SY0-601 practice questions 761–770

1. Question 761 · 856 in bank

   An employee finds a USB flash drive labeled "Salary Info" in an office parking lot. The employee picks up the USB flash drive, goes into the office, and plugs it into a laptop. Later, a technician inspects the laptop and realizes it has been compromised by malware. Which of the following types of social engineering attacks has occurred?

   • ASmishing
   • BBaiting
   • CTailgating
   • DPretexting

   Show answer

   Answer: B

   Explanation

   B. Baiting In this scenario, the social engineering attack that has occurred is "Baiting." Baiting involves leaving a physical device, such as a USB flash drive, in a location where it is likely to be found by the target. The device is labeled in a way to entice the victim to plug it into their computer. Once plugged in, the device may contain malware or other malicious software that compromises the victim's system.

   Source: Adapted from community discussion — salah112

   Next question

2. Question 762 · 856 in bank

   The primary goal of the threat-hunting team at a large company is to identify cyberthreats that the SOC has not detected. Which of the following types of data would the threat-hunting team primarily use to identify systems that are exploitable?

   • AVulnerability scan
   • BPacket capture
   • CThreat feed
   • DUser behavior

   Show answer

   Answer: C

   Explanation

   I'm a bit uncertain of my answer, however I'm leaning towards Threat Feed (C). According to CompTIA, "threat hunting is an assessment technique that utilizes insights gained from threat intelligence to proactively discover whether there is evidence of TTPs already present within the network or system. This contrasts with a reactive process that is only triggered when alert conditions are reported through an incident management system (Section 3C)." The question uses the word "primarily," which I am using to make my inference. I find it more reasonable that threat hunters will use threat feeds to identify exploitable systems, rather than sifting through packet capture files. Obviously, both threat feeds and packet capture can be integrated into a SIEM, which is where my uncertainty comes into play. Also are threat feeds considered to be threat intelligence rather than threat hunting? The semantics causes me to overthink it almost every time, however considering the above excerpt from CompTIA, threat feeds just strike me as more proactive than reactive compared to packet capture.

   Source: Adapted from community discussion — slapster

   Next question

3. Question 763 · 856 in bank

   Which of the following provides a calculated value for known vulnerabilities so organizations can prioritize mitigation steps?

   • ACVSS
   • BSIEM
   • CSOAR
   • DCVE

   Show answer

   Answer: A

   Explanation

   CVSS is maintained by the Forum of Incident Response and Security Teams (first.org/cvss). CVSS metrics generate a score from 0 to 10 based on characteristics of the vulnerability, such as whether it can be triggered remotely or needs local access, whether user intervention is required, and so on

   Source: Adapted from community discussion — stoneface

   Next question

4. Question 764 · 856 in bank

   Which of the following best describes the process of adding a secret value to extend the length of stored passwords?

   • AHashing
   • BQuantum communications
   • CSalting
   • DPerfect forward secrecy

   Show answer

   Answer: C

   Next question

5. Question 765 · 856 in bank

   Adding a value to the end of a password to create a different password hash is called:

   • Asalting.
   • Bkey stretching.
   • Csteganography.
   • DMD5 checksum.

   Show answer

   Answer: A

   Next question

6. Question 766 · 856 in bank

   An organization is concerned about hackers bypassing MFA through social engineering of phone carriers. Which of the following would most likely protect against such an attack?

   • AReceiving alerts about unusual log-in activity
   • BReceiving a six-digit code via SMS
   • CReceiving a push notification to a mobile application
   • DReceiving a phone call for automated approval

   Show answer

   Answer: C

   Explanation

   C. Receiving a push notification to a mobile application To protect against hackers bypassing Multi-Factor Authentication (MFA) through social engineering of phone carriers, using a push notification to a mobile application is a more secure option. This method is often associated with Time-based One-Time Passwords (TOTP) generated by authenticator apps.

   Source: Adapted from community discussion — salah112

   Next question

7. Question 767 · 856 in bank

   A security analyst is working with a vendor to get a new SaaS application deployed to an enterprise. The analyst wants to ensure role-based security policies are correctly applied as users access the application. Which of the following is most likely to solve the issue?

   • ACASB
   • BAUP
   • CNG-SWG
   • DVPC endpoint

   Show answer

   Answer: A

   Explanation

   A. CASB CASB stands for Cloud Access Security Broker, and it is a solution designed to provide security policies and controls for organizations as they migrate to cloud-based services. CASBs are particularly effective in enforcing security policies for Software as a Service (SaaS) applications.

   Source: Adapted from community discussion — salah112

   Next question

8. Question 768 · 856 in bank

   A municipality implements an IoT device discovery scanner and finds a legacy controller for a critical internal utility SCADA service that is running firmware with multiple vulnerabilities. Unfortunately, the controller cannot be upgraded, and a replacement for it is not available for at least a year. Which of the following is the best action to take to mitigate the risk posed by this controller in the meantime?

   • AIsolate the controller from the rest of the network and constrain connectivity.
   • BRemove the controller from the network altogether.
   • CQuarantine the controller in a VLAN used for device patching from the internet.
   • DConfigure the internet firewall to deny any internet access to or from the controller.

   Show answer

   Answer: A

   Explanation

   A. Isolate the controller from the rest of the network and constrain connectivity. Given that the legacy controller cannot be upgraded, and a replacement is not available for at least a year, the best action to mitigate the risk posed by this controller is to isolate it from the rest of the network and constrain its connectivity. This approach minimizes the potential attack surface and limits the impact of vulnerabilities in the controller.

   Source: Adapted from community discussion — salah112

   Next question

9. Question 769 · 856 in bank

   Select 2

   Which of the following types of data are most likely to be subject to regulations and laws? (Choose two.)

   • APHI
   • BTrade secrets
   • CProprietary
   • DOSINT
   • EPII
   • FPublic

   Show answer

   Answer: AE

   Explanation

   The types of data most likely to be subject to regulations and laws are: A. PHI (Protected Health Information): PHI is sensitive health-related information and is subject to strict privacy regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States. E. PII (Personally Identifiable Information): PII includes any information that can be used to identify an individual, such as names, addresses, social security numbers, or financial information. PII is often protected by data privacy laws and regulations.

   Source: Adapted from community discussion — salah112

   Next question

10. Question 770 · 856 in bank

    An analyst is reviewing an incident in which a user clicked on a link in a phishing email. Which of the following log sources would the analyst utilize to determine whether the connection was successful?

    • ANetwork
    • BSystem
    • CApplication
    • DAuthentication

    Show answer

    Answer: A

    Explanation

    Hint:: A phishing link in an email leads you where? A URL. A malicious site. Where do you find info about your Internet visits and browsing history? Answer:: Network Logs.

    Source: Adapted from community discussion — Yomzie

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 761. 856 questions available.