SY0-601 practice questions 741–750

1. Question 741 · 856 in bank

   After returning from a conference, a user's laptop has been operating slower than normal and overheating, and the fans have been running constantly. During the diagnosis process, an unknown piece of hardware is found connected to the laptop's motherboard. Which of the following attack vectors was exploited to install the hardware?

   • ARemovable media
   • BSpear phishing
   • CSupply chain
   • DDirect access

   Show answer

   Answer: D

   Explanation

   Security+ 601 Objectives Section 1.5 Explain different threat actors, vectors, and intelligence sources. Vectors: * Direct Access * Email * Supply Chain * Social Media * Removable media * Cloud The answer is *most likely* direct access, as the problem started after going to the conference. It's implied someone gained physical access to this laptop and installed hardware on the motherboard -or- plugged in a USB drive. It's unlikely, however it's possible a supply chain attacker could have also installed hardware inside the laptop prior to shipping to a company. Either way, the attacker would have needed direct access to complete this attack. It's more general than the other options, and covers all possibilities.

   Source: Adapted from community discussion — CTE_Instructor

   Next question

2. Question 742 · 856 in bank

   A company wants to ensure that all employees in a given department are trained on each job role to help with employee burnout and continuity of business operations in the event an employee leaves the company. Which of the following should the company implement?

   • ASeparation of duties
   • BJob rotation
   • CMandatory vacations
   • DLeast privilege

   Show answer

   Answer: B

   Next question

3. Question 743 · 856 in bank

   Various stakeholders are meeting to discuss their hypothetical roles and responsibilities in a specific situation, such as a security incident or major disaster. Which of the following best describes this meeting?

   • APenetration test
   • BContinuity of operations planning
   • CTabletop exercise
   • DSimulation

   Show answer

   Answer: C

   Explanation

   C. Tabletop exercise During a tabletop exercise: Participants review and discuss the hypothetical scenario. They simulate their responses, actions, and decision-making processes. The exercise helps identify gaps in plans and procedures. It facilitates communication and coordination among different stakeholder

   Source: Adapted from community discussion — Hs1208

   Next question

4. Question 744 · 856 in bank

   Which of the following threat actors is most likely to use a high level of sophistication and potentially zero-day exploits to target organizations and systems?

   • AAPT groups
   • BScript kiddies
   • CHacktivists
   • DEthical hackers

   Show answer

   Answer: A

   Explanation

   A. APT groups APT (Advanced Persistent Threat) groups are most likely to use a high level of sophistication and potentially zero-day exploits to target organizations and systems. APTs are well-resourced and organized adversaries with specific objectives, often associated with nation-states or state-sponsored entities. They employ advanced techniques, including the development or use of zero-day vulnerabilities, to gain unauthorized access, maintain persistence, and exfiltrate sensitive information over an extended period.

   Source: Adapted from community discussion — salah112

   Next question

5. Question 745 · 856 in bank

   A company is implementing a vendor's security tool in the cloud. The security director does not want to manage users and passwords specific to this tool but would rather utilize the company's standard user directory. Which of the following should the company implement?

   • A802.1X
   • BSAML
   • CRADIUS
   • DCHAP

   Show answer

   Answer: B

   Explanation

   Based on the information provided, the company should implement SAML as the protocol for exchanging authentication and authorization data between the coud-based security tool and the company's user directory. SAML is an open-standard protocol that uses HTTP or HTTPS as the transport protocol and can encrypt all the data sent between the identity provider (idP) and the service provider. SAML also enables Single Sign-On (SSO), which means that users do not have to enter their credentials multiple times for different applications.

   Source: Adapted from community discussion — johnabayot

   Next question

6. Question 746 · 856 in bank

   An organization wants to ensure it can track changes between software deployments. Which of the following concepts should the organization implement?

   • AContinuous monitoring
   • BRights management
   • CNon-repudiation
   • DVersion control

   Show answer

   Answer: D

   Explanation

   D. Version control To ensure the ability to track changes between software deployments, the organization should implement version control. Version control, also known as source code management or revision control, is a system that tracks changes to source code, documentation, and other files, enabling teams to collaborate and manage different versions of software throughout its development lifecycle.

   Source: Adapted from community discussion — salah112

   Next question

7. Question 747 · 856 in bank

   A company has implemented a policy that requires two people to agree in order to push any changes from the test codebase repository into production. Which of the following best describes this control type?

   • ADetective
   • BTechnical
   • CPhysical
   • DOperational

   Show answer

   Answer: D

   Explanation

   Detective • May not prevent or deter access, but it will identify and record any attempted or successful intrusion • Operates during an attack Technical • Controls implemented in operating systems, software, and security appliances Physical • Controls such as alarms, gateways, and locks that deter access to premises and hardware Operational • Controls that depend on a person for implementation So has to be D. Operational

   Source: Adapted from community discussion — Mizzcoors

   Next question

8. Question 748 · 856 in bank

   A security administrator is reviewing reports about suspicious network activity occurring on a subnet. Users on the network report that connectivity to various websites is intermittent. The administrator logs in to a workstation and reviews the following command output:

   

   Which of the following best describes what is occurring on the network?

   • AARP poisoning
   • BOn-path attack
   • CURL redirection
   • DIP address conflicts

   Show answer

   Answer: A

   Explanation

   The best answer is A. ARP poisoning. This is a type of attack where an attacker sends false ARP messages to a network to associate their own MAC address with the IP addresses of other devices. This allolws the attacker to intercept, modify, or block the network traffic intended for those devices. The command output shows the same MAC address is associated with multiple IP addresses on the network, which is a sign of ARP poisoning. The attacker is likely using the this techinque to perform a man-in-the-middle attack and disrupt the network connectivity of the users.

   Source: Adapted from community discussion — johnabayot

   Next question

9. Question 749 · 856 in bank

   A security analyst is looking for a way to categorize and share a threat actor's TTPs with colleagues at a partner organization. Which of the following would be the best method to achieve this goal?

   • AReleasing the lessons-learned report
   • BUsing the MITRE ATT&CK framework
   • CSharing the CVE IDs used in attacks
   • DSending relevant log files and pcaps

   Show answer

   Answer: B

   Explanation

   B. Using the MITRE ATT&CK framework MITRE ATT&CK provides a standardized way to categorize and share information about threat actors' Tactics, Techniques, and Procedures (TTPs). This framework would be a suitable method for a security analyst to categorize and share information about a threat actor's TTPs with colleagues at a partner organization.

   Source: Adapted from community discussion — tolani_adetunji

   Next question

10. Question 750 · 856 in bank

    A systems administrator wants to add a second factor to the single sign-on portal that the organization uses. Currently, only a username and password are required. Which of the following should the administrator implement to best meet this requirement?

    • APersonal verification questions
    • BSoftware-based TOTP
    • CLog-in image checks
    • DSecondary PIN code

    Show answer

    Answer: B

    Explanation

    A. Personal verification questions - something you know B. Software-based TOTP - something you have C. Log-in image checks - something you know D. Secondary PIN code - something you know

    Source: Adapted from community discussion — psowrong

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 741. 856 questions available.