SY0-601 practice questions 681–690

1. Question 681 · 856 in bank

   A privileged user at a company stole several proprietary documents from a server. The user also went into the log files and deleted all records of the incident. The systems administrator has just informed investigators that other log files are available for review. Which of the following did the administrator most likely configure that will assist the investigators?

   • AMemory dumps
   • BThe syslog server
   • CThe application logs
   • DThe log retention policy

   Show answer

   Answer: B

   Explanation

   B. The syslog server It is good security practice for organizations to have Syslog server configured and logs from all systems forwarded and stored to it, just in cases like this mentioned in the question, where attacker could get access to the host and delete all logs from it trying to cover his tracks.

   Source: Adapted from community discussion — predsednik

   Next question

2. Question 682 · 856 in bank

   Local guidelines require that all information systems meet a minimum security baseline to be compliant. Which of the following can security administrators use to assess their system configurations against the baseline?

   • ASOAR playbook
   • BSecurity control matrix
   • CRisk management framework
   • DBenchmarks

   Show answer

   Answer: D

   Explanation

   D. Benchmarks Security administrators can use benchmarks to assess their system configurations against a minimum security baseline required for compliance. Benchmarks are documents that provide guidance and best practices for configuring and securing various types of systems and software. These benchmarks are often created by trusted organizations, such as the Center for Internet Security (CIS) or the National Institute of Standards and Technology (NIST). Security control matrices and risk management frameworks are important tools for managing and assessing security controls and risks within an organization, but they are not typically used to directly assess system configurations against a specific security baseline. SOAR (Security Orchestration, Automation, and Response) playbooks are used for automating incident response and security processes and are not specifically designed for assessing system configurations against security baselines.

   Source: Adapted from community discussion — predsednik

   Next question

3. Question 683 · 856 in bank

   A company's public-facing website, https://www.organization.com, has an IP address of 166.18.75.6. However, over the past hour the SOC has received reports of the site's homepage displaying incorrect information. A quick nslookup search shows https://www.organization.com is pointing to 151.191.122.115. Which of the following is occurring?

   • ADoS attack
   • BARP poisoning
   • CDNS spoofing
   • DNXDOMAIN attack

   Show answer

   Answer: C

   Explanation

   C: Domain Name Server (DNS) spoofing, or DNS cache poisoning, is an attack involving manipulating DNS records to redirect users toward a fraudulent, malicious website that may resemble the user’s intended destination.

   Source: Adapted from community discussion — JMB7448

   Next question

4. Question 684 · 856 in bank

   An employee receives an email stating the employee won the lottery. The email includes a link that requests a name, mobile phone number, address, and date of birth be provided to confirm employee's identity before sending the prize. Which of the following best describes this type of email?

   • ASpear phishing
   • BWhaling
   • CPhishing
   • DVishing

   Show answer

   Answer: C

   Explanation

   Phishing seems like the correct answer to me. It is my understanding that spear fishing is not merely a phishing email sent to one person, but rather a tailored phishing email where the attacker incorporates knowledge pertaining to that specific individual (a document they were working on, or maybe a project they are in charge of). Furthermore, based on the wording of the question, we are unable to verify whether this email was sent en masse. All it mentions is that it was directed at an employee of a company. Was it sent to others? We don't know. There is no evidence to suggest that only this one employee received the email, so the "en masse" justification others have mentioned to eliminate phishing as an answer choice seems ill-advised

   Source: Adapted from community discussion — slapster

   Next question

5. Question 685 · 856 in bank

   A company currently uses passwords for logging in to company-owned devices and wants to add a second authentication factor. Per corporate policy, users are not allowed to have smartphones at their desks. Which of the following would meet these requirements?

   • ASmart card
   • BPIN code
   • CKnowledge-based question
   • DSecret key

   Show answer

   Answer: A

   Next question

6. Question 686 · 856 in bank

   The Chief Technology Officer of a local college would like visitors to utilize the school's Wi-Fi but must be able to associate potential malicious activity to a specific person. Which of the following would best allow this objective to be met?

   • ARequiring all new. on-site visitors to configure their devices to use WPS
   • BImplementing a new SSID for every event hosted by the college that has visitors
   • CCreating a unique PSK for every visitor when they arrive at the reception area
   • DDeploying a captive portal to capture visitors’ MAC addresses and names

   Show answer

   Answer: D

   Explanation

   D. Deploying a captive portal to capture visitors’ MAC addresses and names: A captive portal forces all users trying to access the Internet over Wi-Fi to view a special web page and take action, usually authentication or acceptance of terms and conditions, before they can get connected. In this scenario, by capturing visitors' names along with their device's MAC address, the college can associate network activity with specific individuals. The other options do not effectively link activity to a specific person

   Source: Adapted from community discussion — BlackSpider

   Next question

7. Question 687 · 856 in bank

   Which of the following terms describes a broad range of information that is sensitive to a specific organization?

   • APublic
   • BTop secret
   • CProprietary
   • DOpen-source

   Show answer

   Answer: C

   Explanation

   Professor Messer notes: • Proprietary – Data that is the property of an organization – May also include trade secrets – Often data unique to an organization

   Source: Adapted from community discussion — IQ30

   Next question

8. Question 688 · 856 in bank

   Which of the following is most likely associated with introducing vulnerabilities on a corporate network by the deployment of unapproved software?

   • AHacktivists
   • BScript kiddies
   • CCompetitors
   • DShadow IT

   Show answer

   Answer: D

   Next question

9. Question 689 · 856 in bank

   A cybersecurity incident response team at a large company receives notification that malware is present on several corporate desktops. No known indicators of compromise have been found on the network. Which of the following should the team do first to secure the environment?

   • AContain the impacted hosts.
   • BAdd the malware to the application blocklist.
   • CSegment the core database server.
   • DImplement firewall rules to block outbound beaconing.

   Show answer

   Answer: A

   Explanation

   A. Contain the impacted hosts. The incident response process on the exam has six steps— 1.preparation, 2. identification, 3. CONTAINMENT - THIS is where we are now in this example 4. eradication, 5. recovery, and 6. lessons learned.

   Source: Adapted from community discussion — predsednik

   Next question

10. Question 690 · 856 in bank

    An administrator receives the following network requirements for a data integration with a third-party vendor:

    

    Which of the following is the most appropriate response for the administrator to send?

    • AFTP is an insecure protocol and should not be used.
    • BPort 8080 is a non-standard port and should be blocked.
    • CSSH protocol version 1 is obsolete and should not be used.
    • DCertificate stapling on port 443 is a security risk that should be mitigated.

    Show answer

    Answer: A

    Explanation

    Based on the provided options and the information given, the most appropriate response is: A. FTP is an insecure protocol and should not be used

    Source: Adapted from community discussion — 32d799a

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 681. 856 questions available.