SY0-601 practice questions 651–660

1. Question 651 · 856 in bank

   Which of the following best describes a use case for a DNS sinkhole?

   • AAttackers can see a DNS sinkhole as a highly valuable resource to identify a company's domain structure.
   • BA DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.
   • CA DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.
   • DA DNS sinkhole can be set up to attract potential attackers away from a company's network resources.

   Show answer

   Answer: C

   Explanation

   This was my initial understanding of a sinkhole A DNS sinkhole, also known as a sinkhole server, Internet sinkhole, or Blackhole DNS[1] is a Domain Name System (DNS) server that has been configured to hand out non-routable addresses for a certain set of domain names. Computers that use the sinkhole fail to access the real site.[2] The higher up the DNS resolution chain the sinkhole is, the more requests will fail, because of the greater number of lower nameservers that in turn serve a greater number of clients. Some of the larger botnets have been made unusable by top-level domain sinkholes that span the entire Internet.[3] DNS Sinkholes are effective at detecting and blocking bots and other malicious traffic. DNS sinkholing is used to provide wrong DNS resolution and alternate the path of the users to different resources instead of the malicious or non-accessible content. A sinkhole is a way of redirecting malicious internet traffic so that it can be captured and analyzed by security analysts. Sinkholes are most often used to seize control of botnets by interrupting the DNS names of the botnet that is used by the malware. https://resources.infosecinstitute.com/topics/general-security/dns-sinkhole/

   Source: Adapted from community discussion — Rowdy_47

   Next question

2. Question 652 · 856 in bank

   Which of the following explains why an attacker cannot easily decrypt passwords using a rainbow table attack?

   • ADigital signatures
   • BSalting
   • CHashing
   • DPerfect forward secrecy

   Show answer

   Answer: B

   Explanation

   "If hackers gain access to the list of password hashes, they can crack all passwords very quickly with a rainbow table. The prevalence of rainbow table attacks has dramatically decreased due to a technique known as “salting.” Salting is a modern technique used to thwart rainbow table attacks. It involves adding an extra random value to every hashed password to create a different hash value. Most modern password authentication systems include salting, which has significantly lessened the number of successful rainbow table attacks. " https://www.beyondidentity.com/glossary/rainbow-table-attack

   Source: Adapted from community discussion — CanBaB

   Next question

3. Question 653 · 856 in bank

   The SOC for a large MSSP is meeting to discuss the lessons learned from a recent incident that took much too long to resolve. This type of incident has become more common in recent weeks and is consuming large amounts of the analysts' time due to manual tasks being performed. Which of the following solutions should the SOC consider to BEST improve its response time?

   • AConfigure a NIDS appliance using a Switched Port Analyzer.
   • BCollect OSINT and catalog the artifacts in a central repository.
   • CImplement a SOAR with customizable playbooks.
   • DInstall a SIEM with community-driven threat intelligence.

   Show answer

   Answer: C

   Explanation

   SOAR (Security Orchestration, Automation, and Response) Can use either playbook or runbook. It assists in collecting threat related data from a range of sources and automate responses to low level threats. (frees up some of the CSIRT time)

   Source: Adapted from community discussion — Tjank

   Next question

4. Question 654 · 856 in bank

   A company reduced the area utilized in its data center by creating virtual networking through automation and by creating provisioning routes and rules through scripting. Which of the following does this example describe?

   • AIaC
   • BMSSP
   • CContainers
   • DSaaS

   Show answer

   Answer: A

   Explanation

   The scenario described is an example of Infrastructure as Code (IaC). IaC is a key devOps practice that involves managing and provisioning computing infrastructure through machine-readable script files, rather than through physical hardware configuration or interactive configuration tools. This approach can help in automating the process of setting up, changing, and versioning infrastructure efficiently and it can be particularly useful in managing virtualized and cloud-based services, which is the case in the scenario provided.

   Source: Adapted from community discussion — DarexTech100

   Next question

5. Question 655 · 856 in bank

   Historically, a company has had issues with users plugging in personally owned removable media devices into corporate computers. As a result, the threat of malware incidents is almost constant. Which of the following would best help prevent the malware from being installed on the computers?

   • AAUP
   • BNGFW
   • CDLP
   • DEDR

   Show answer

   Answer: D

   Explanation

   EDR can help prevent malware infections by blocking unauthorized processes, quarantining infected files, alerting security teams, and providing forensic analysis.

   Source: Adapted from community discussion — johnabayot

   Next question

6. Question 656 · 856 in bank

   While investigating a recent security breach, an analyst finds that an attacker gained access by SQL injection through a company website. Which of the following should the analyst recommend to the website developers to prevent this from reoccurring?

   • ASecure cookies
   • BInput sanitization
   • CCode signing
   • DBlocklist

   Show answer

   Answer: B

   Explanation

   To prevent SQL injection attacks, input sanitization is a crucial security measure. SQL injection occurs when an attacker injects malicious SQL code into input fields on a website, exploiting vulnerabilities in the application's handling of user input. Input sanitization involves validating and cleaning user inputs to ensure they don't contain malicious code.

   Source: Adapted from community discussion — BigBadWolff

   Next question

7. Question 657 · 856 in bank

   Which of the following best describes the risk that is present once mitigations are applied?

   • AControl risk
   • BResidual risk
   • CInherent risk
   • DRisk awareness

   Show answer

   Answer: B

   Explanation

   The residual risk is the amount of risk or danger associated with an action or event remaining after natural or inherent risks have been reduced by risk controls.

   Source: Adapted from community discussion — Cisco103

   Next question

8. Question 658 · 856 in bank

   A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization’s existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would best meet the architect's objectives?

   • ATrusted Platform Module
   • BIaaS
   • CHSMaaS
   • DPaaS

   Show answer

   Answer: C

   Explanation

   HSM as a Service (HSMaaS), Hardware security modules (HSMs) are fortified, tamper-resistant hardware components that produce, safeguard, and manage keys for encrypting and decrypting data and establishing digital signatures and certificates.

   Source: Adapted from community discussion — rr_1985_ma

   Next question

9. Question 659 · 856 in bank

   Which of the following best represents an application that does not have an on-premises requirement and is accessible from anywhere?

   • APaaS
   • BHybrid cloud
   • CPrivate cloud
   • DIaaS
   • ESaaS

   Show answer

   Answer: E

   Next question

10. Question 660 · 856 in bank

    During an investigation, events from two affected servers in the same subnetwork occurred at the same time: Server 1: 192.168.10.1 [01/Apr/2021:06:00:00 PST] SAN access denied for user 'admin' Server 2: 192.168.10.6 [01/Apr/2021:06:01:01 CST] SAN access successful for user 'admin' Which of the following should be consistently configured to prevent the issue seen in the logs?

    • AGeolocation
    • BTOTP
    • CNTP
    • DMFA

    Show answer

    Answer: C

    Explanation

    C. NTP (Network Time Protocol) NTP is used to synchronize the time across devices on a network. Inconsistent time settings between servers can lead to confusion during investigations and issues with event correlation. Configuring NTP ensures that all devices in the network maintain accurate and synchronized time, which is essential for proper log management, security analysis, and event coordination. (synchronized is the word here)

    Source: Adapted from community discussion — [Removed]

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 651. 856 questions available.