SY0-601 practice questions 561–570

1. Question 561 · 856 in bank

   A company is expanding its threat surface program and allowing individuals to security test the company's internet-facing application. The company will compensate researchers based on the vulnerabilities discovered. Which of the following best describes the program the company is setting up?

   • AOpen-source intelligence
   • BBug bounty
   • CRed team
   • DPenetration testing

   Show answer

   Answer: B

   Explanation

   Bug bounty programs are initiatives where organizations invite external security researchers or "white-hat" hackers to find and report security vulnerabilities in their systems. Researchers are rewarded with compensation based on the severity and impact of the discovered vulnerabilities.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

2. Question 562 · 856 in bank

   Select 2

   An organization experiences a cybersecurity incident involving a command-and-control server. Which of the following logs should be analyzed to identify the impacted host? (Choose two.)

   • AApplication
   • BAuthentication
   • CError
   • DNetwork
   • EFirewall
   • FSystem

   Show answer

   Answer: DE

   Explanation

   Changing my answer Network logs (Option D): These logs can help identify network connections to the command-and-control server and provide information about source IP addresses (the impacted host) and destination IP addresses (the command-and-control server). Firewall logs (Option E): Firewall logs also track network traffic and can provide valuable information about source and destination IP addresses, helping identify the impacted host and its communication with the command-and-control server.

   Source: Adapted from community discussion — touisuzuki

   Next question

3. Question 563 · 856 in bank

   An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period. Which of the following data policies is the administrator carrying out?

   • ACompromise
   • BRetention
   • CAnalysis
   • DTransfer
   • EInventory

   Show answer

   Answer: B

   Explanation

   Retention policies specify how long certain types of data should be retained, archived, or stored within an organization. These policies are typically defined to comply with legal and regulatory requirements or to meet internal business needs. In this case, the administrator is ensuring that information about customer transactions is archived for the proper time period, which aligns with a retention policy. Option A, "Compromise," is not a standard data policy term and does not describe the action of archiving data. Option C, "Analysis," is a general term that may refer to the process of examining data, but it does not specifically relate to archiving data. Option D, "Transfer," refers to the movement of data from one location or system to another, but it does not specifically address the time period for which data should be archived. Option E, "Inventory," refers to the process of tracking and managing data assets within an organization, but it does not specifically relate to defining how long data should be retained.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

4. Question 564 · 856 in bank

   Select 2

   Data exfiltration analysis indicates that an attacker managed to download system configuration notes from a web server. The web-server logs have been deleted, but analysts have determined that the system configuration notes were stored in the database administrator's folder on the web server. Which of the following attacks explains what occurred? (Choose two.)

   • APass-the-hash
   • BDirectory traversal
   • CSQL injection
   • DPrivilege escalation
   • ECross-site scripting
   • FRequest forgery

   Show answer

   Answer: BD

   Explanation

   Answer: B. Directory traversal & D. Privilege escalation Directory traversal is a type of HTTP exploit in which a hacker uses the software on a web server to access data in a directory other than the server's root directory. If the attempt is successful, the threat actor can view restricted files or execute commands on the server. Privilege escalation is the act of exploiting a bug, a design flaw, or a configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user.

   Source: Adapted from community discussion — rodwave

   Next question

5. Question 565 · 856 in bank

   Select 2

   Which of the following are the MOST likely vectors for the unauthorized or unintentional inclusion of vulnerable code in a software company's final software releases? (Choose two.)

   • AUnsecure protocols
   • BUse of penetration-testing utilities
   • CWeak passwords
   • DIncluded third-party libraries
   • EVendors/supply chain
   • FOutdated anti-malware software

   Show answer

   Answer: DE

   Explanation

   The most likely vectors for the unauthorized or unintentional inclusion of vulnerable code in a software company's final software releases are: D. Included third-party libraries: Third-party libraries are often used in software development to expedite the development process or incorporate additional functionality. However, if these libraries contain vulnerabilities, they can introduce security risks into the final software releases. E. Vendors/supply chain: Supply chain attacks involve exploiting vulnerabilities in the software supply chain to compromise the integrity of software products. Attackers may target vendors or suppliers to inject malicious code or compromise the software during distribution, leading to the inclusion of vulnerable code in the final software releases. Both of these vectors involve dependencies external to the company's direct development process and represent common avenues for the unintentional inclusion of vulnerable code.

   Source: Adapted from community discussion — Geronemo

   Next question

6. Question 566 · 856 in bank

   An organization has a growing workforce that is mostly driven by additions to the sales department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering if the organization may need to scale down just as quickly as it scaled up. The CIO is also concerned about the organization's security and customer privacy. Which of the following would be BEST to address the CIO's concerns?

   • ADisallow new hires from using mobile devices for six months.
   • BSelect four devices for the sales department to use in a CYOD model.
   • CImplement BYOD for the sales department while leveraging the MDM.
   • DDeploy mobile devices using the COPE methodology.

