SY0-601 practice questions 611–620

1. Question 611 · 856 in bank

   A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. Upon investigation, a security analyst identifies the following: • The legitimate website's IP address is 10.1.1.20 and eRecruit.local resolves to this IP. • The forged website's IP address appears to be 10.2.12.99, based on NetFlow records. • All three of the organization's DNS servers show the website correctly resolves to the legitimate IP. • DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise. Which of the following MOST likely occurred?

   • AA reverse proxy was used to redirect network traffic.
   • BAn SSL strip MITM attack was performed.
   • CAn attacker temporarily poisoned a name server.
   • DAn ARP poisoning attack was successfully executed.

   Show answer

   Answer: C

   Explanation

   an attacker temporarily poisoned a name server, occurred. The DNS query logs show that one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise, indicating that the attacker may have compromised a DNS server to replace the valid IP address for a trusted website with a forged one. This type of attack is known as a pharming attack, where the attacker compromises the process of DNS resolution to redirect network traffic to a forged website

   Source: Adapted from community discussion — sujon_london

   Next question

2. Question 612 · 856 in bank

   A recent audit uncovered a key finding regarding the use of a specific encryption standard in a web application that is used to communicate with business customers. Due to the technical limitations of its customers, the company is unable to upgrade the encryption standard. Which of the following types of controls should be used to reduce the risk created by this scenario?

   • APhysical
   • BDetective
   • CPreventive
   • DCompensating

   Show answer

   Answer: D

   Explanation

   To reduce the risk created by this situation, compensating controls should be used. Compensating controls are alternative measures that can be put in place when a primary control is not feasible or effective. These controls are designed to compensate for the lack of a primary control and reduce the risk to an acceptable level. In this case, the company could implement compensating controls such as increasing the frequency of security audits, implementing intrusion detection systems, and restricting access to sensitive data.

   Source: Adapted from community discussion — sujon_london

   Next question

3. Question 613 · 856 in bank

   Which of the following is a team of people dedicated to testing the effectiveness of organizational security programs by emulating the techniques of potential attackers?

   • ARed team
   • BWhite team
   • CBlue team
   • DPurple team

   Show answer

   Answer: A

   Next question

4. Question 614 · 856 in bank

   A security assessment determines DES and 3DES are still being used on recently deployed production servers. Which of the following did the assessment identify?

   • AUnsecure protocols
   • BDefault settings
   • COpen permissions
   • DWeak encryption

   Show answer

   Answer: D

   Explanation

   The assessment identified D. Weak encryption. DES (Data Encryption Standard) and 3DES (Triple DES) are considered outdated and insecure encryption algorithms due to their relatively short key lengths and susceptibility to certain types of attacks.

   Source: Adapted from community discussion — DarexTech100

   Next question

5. Question 615 · 856 in bank

   The cost of removable media and the security risks of transporting data have become too great for a laboratory. The laboratory has decided to interconnect with partner laboratories to make data transfers easier and more secure. The Chief Security Officer (CSO) has several concerns about proprietary data being exposed once the interconnections are established. Which of the following security features should the network administrator implement to prevent unwanted data exposure to users in partner laboratories?

   • AVLAN zoning with a file-transfer server in an external-facing zone
   • BDLP running on hosts to prevent file transfers between networks
   • CNAC that permits only data-transfer agents to move data between networks
   • DVPN with full tunneling and NAS authenticating through the Active Directory

   Show answer

   Answer: D

   Explanation

   For the scenario described where proprietary data might be exposed once interconnections are established with partner laboratories, option D (VPN with full tunneling and NAS authenticating through the Active Directory) offers a holistic security solution. It combines the encrypted communication features of a VPN with the strong user and device authentication mechanisms of Active Directory.

   Source: Adapted from community discussion — 32d799a

   Next question

6. Question 616 · 856 in bank

   A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better:

   • Avalidate the vulnerability exists in the organization's network through penetration testing.
   • Bresearch the appropriate mitigation techniques in a vulnerability database.
   • Cfind the software patches that are required to mitigate a vulnerability.
   • Dprioritize remediation of vulnerabilities based on the possible impact.

   Show answer

   Answer: D

   Explanation

   The CVSS score is included in vulnerability assessment reports because it allows organizations to prioritize the remediation of vulnerabilities based on the possible impact. Vulnerabilities with a higher CVSS score should be prioritized for remediation, as they are more likely to be exploited and have a greater impact on the organization.

   Source: Adapted from community discussion — sujon_london

   Next question

7. Question 617 · 856 in bank

   A security analyst is performing a forensic investigation involving compromised account credentials. Using the Event Viewer, the analyst was able to detect the following message: "Special privileges assigned to new logon." Several of these messages did not have a valid logon associated with the user before these privileges were assigned. Which of the following attacks is MOST likely being detected?

   • APass-the-hash
   • BBuffer overflow
   • CCross-site scripting
   • DSession replay

   Show answer

   Answer: A

   Explanation

   Pass-the-hash is an attack technique that attackers use to obtain the NTLM or LANMAN hash of a user's password and then use it to authenticate to other systems and resources to which the account has access to achieve lateral movement within the network. This attack is possible because Windows stores password hashes in memory, and an attacker can steal these hashes and use them to authenticate to other systems without knowing the actual password

   Source: Adapted from community discussion — sujon_london

   Next question

8. Question 618 · 856 in bank

   Company engineers regularly participate in a public Internet forum with other engineers throughout the industry. Which of the following tactics would an attacker MOST likely use in this scenario?

   • AWatering-hole attack
   • BCredential harvesting
   • CHybrid warfare
   • DPharming

   Show answer

   Answer: A

   Explanation

   A watering-hole attack involves compromising a website or online resource that a particular group of people frequently visit. In this case, the public Internet forum that the engineers use would be the "watering hole."

   Source: Adapted from community discussion — 32d799a

   Next question

9. Question 619 · 856 in bank

   A business operations manager is concerned that a PC that is critical to business operations will have a costly hardware failure soon. The manager is looking for options to continue business operations without incurring large costs. Which of the following would mitigate the manager's concerns?

   • AImplement a full system upgrade.
   • BPerform a physical-to-virtual migration.
   • CInstall uninterruptible power supplies.
   • DPurchase cybersecurity insurance.

   Show answer

   Answer: B

   Explanation

   I got for B. A. Implement a full system upgrade. (Not cost effective) B. Perform a physical-to-virtual migration. (Cloud would be much more redundant against physical hardware breaking) C. Install uninterruptible power supplies. (Would only help really if an external power failure, would do nothing if say a hard drive fails) D. Purchase cybersecurity insurance. (Hardware will still fail)

   Source: Adapted from community discussion — xxxdolorxxx

   Next question

10. Question 620 · 856 in bank

    As company uses wireless for all laptops and keeps a very detailed record of its assets, along with a comprehensive list of devices that are authorized to be on the wireless network. The Chief Information Officer (CIO) is concerned about a script kiddie potentially using an unauthorized device to brute force the wireless PSK and obtain access to the internal network. Which of the following should the company implement to BEST prevent this from occurring?

    • AA BPDU guard
    • BWPA-EAP
    • CIP filtering
    • DA WIDS

    Show answer

    Answer: B

    Explanation

    A WIDS would only be a detective control, not a preventative control as required by the question. Would B be a better answer here?

    Source: Adapted from community discussion — LeonardSnart

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 611. 856 questions available.