SY0-601 practice questions 51–60

1. Question 51 · 856 in bank

   A security analyst is evaluating solutions to deploy an additional layer of protection for a web application. The goal is to allow only encrypted communications without relying on network devices. Which of the following can be implemented?

   • AHTTP security header
   • BDNSSEC implementation
   • CSRTP
   • DS/MIME

   Show answer

   Answer: A

   Explanation

   When enabled on the server, HTTP Strict Transport Security (HSTS), part of HTTP Security header, enforces the use of encrypted HTTPS connections instead of plain-text HTTP communication.

   Source: Adapted from community discussion — stoneface

   Next question

2. Question 52 · 856 in bank

   A company labeled some documents with the public sensitivity classification. This means the documents can be accessed by:

   • Aemployees of other companies and the press.
   • Ball members of the department that created the documents.
   • Conly the company's employees and those listed in the document.
   • Donly the individuals listed in the documents.

   Show answer

   Answer: A

   Explanation

   Public (unclassified)—there are no restrictions on viewing the data. Public information presents no risk to an organization if it is disclosed but does present a risk if it is modified or not available.

   Source: Adapted from community discussion — stoneface

   Next question

3. Question 53 · 856 in bank

   Which of the following is the MOST relevant security check to be performed before embedding third-party libraries in developed code?

   • ACheck to see if the third party has resources to create dedicated development and staging environments.
   • BVerify the number of companies that downloaded the third-party code and the number of contributions on the code repository.
   • CAssess existing vulnerabilities affecting the third-party code and the remediation efficiency of the libraries' developers.
   • DRead multiple penetration-testing reports for environments running software that reused the library.

   Show answer

   Answer: C

   Explanation

   Before embedding third-party libraries in developed code, it is crucial to assess the existing vulnerabilities in the third-party code and evaluate the responsiveness and efficiency of the library developers in addressing these vulnerabilities. This check helps to ensure that the third-party libraries are secure and do not introduce unnecessary risks into the developed code. The other options may provide valuable information about the third-party libraries, but assessing existing vulnerabilities and the responsiveness of the library developers is the most relevant security check in this context.

   Source: Adapted from community discussion — Protract8593

   Next question

4. Question 54 · 856 in bank

   A help desk technician receives an email from the Chief Information Officer (CIO) asking for documents. The technician knows the CIO is on vacation for a few weeks. Which of the following should the technician do to validate the authenticity of the email?

   • ACheck the metadata in the email header of the received path in reverse order to follow the email's path.
   • BHover the mouse over the CIO's email address to verify the email address.
   • CLook at the metadata in the email header and verify the ג€From:ג€ line matches the CIO's email address.
   • DForward the email to the CIO and ask if the CIO sent the email requesting the documents.

   Show answer

   Answer: A

   Explanation

   I don't know why so many people think its D. Forwarding a possibly malicious email to anyone much less the CIO and being like "this you?" seems crazy especially since it says he is on vacation for a few weeks. He likely wouldn't reply quickly and if he did it would be with "why would you forward this to me?"

   Source: Adapted from community discussion — revolt54

   Next question

5. Question 55 · 856 in bank

   A company needs to validate its updated incident response plan using a real-world scenario that will test decision points and relevant incident response actions without interrupting daily operations. Which of the following would BEST meet the company's requirements?

   • ARed-team exercise
   • BCapture-the-flag exercise
   • CTabletop exercise
   • DPhishing exercise

   Show answer

   Answer: C

   Explanation

   A Cyber Security tabletop exercise is a discussion-based event (not real). If they are looking for "real world" solution to validate their IRP then the best option would be a "Red Team" as they can simulate a real-world event testing your organizations IRP. let me know If I am missing something.

   Source: Adapted from community discussion — TR3Y

   Next question

6. Question 56 · 856 in bank

   Security analysts are conducting an investigation of an attack that occurred inside the organization's network. An attacker was able to collect network traffic between workstations throughout the network. The analysts review the following logs:

   

   The Layer 2 address table has hundreds of entries similar to the ones above. Which of the following attacks has MOST likely occurred?

