SY0-601 practice questions 631–640

1. Question 631 · 856 in bank

   A security analyst has received an alert about PII being sent via email. The analyst's Chief Information Security Officer (CISO) has made it clear that PII must be handled with extreme care. From which of the following did the alert MOST likely originate?

   • AS/MIME
   • BDLP
   • CIMAP
   • DHIDS

   Show answer

   Answer: B

   Explanation

   DLP systems are specifically designed to monitor and prevent the unauthorized transmission of sensitive and confidential data, such as Personally Identifiable Information (PII), both within and outside an organization. The alert about PII being sent via email is most likely to have originated from a DLP system, which is responsible for detecting and preventing such incidents and ensuring that data is handled in accordance with the organization’s security policies and compliance requirements.

   Source: Adapted from community discussion — sujon_london

   Next question

2. Question 632 · 856 in bank

   A company has drafted an insider-threat policy that prohibits the use of external storage devices. Which of the following would BEST protect the company from data exfiltration via removable media?

   • AMonitoring large data transfer transactions in the firewall logs
   • BDeveloping mandatory training to educate employees about the removable media policy
   • CImplementing a group policy to block user access to system files
   • DBlocking removable-media devices and write capabilities using a host-based security tool

   Show answer

   Answer: D

   Explanation

   This provides a stronger layer of defense by physically restricting access to external storage devices, reducing the risk of accidental or intentional data transfers that could occur despite employee training.

   Source: Adapted from community discussion — ComPCertOn

   Next question

3. Question 633 · 856 in bank

   After a ransomware attack, a forensics company needs to review a cryptocurrency transaction between the victim and the attacker. Which of the following will the company MOST likely review to trace this transaction?

   • AThe public ledger
   • BThe NetFlow data
   • CA checksum
   • DThe event log

   Show answer

   Answer: A

   Explanation

   A crypto ledger keeps an immutable record of all transactions on a cryptocurrency network. This system helps keep users’ identities anonymous, while still maintaining an accurate history of transactions within the network.

   Source: Adapted from community discussion — JMB7448

   Next question

4. Question 634 · 856 in bank

   A network administrator is setting up wireless access points in all the conference rooms and wants to authenticate devices using PKI. Which of the following should the administrator configure?

   • AA captive portal
   • BPSK
   • C802.1X
   • DWPS

   Show answer

   Answer: C

   Explanation

   802.1X is a network authentication protocol that opens ports for network access when an organization authenticates a user's identity and authorizes them for access to the network. The user's identity is determined based on their credentials or certificate, which is confirmed by the RADIUS server.

   Source: Adapted from community discussion — mpengly88

   Next question

5. Question 635 · 856 in bank

   A security analyst is reviewing the following attack log output:

   

   Which of the following types of attacks does this MOST likely represent?

   • ARainbow table
   • BBrute-force
   • CPassword-spraying
   • DDictionary

   Show answer

   Answer: C

   Explanation

   A Password Spraying Attack is a type of brute force attack where a malicious actor attempts the same password on many accounts before moving on to another one and repeating the process. This is effective because many users use simple, predictable passwords, such as "password123."

   Source: Adapted from community discussion — mpengly88

   Next question

6. Question 636 · 856 in bank

   An organization has hired a security analyst to perform a penetration test. The analyst captures 1Gb worth of inbound network traffic to the server and transfers the pcap back to the machine for analysis. Which of the following tools should the analyst use to further review the pcap?

   • ANmap
   • BcURL
   • CNetcat
   • DWireshark

   Show answer

   Answer: D

   Explanation

   Nmap: Nmap is a network scanning tool used for discovering hosts and services on a network. cURL: cURL is a command-line tool for transferring data with URLs. It's commonly used to send and receive data over various protocols, such as HTTP. Netcat: Netcat (nc) is a versatile networking utility often referred to as the "Swiss Army knife" of networking. It can create TCP and UDP connections, transfer files, and perform various networking tasks. D. Wireshark: Wireshark is specifically designed for capturing and analyzing network packets. It provides a graphical user interface for dissecting and analyzing captured network data, making it the most appropriate tool for reviewing a pcap file to understand the content and behavior of the captured network traffic.

   Source: Adapted from community discussion — sujon_london

   Next question

7. Question 637 · 856 in bank

   An organization that is located in a flood zone is MOST likely to document the concerns associated with the restoration of IT operations in a:

   • Abusiness continuity plan.
   • Bcommunications plan.
   • Cdisaster recovery plan.
   • Dcontinuity of operations plan.

   Show answer

   Answer: C

   Explanation

   A disaster recovery plan (DRP) is a documented and structured approach that outlines the processes and procedures to recover and restore IT systems and operations after a disruptive event, such as a flood or other disaster In the flood zone, a disaster recovery plan would address the specific concerns and considerations related to the restoration of IT operations after a flood. While a business continuity plan (Option A) is closely related to a disaster recovery plan, it typically has a broader scope and encompasses the overall strategies and actions to ensure the continuity of business operations in the face of various disruptions including floods. Option B focuses on establishing effective communication channels during emergencies. A continuity of operations plan (Option D) is generally associated with government agencies and outlines procedures to ensure the continuous performance of essential functions during a wide range of emergencies.

   Source: Adapted from community discussion — sujon_london

   Next question

8. Question 638 · 856 in bank

   Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

   • ADisaster recovery plan
   • BIncident response procedure
   • CBusiness continuity plan
   • DChange management procedure

   Show answer

   Answer: D

   Explanation

   Change management procedure," is the correct answer when it comes to adhering to best practices for setting up a new set of firewall rules. creating a change procedure for the firewall configuration is one of the best practices for firewall rule configuration managing firewall rulesets and policies by a formal change management control process is also recommended. A change management procedure ensures that any changes made to the firewall configuration are done in a controlled and documented manner, reducing the risk of errors and unauthorized changes.

   Source: Adapted from community discussion — sujon_london

   Next question

9. Question 639 · 856 in bank

   During an engagement, penetration testers left USB keys that contained specially crafted malware in the company's parking lot. A couple days later, the malware contacted the command-and-control server, giving the penetration testers unauthorized access to the company endpoints. Which of the following will most likely be a recommendation in the engagement report?

   • AConduct an awareness campaign on the usage of removable media.
   • BIssue a user guidance program focused on vishing campaigns.
   • CImplement more complex password management practices.
   • DEstablish a procedure on identifying and reporting suspicious messages.

   Show answer

   Answer: A

   Next question

10. Question 640 · 856 in bank

    A company recently experienced a significant data loss when proprietary information was leaked to a competitor. The company took special precautions by using proper labels; however, email filter logs do not have any record of the incident. An investigation confirmed the corporate network was not breached, but documents were downloaded from an employee's COPE tablet and passed to the competitor via cloud storage. Which of the following is the best mitigation strategy to prevent this from happening in the future?

    • AUser training
    • BCASB
    • CMDM
    • DEDR

    Show answer

    Answer: C

    Explanation

    This is a typical question with many concepts to confuse. The key is to look at the incident; the incident involved an employee using a TABLET, downloading a file, and then uploading it to a competitor's cloud. The text does not specify that the employee used their own cloud to transfer the file, which would be odd, meaning they would download the file and then place it on their own cloud, and then what, grant access to the competitor? It doesn't make sense. In my opinion, the best solution is an MDM with specific policies prohibiting the download and exfiltration of data. The key point is that they mention it was a tablet. The answer, in my view, is MDM.

    Source: Adapted from community discussion — damianUY

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 631. 856 questions available.