SY0-601 practice questions 731–740

1. Question 731 · 856 in bank

   A security analyst is reviewing an IDS alert and sees the following: C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe -noP -exe byPass -nonI -wind hidden -no1 -c dir;findstr /s maldinuv %USERPROFILE%\\*.lnk > %USERPROFILE%\Documents\iijlqe.ps1;%USERPROFILE%\Documents\iijlqe.psi;exit Which of the following triggered the IDS alert?

   • ABluesnarfing attack
   • BURL redirection attack
   • CFileless malware execution
   • DMacro-based denial of service

   Show answer

   Answer: C

   Explanation

   Fileless malware often uses legitimate system tools, such as PowerShell, to run malicious code directly in memory without dropping traditional executable files on disk. In this case, the command includes a PowerShell script that is being executed without the need for a separate executable file, making it characteristic of a fileless attack.

   Source: Adapted from community discussion — Hs1208

   Next question

2. Question 732 · 856 in bank

   A company wants to implement MFA. Which of the following enables the additional factor while using a smart card?

   • APIN
   • BHardware token
   • CUser ID
   • DSMS

   Show answer

   Answer: A

   Explanation

   Factors - Something you know - Something you have - Something you are In the question they say that they want MFA. one of the authentication factors is a smartcard which is something you have. In order to have MFA you need to have different authentication methods, in this case smart card is something you have and the only other answer that isn't something you have is PIN. A PIN is defined as something you know.

   Source: Adapted from community discussion — [Removed]

   Next question

3. Question 733 · 856 in bank

   A server administrator is reporting performance issues when accessing all internal resources. Upon further investigation, the security team notices the following: • A user's endpoint has been compromised and is broadcasting its MAC as the default gateway's MAC throughout the LAN. • Traffic to and from that endpoint is significantly greater than all other similar endpoints on the LAN. • Network ports on the LAN are not properly configured. • Wired traffic is not being encrypted properly. Which of the following attacks is most likely occurring?

   • ADDoS
   • BMAC flooding
   • CARP poisoning
   • DDHCP snooping

   Show answer

   Answer: C

   Explanation

   In an ARP poisoning attack, the attacker sends false ARP messages to associate their MAC address with the IP address of the default gateway or other devices on the network

   Source: Adapted from community discussion — Hs1208

   Next question

4. Question 734 · 856 in bank

   A security analyst is reviewing the following system command history on a computer that was recently utilized in a larger attack on the corporate infrastructure:

   

   Which of the following best describes what the analyst has discovered?

   • AA successful privilege escalation attack by a local user
   • BA user determining what level of permissions the user has
   • CA systems administrator performing routine maintenance
   • DAn attempt to utilize living-off-the-land binaries

   Show answer

   Answer: A

   Explanation

   These commands indicate that the user was trying to find ways to elevate their privileges using the same account or another account with higher privileges.

   Source: Adapted from community discussion — johnabayot

   Next question

5. Question 735 · 856 in bank

   During a forensic investigation, an analyst uses software to create a checksum of the affected subject's email file. Which of the following is the analyst practicing?

   • AChain of custody
   • BData recovery
   • CNon-repudiation
   • DIntegrity

   Show answer

   Answer: D

   Explanation

   The analyst is looking at the checksum. A checksum is repeating a message and checking the hashes to make sure that the hash from the original message is the same, hence maintaining integrity. correct me if I'm wrong.

   Source: Adapted from community discussion — [Removed]

   Next question

6. Question 736 · 856 in bank

   A software company has a shared codebase for multiple projects using the following strategy: • Unused features are deactivated but still present on the code. • New customer requirements trigger additional development work. Which of the following will most likely occur when the company uses this strategy?

   • AMalicious code
   • BDead code
   • COutsourced code
   • DCode obfuscation

   Show answer

   Answer: B

   Explanation

   Dead code refers to portions of a program's source code that are never executed during the program's runtime. In this strategy, features that are deactivated but still present in the code are effectively dead code. They are not actively used or executed, yet they remain in the codebase.

   Source: Adapted from community discussion — psowrong

   Next question

7. Question 737 · 856 in bank

   A security audit of an organization revealed that most of the IT staff members have domain administrator credentials and do not change the passwords regularly. Which of the following solutions should the security team propose to resolve the findings in the most complete way?

   • ACreating group policies to enforce password rotation on domain administrator credentials
   • BReviewing the domain administrator group, removing all unnecessary administrators, and rotating all passwords
   • CIntegrating the domain administrator's group with an IdP and requiring SSO with MFA for all access
   • DSecuring domain administrator credentials in a PAM vault and controlling access with role-based access control

   Show answer

   Answer: B

   Explanation

   I took the exam today and 90% from came from this dump I scored 800 so study this dump at least twice and you are good to go.

   Source: Adapted from community discussion — johnabayot

   Next question

8. Question 738 · 856 in bank

   Which of the following best describes a threat actor who is attempting to use commands found on a public code repository?

   • AScript kiddie
   • BState actor
   • CInsider threat
   • DCompetitor espionage

   Show answer

   Answer: A

   Explanation

   A script kiddie is someone who gets (prebuilt) script from someone. They are called script kiddie because they didn't make the code and there just taking someone's else's scripts and using them. an example is people using hacks (aimbot) on games like rust, Fortnite, apex, etc...

   Source: Adapted from community discussion — [Removed]

   Next question

9. Question 739 · 856 in bank

   While assessing the security of a web application, a security analyst was able to introduce unsecure strings through the application input fields by bypassing client-side controls. Which of the following solutions should the analyst recommend?

   • ACode signing
   • BHost-based intrusion detection system
   • CSecure cookies
   • DServer-side validation

   Show answer

   Answer: D

   Explanation

   server-side validation- essential for ensuring the security and integrity of data submitted through web application forms. In this scenario, the security analyst was able to introduce insecure strings by bypassing client-side controls. To prevent such issues, it is crucial to perform thorough validation on the server side. Code signing- is used to verify the integrity and authenticity of code host-based intrusion detection systems focus- on detecting malicious activities on a host secure cookies- help protect data during transmission and storage but do not address the issue of input validation.

   Source: Adapted from community discussion — pinkdog

   Next question

10. Question 740 · 856 in bank

    A vulnerability scan returned the following results: 2 Critical 5 High 15 Medium 98 Low Which of the following would the information security team most likely use to decide if all discovered vulnerabilities must be addressed and the order in which they should be addressed?

    • ARisk appetite
    • BRisk register
    • CRisk matrix
    • DRisk acceptance

    Show answer

    Answer: C

    Explanation

    C. Risk matrix A risk matrix is a tool commonly used by information security teams to assess and prioritize vulnerabilities based on their impact and likelihood. It helps in deciding which vulnerabilities should be addressed first and guides the allocation of resources for remediation efforts. The risk matrix typically categorizes risks (including vulnerabilities) into different levels based on severity, allowing organizations to focus on addressing the most critical ones.

    Source: Adapted from community discussion — salah112

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 731. 856 questions available.