SY0-601 practice questions 571–580

1. Question 571 · 856 in bank

   While troubleshooting a firewall configuration, a technician determines that a "deny any" policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable. Which of the following actions would prevent this issue?

   • ADocumenting the new policy in a change request and submitting the request to change management
   • BTesting the policy in a non-production environment before enabling the policy in the production network
   • CDisabling any intrusion prevention signatures on the "deny any" policy prior to enabling the new policy
   • DIncluding an “allow any" policy above the "deny any" policy

   Show answer

   Answer: A

   Explanation

   At first I thought B but I realize how impractical that would be in the real world. Unlike applications, you cannot deploy firewall policies in a test environment as the rules are declarative (you know something is getting blocked even if you don't know what exactly that will be). So, I'd go with A because the Change Advisory Board needs to go through the request, gauge the risks, rollback actions and points etc.

   Source: Adapted from community discussion — DChilds

   Next question

2. Question 572 · 856 in bank

   A network technician is installing a guest wireless network at a coffee shop. When a customer purchases an item, the password for the wireless network is printed on the receipt so the customer can log in. Which of the following will the technician MOST likely configure to provide the highest level of security with the least amount of overhead?

   • AWPA-EAP
   • BWEP-TKIP
   • CWPA-PSK
   • DWPS-PIN

   Show answer

   Answer: C

   Explanation

   I would have to disagree here, I think keeping a RADIUS server to authenticate users would be quite a bit of overhead. Also the question states that a password is printed on the receipt, but nothing about a username which would be required for an EAP connection AFIAK. I think the original answer of C is likely correct here, even if it isn't the security isn't as strong as WPA-EAP.

   Source: Adapted from community discussion — LeonardSnart

   Next question

3. Question 573 · 856 in bank

   Which of the following ISO standards is certified for privacy?

   • AISO 9001
   • BISO 27002
   • CISO 27701
   • DISO 31000

   Show answer

   Answer: C

   Explanation

   ISO 9001 - an internationally recognized standard for Quality Management Systems (QMS). It provides a framework and set of principles for organizations to ensure that their products and services consistently meet customer requirements and quality standards, while also aiming for continual improvement. 27002 - an international standard that provides guidelines and best practices for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It is part of the ISO/IEC 27000 family of standards, which addresses various aspects of information security management. 27701 is a relatively new international standard that focuses on privacy information management. ISO 31000 is an international standard that provides guidelines and principles for risk management.

   Source: Adapted from community discussion — AspiringNerd

   Next question

4. Question 574 · 856 in bank

   An organization suffered an outage, and a critical system took 90 minutes to come back online. Though there was no data loss during the outage, the expectation was that the critical system would be available again within 60 minutes. Which of the following is the 60-minute expectation an example of?

   • AMTBF
   • BRPO
   • CMTTR
   • DRTO

   Show answer

   Answer: D

   Explanation

   RTO (Recovery Time Objective): is a measure that defines the maximum allowable downtime for a system or service. It represents the time within which a system must be recovered and become operational again after an incident. In the given scenario, the 60-minute expectation of having the critical system available again falls under RTO. RTO specifies the organization's recovery goals for system availability.

   Source: Adapted from community discussion — sujon_london

   Next question

5. Question 575 · 856 in bank

   A junior security analyst is conducting an analysis after passwords were changed on multiple accounts without users' interaction. The SIEM have multiple login entries with the following text: suspicious event - user: scheduledtasks successfully authenticate on AD on abnormal time suspicious event - user: scheduledtasks failed to execute c:\weekly_checkups\amazing-3rdparty-domain-assessment.py suspicious event - user: scheduledtasks failed to execute c:\weekly_checkups\secureyourAD-3rdparty-compliance.sh suspicious event - user: scheduledtasks successfully executed c:\weekly_checkups\amazing-3rdparty-domain-assessment.py Which of the following is the MOST likely attack conducted on the environment?

   • AMalicious script
   • BPrivilege escalation
   • CDomain hijacking
   • DDNS poisoning

   Show answer

   Answer: A

   Explanation

   This is obviously A, malicious script. Look at the name of the script that is running: "amazing-3rdparty-domain-assessment.py" I'm sure they used the word amazing in the file name so that the script appears as a malicious script that is disguised as a 3rd party domain assessment script.

   Source: Adapted from community discussion — CertAddict69

   Next question

6. Question 576 · 856 in bank

   A security analyst needs to be proactive in understanding the types of attacks that could potentially target the company's executives. Which of the following intelligence sources should the security analyst review?

