness continuity planning

   Show answer

   Answer: A

   Explanation

   The first thing i think about when i read this question is plankton trying to steal the krabby patties secret formula. You think if was an employee of the krusty Krab it would be a lot easier for him?? Proabally. I would go with A: insider threat detection

   Source: Adapted from community discussion — Copmp

   Next question

2. Question 542 · 856 in bank

   Select 2

   Which of the following must be considered when designing a high-availability network? (Choose two.)

   • AEase of recovery
   • BAbility to patch
   • CPhysical isolation
   • DResponsiveness
   • EAttack surface
   • FExtensible authentication

   Show answer

   Answer: AD

   Explanation

   A. Ease of recovery: High-availability networks should be designed in a way that allows for quick and easy recovery in the event of a failure. Redundancy, failover mechanisms, and backup systems are some of the components that can help facilitate smooth recovery. D. Responsiveness: High-availability networks need to be responsive to ensure that any potential issues or failures are quickly detected, and appropriate actions are taken promptly to minimize downtime and impact.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

3. Question 543 · 856 in bank

   An organization is building backup server rooms in geographically diverse locations. The Chief Information Security Officer implemented a requirement on the project that states the new hardware cannot be susceptible to the same vulnerabilities in the existing server room. Which of the following should the systems engineer consider?

   • APurchasing hardware from different vendors
   • BMigrating workloads to public cloud infrastructure
   • CImplementing a robust patch management solution
   • DDesigning new detective security controls

   Show answer

   Answer: A

   Explanation

   Don't let this one trip you up. A seems to be too easy of an answer, but it's A. Part of the reason it tripped me up is anytime I learned about vender diversity, it was always in the context of anti-malware, SIEM, NIDS, etc. Never dawned on me that vendor diversity also applies to physical hardware, but it makes sense. Vender diversity is a part of the swiss cheese model, or defense-in-depth. Having your production server, and your backup server running identical configurations means that there's two perfectly aligned holes in the swiss cheese model. Meaning the integrity of the backup server cannot be trusted in the event of an attack that damages or shuts down the production server. Different hardware is a defense layer that gives the defenders a buffer time to get their operation back in order, and defend against potentially inbound attacks on the backup server.

   Source: Adapted from community discussion — Gravoc

   Next question

4. Question 544 · 856 in bank

   Which of the following strategies shifts risks that are not covered in an organization’s risk strategy?

   • ARisk transference
   • BRisk avoidance
   • CRisk mitigation
   • DRisk acceptance

   Show answer

   Answer: A

   Explanation

   Risk transference is a risk management strategy that involves shifting the financial burden of potential risks to a third party. This is typically done by purchasing insurance or transferring the risk to a vendor or business partner through contractual agreements. By transferring the risk, the organization aims to mitigate the potential financial impact of the risk and protect its assets.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 545 · 856 in bank

   A dynamic application vulnerability scan identified that code injection could be performed using a web form. Which of the following will be the best remediation to prevent this vulnerability?

   • AImplement input validations
   • BDeploy MFA
   • CUtilize a WAF
   • DConfigure HIPS

   Show answer

   Answer: A

   Explanation

   Implementing input validation is the best remediation to prevent code injection vulnerabilities. Input validation involves validating and sanitizing user inputs before processing them within the application. By doing so, the application can detect and prevent malicious inputs, such as SQL injection or other code injection attempts. Input validation helps ensure that data entered into web forms or other application inputs meets the expected format and criteria, thus mitigating the risk of code injection attacks. It is a fundamental security practice to protect against various types of injection attacks.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

6. Question 546 · 856 in bank

   A security administrator needs a method to secure data in an environment that includes some form of checks so that the administrator can track any changes. Which of the following should the administrator set up to achieve this goal?

   • ASPF
   • BGPO
   • CNAC
   • DFIM

   Show answer

   Answer: D

   Explanation

   File Integrity Monitoring (FIM) is a security feature that tracks changes to files and directories on a system. It helps administrators detect unauthorized changes, modifications, or deletions to critical files and data. FIM solutions use checksums or hash values to verify the integrity of files, comparing them to baseline values or known good states. If any discrepancies are found, alerts are generated, and administrators can take appropriate action to investigate and respond to potential security incidents. FIM is commonly used in environments where data security is essential, as it provides visibility into changes made to files, helping to detect potential security breaches or unauthorized access.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

7. Question 547 · 856 in bank

   An analyst is working on an email security incident in which the target opened an attachment containing a worm. The analyst wants to implement mitigation techniques to prevent further spread. Which of the following is the best course of action for the analyst to take?

   • AApply a DLP solution
   • BImplement network segmentation
   • CUtilize email content filtering.
   • DIsolate the infected attachment

   Show answer

   Answer: B

   Explanation

   Thanks! I only had 78 questions on the exam. There were 3 pbqs were from here. One was the virus one. 95% of the questions were from here. The problem is that there are so many questions that you don't know which ones will be on the exam. I had to guess on about 3 questions that I did not know the answer to.

   Source: Adapted from community discussion — Bdels

   References

   • Cisco documentation

   Next question

8. Question 548 · 856 in bank

   Sales team members have been receiving threatening voicemail messages and have reported these incidents to the IT security team. Which of the following would be MOST appropriate for the IT security team to analyze?

   • AAccess control
   • BSyslog
   • CSession Initiation Protocol traffic logs
   • DApplication logs

   Show answer

   Answer: C

   Explanation

   Since the threatening messages are reported to be voicemail messages, analyzing the Session Initiation Protocol (SIP) traffic logs would be the most appropriate action. SIP is a signaling protocol commonly used for initiating, maintaining, modifying, and terminating real-time communication sessions like voice and video calls over IP networks. Voicemail messages often involve SIP traffic, which includes information about the call setup and signaling details. Analyzing SIP traffic logs can help the IT security team identify the source of the threatening voicemail messages, track the call flow, and gather information about the calling party. This can be crucial for understanding the nature of the threat and taking appropriate actions to mitigate or prevent further incidents.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

9. Question 549 · 856 in bank

   Which of the following can be used to calculate the total loss expected per year due to a threat targeting an asset?

   • AEF x asset value
   • BALE / SLE
   • CMTBF x impact
   • DSLE x ARO

   Show answer

   Answer: D

   Explanation

   SLE stands for Single Loss Expectancy and is the expected monetary loss from a single incident. ARO stands for Annualized Rate of Occurrence and is the estimated number of times an incident is expected to occur in a year. ALE = SLE x ARO The other options are incorrect. EF x asset value is the formula for calculating the Exposure Factor, which is a measure of the potential loss from a single incident. ALE / SLE is the inverse of the formula for calculating the ALE. MTBF x impact is the formula for calculating the Mean Time Between Failures, which is a measure of the reliability of a system.

   Source: Adapted from community discussion — sujon_london

   Next question

10. Question 550 · 856 in bank

    Select 2

    A security engineer is hardening existing solutions to reduce application vulnerabilities. Which of the following solutions should the engineer implement FIRST? (Choose two.)

    • AAuto-update
    • BHTTP headers
    • CSecure cookies
    • DThird-party updates
    • EFull disk encryption
    • FSandboxing
    • GHardware encryption

    Show answer

    Answer: AF

    Explanation

    The scenario doesn't specify a web application. I just assumed a locally ran application so I chose A&F. Poorly worded question.

    Source: Adapted from community discussion — NetTech

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 541. 856 questions available.