   Show answer

   Answer: C

   Explanation

   Given the organization's growing workforce and the concerns regarding security and customer privacy, the best option to address the CIO's concerns would be: D. Deploy mobile devices using the COPE (Corporate-Owned, Personally Enabled) methodology. COPE allows the organization to maintain control over the mobile devices while still accommodating employees' personal use to some extent. With COPE, the organization provides mobile devices to its employees, ensuring that they adhere to corporate security policies and standards. This approach offers a balance between security and employee flexibility, addressing the CIO's concerns about security and customer privacy while still allowing employees to use mobile devices for business purposes.

   Source: Adapted from community discussion — Geronemo

   Next question

7. Question 567 · 856 in bank

   A company has limited storage space available and an online presence that cannot be down for more than four hours. Which of the following backup methodologies should the company implement to allow for the FASTEST database restore time in the event of a failure, while being mindful of the limited available storage space?

   • AImplement full tape backups every Sunday at 8:00 p.m. and perform nightly tape rotations.
   • BImplement differential backups every Sunday at 8:00 p.m. and nightly incremental backups at 8:00 p.m.
   • CImplement nightly full backups every Sunday at 8:00 p.m.
   • DImplement full backups every Sunday at 8:00 p.m. and nightly differential backups at 8:00 p.m.

   Show answer

   Answer: D

   Explanation

   Explanation: Full backups every Sunday provide a complete snapshot of the database, ensuring that all data is backed up. This ensures that in the event of a failure, the most recent complete dataset is available for restoration. Nightly differential backups capture all changes made since the last full backup, which allows for faster restoration compared to incremental backups. Differential backups require less storage space compared to full backups and provide faster restore times compared to incremental backups. This combination ensures that the company has the most recent complete backup available on Sundays and captures all changes efficiently during the week, minimizing the time required for restoration while conserving storage space.

   Source: Adapted from community discussion — Geronemo

   Next question

8. Question 568 · 856 in bank

   A startup company is using multiple SaaS and IaaS platforms to stand up a corporate infrastructure and build out a customer-facing web application. Which of the following solutions would be BEST to provide security, manageability, and visibility into the platforms?

   • ASIEM
   • BDLP
   • CCASB
   • DSWG

   Show answer

   Answer: C

   Explanation

   manageability, and visibility into multiple SaaS and IaaS platforms is Cloud Access Security Broker (CASB). CASB offers logging, auditing, access control, and encryption capabilities that can be critical when investigating security issues in a SaaS product. It provides a unified security solution for multiple cloud services, including SaaS and IaaS. CASB tools are based on four base concepts: visibility, compliance, data security, and threat protection.

   Source: Adapted from community discussion — sujon_london

   Next question

9. Question 569 · 856 in bank

   Which of the following technical controls is BEST suited for the detection and prevention of buffer overflows on hosts?

   • ADLP
   • BHIDS
   • CEDR
   • DNIPS

   Show answer

   Answer: C

   Explanation

   Are you considering that HIDS only detect and do not respond/prevent, the question is mentioning "prevent". A host intrusion detection system (HIDS) will give you deep visibility into what is happening on your critical system files. HID technologies are passive, aiming to identify suspicious activity but not prevent it. Therefore, HID solutions are used in conjunction with active intrusion prevention systems

   Source: Adapted from community discussion — GovoriLind

   Next question

10. Question 570 · 856 in bank

    A consultant is configuring a vulnerability scanner for a large, global organization in multiple countries. The consultant will be using a service account to scan systems with administrative privileges on a weekly basis, but there is a concern that hackers could gain access to the account and pivot throughout the global network. Which of the following would be BEST to help mitigate this concern?

    • ACreate different accounts for each region, each configured with push MFA notifications.
    • BCreate one global administrator account and enforce Kerberos authentication.
    • CCreate different accounts for each region, limit their logon times, and alert on risky logins.
    • DCreate a guest account for each region, remember the last ten passwords, and block password reuse.

    Show answer

    Answer: C

    Explanation

    To mitigate the concern of hackers gaining access to the service account and pivoting throughout the global network, the BEST solution would be to create different accounts for each region, limit their logon times, and alert on risky logins (C). Enforcing Kerberos authentication (Option B) is also a good security measure, but it should be used in conjunction with creating different accounts for each region. Kerberos authentication is used to authenticate users over insecure networks and can help prevent attackers from intercepting login credentials. Implementing multi-factor authentication (MFA) (Option A) is also a good security measure, but it should be used in addition to creating different accounts for each region. MFA adds an extra layer of security by requiring users to provide additional authentication factors, such as a code sent to their phone, in addition to their password.

    Source: Adapted from community discussion — sujon_london

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 561. 856 questions available.