   • AVulnerability feeds
   • BTrusted automated exchange of indicator information
   • CStructured threat information expression
   • DIndustry information-sharing and collaboration groups

   Show answer

   Answer: D

   Explanation

   D. Industry information-sharing and collaboration groups. Industry information-sharing and collaboration groups, often referred to as Information Sharing and Analysis Centers (ISACs) or Information Sharing and Analysis Organizations (ISAOs), are organizations or groups that facilitate the exchange of threat intelligence and cybersecurity information among organizations within the same industry or sector. These groups provide a valuable source of real-time threat intelligence and insights into the specific threats and attack techniques that organizations within that industry may face. Analyzing information shared within these groups can help security analysts stay informed about emerging threats and vulnerabilities relevant to their sector, including those that could target executives. While the other options (A, B, and C) can provide valuable threat intelligence, they are not specifically focused on understanding threats targeting executives or tailored to a specific industry or sector.

   Source: Adapted from community discussion — touisuzuki

   Next question

7. Question 577 · 856 in bank

   An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has agreed to pay for each vulnerability that is discovered. Which of the following BEST represents the type of testing that will occur?

   • ABug bounty
   • BBlack-box
   • CGray-box
   • DWhite-box
   • ERed-team

   Show answer

   Answer: A

   Next question

8. Question 578 · 856 in bank

   A security analyst needs to determine how an attacker was able to use User3 to gain a foothold within a company’s network. The company's lockout policy requires that an account be locked out for a minimum of 15 minutes after three unsuccessful attempts. While reviewing the log files, the analyst discovers the following:

   

   Which of the following attacks MOST likely occurred?

   • ADictionary
   • BCredential-stuffing
   • CPassword-spraying
   • DBrute-force

   Show answer

   Answer: D

   Explanation

   I believe it’s Brute Force. Please let me know if I’m off in my understanding of the differences between Brute Force and Password Spraying: When I see password spraying, I see: User One (password attempt) User Two (password attempt) User Three (password attempt) And so on… When I see brute force, I see: User One (password attempt) User One (password attempt) User One (password attempt) User Two (password attempt) User Two (password attempt) And so on…

   Source: Adapted from community discussion — TM78

   Next question

9. Question 579 · 856 in bank

   Select 2

   Users have been issued smart cards that provide physical access to a building. The cards also contain tokens that can be used to access information systems. Users can log in to any thin client located throughout the building and see the same desktop each time. Which of the following technologies are being utilized to provide these capabilities? (Choose two.)

   • ACOPE
   • BVDI
   • CGPS
   • DTOTP
   • ERFID
   • FBYOD

   Show answer

   Answer: BE

   Explanation

   The technologies being utilized to provide physical access to a building and access to information systems through smart cards are RFID and VDI. RFID (Radio Frequency Identification) technology is used to read the information stored on the smart card and grant physical access to the building. VDI (Virtual Desktop Infrastructure) technology is used to provide users with a consistent desktop experience when logging in to any thin client located throughout the building. VDI allows users to access their virtual desktop from any device, anywhere, and at any time

   Source: Adapted from community discussion — sujon_london

   Next question

10. Question 580 · 856 in bank

    Select 2

    A security engineer needs to implement an MDM solution that complies with the corporate mobile device policy. The policy states that in order for mobile users to access corporate resources on their devices, the following requirements must be met: • Mobile device OSs must be patched up to the latest release. • A screen lock must be enabled (passcode or biometric). • Corporate data must be removed if the device is reported lost or stolen. Which of the following controls should the security engineer configure? (Choose two.)

    • AContainerization
    • BStorage segmentation
    • CPosturing
    • DRemote wipe
    • EFull-device encryption
    • FGeofencing

    Show answer

    Answer: CD

    Explanation

    If a mobile device does not meet the policy requirements, such as having an outdated OS or not being able to enable a screen lock, it should not be allowed access to corporate resources until it meets these requirements. to the point "posturing" becomes particularly relevant and first priority. Posturing, as part of a Mobile Device Management (MDM) solution, can assess the compliance of mobile devices with the corporate security policy. If a device is found to be non-compliant (e.g., due to an outdated OS or lack of a screen lock), the MDM solution can restrict or deny access to corporate resources until the device is brought into compliance. Posturing: Use posturing checks to verify that mobile devices comply with the policy's requirements, such as having an up-to-date OS and enabling a screen lock.

    Source: Adapted from community discussion — sujon_london

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 571. 856 questions available.