   • ASQL injection
   • BDNS spoofing
   • CMAC flooding
   • DARP poisoning

   Show answer

   Answer: C

   Explanation

   Answer: MAC flooding The question mentions that the table is on Layer 2 which is the Data link layer. The data-link layer is where switches operates on to move traffic. Switches will use MAC addresses to find the physical address of the device. This is because the Layer 2 address(MAC Address) will be unique on the local network. MAC flooding is a cyber attack that overflows the MAC Table (Layer 2 Table) of switches by sending out invalid MAC addresses. When a MAC Address table is full, the switch is no longer able to save new addresses, so it will enter into fail-open mode and begin broadcasting data (like a hub) to all ports. This will allow an attacker to get data packets intended for another computer and be able to steal sensitive information.

   Source: Adapted from community discussion — rodwave

   Next question

7. Question 57 · 856 in bank

   An administrator needs to protect user passwords and has been advised to hash the passwords. Which of the following BEST describes what the administrator is being advised to do?

   • APerform a mathematical operation on the passwords that will convert them into unique strings.
   • BAdd extra data to the passwords so their length is increased, making them harder to brute force.
   • CStore all passwords in the system in a rainbow table that has a centralized location.
   • DEnforce the use of one-time passwords that are changed for every login session.

   Show answer

   Answer: A

   Explanation

   Hashing is a cryptographic process that takes an input (such as a user password) and transforms it into a fixed-size, unique string of characters, known as the hash value or hash code. The hashing algorithm performs a one-way function, meaning it is not possible to reverse the process and retrieve the original password from the hash value alone. The resulting hash value is unique to the input, meaning different passwords will result in different hash values. By storing only the hash values of passwords instead of the passwords themselves, the administrator ensures that even if the database is compromised, the actual passwords are not exposed to attackers. When a user attempts to log in, the password they provide is hashed and compared to the stored hash value. If the hash values match, the password is considered correct, and access is granted.

   Source: Adapted from community discussion — Protract8593

   Next question

8. Question 58 · 856 in bank

   A security policy states that common words should not be used as passwords. A security auditor was able to perform a dictionary attack against corporate credentials. Which of the following controls was being violated?

   • APassword complexity
   • BPassword history
   • CPassword reuse
   • DPassword length

   Show answer

   Answer: A

   Explanation

   Answer: Password complexity Password complexity is a measure of how difficult a password is to guess in relation to any number of guessing or cracking methods. For the security auditor to be able to successfully perform a dictionary attack, that means that the credentials were too predictable and was likely a common password.

   Source: Adapted from community discussion — rodwave

   Next question

9. Question 59 · 856 in bank

   A SOC operator is analyzing a log file that contains the following entries:

   

   Which of the following explains these log entries?

   • ASQL injection and improper input-handling attempts
   • BCross-site scripting and resource exhaustion attempts
   • CCommand injection and directory traversal attempts
   • DError handling and privilege escalation attempts

   Show answer

   Answer: C

   Explanation

   Answer: Command injection and directory traversal attempts Directory traversal is when an attacker uses the software on a web server to access data in a directory other than the server's root directory. If the attempt is successful, the threat actor can view restricted files or execute commands on the server. Command injection is an attack that involves executing commands on a host. Typically, the threat actor injects the commands by exploiting an application vulnerability, such as insufficient input validation. The attacker is attempting to traverse the directory of the host and execute the cat command which could be used to print the contents of a file.

   Source: Adapted from community discussion — rodwave

   Next question

10. Question 60 · 856 in bank

    A security incident has been resolved. Which of the following BEST describes the importance of the final phase of the incident response plan?

    • AIt examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.
    • BIt returns the affected systems back into production once systems have been fully patched, data restored, and vulnerabilities addressed.
    • CIt identifies the incident and the scope of the breach, how it affects the production environment, and the ingress point.
    • DIt contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach.

    Show answer

    Answer: A

    Explanation

    Answer: It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future. The final phase of the incident response is also called the lessons learned or remediation step. ======================= Phases of the Incident Response Plan: 1. Preparation - Preparing for an attack and how to respond 2. Identification - Identifying the threat 3. Containment - Containing the threat 4. Eradication - Removing the threat 5. Recovery - Recovering affected systems 6. Lessons Learned - Evaluating the incident response, see where there can be improvements for a future incident.

    Source: Adapted from community discussion — rodwave

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 51. 856 questions available.