SY0-601 practice questions 781–790

1. Question 781 · 856 in bank

   Which of the following is best used to detect fraud by assigning employees to different roles?

   • ALeast privilege
   • BMandatory vacation
   • CSeparation of duties
   • DJob rotation

   Show answer

   Answer: D

   Explanation

   D. Job Rotation This is from the Mike Myers’s Sec+ (601) Cert Guide book: “Job rotation involves periodically switching people around to work in different positions. This practice enables different people to become proficient in a variety of job roles so that the organization doesn’t have to depend solely on one person to perform certain critical function or tasks”…(HERE’S THE IMPORTANT PART)…”When people become too comfortable with a job, they might believe that they can get away with performing actions they are not authorized to perform. Rotating people into different positions increases the potential to detect fraud or misuse in that position and can discourage or prevent nefarious activities.”

   Source: Adapted from community discussion — TM78

   Next question

2. Question 782 · 856 in bank

   Select 2

   A company implemented an MDM policy to mitigate risks after repeated instances of employees losing company-provided mobile phones. In several cases, the lost phones were used maliciously to perform social engineering attacks against other employees. Which of the following MDM features should be configured to best address this issue? (Choose two.)

   • AScreen locks
   • BRemote wipe
   • CFull device encryption
   • DPush notifications
   • EApplication management
   • FGeolocation

   Show answer

   Answer: AB

   Explanation

   I believe A would prevent a malicious actor from using the information on the phone to target other employees. Without it, the device can be encrypted. However, the data can is still visible to the phone user. It's just useless when the data is not directly accessed from the device (aka dat exfil). Remote wipe is my second choice.

   Source: Adapted from community discussion — DrCo6991

   Next question

3. Question 783 · 856 in bank

   During a recent company safety stand-down, the cyber-awareness team gave a presentation on the importance of cyber hygiene. One topic the team covered was best practices for printing centers. Which of the following describes an attack method that relates to printing centers?

   • AWhaling
   • BCredential harvesting
   • CPrepending
   • DDumpster diving

   Show answer

   Answer: D

   Next question

4. Question 784 · 856 in bank

   The security operations center is researching an event concerning a suspicious IP address. A security analyst looks at the following event logs and discovers that a significant portion of the user accounts have experienced failed log-in attempts when authenticating from the same IP address:

   

   Which of the following most likely describes the attack that took place?

   • ASpraying
   • BBrute-force
   • CDictionary
   • DRainbow table

   Show answer

   Answer: A

   Explanation

   Password spraying for sure because in a brute force attack, hackers choose a vulnerable ID and enter passwords one after another hoping some password might let them in. On the other hand, password spraying, is when one password is applied to multiple user IDs so that at least one of the user ID is compromised.

   Source: Adapted from community discussion — Elle

   Next question

5. Question 785 · 856 in bank

   Which of the following is an algorithm performed to verify that data has not been modified?

   • AHash
   • BCode check
   • CEncryption
   • DChecksum

   Show answer

   Answer: A

   Explanation

   I think the semantics of the question are the key here. It is by no coincidence that both hash and checksum are answer choices. At first, I read the question and thought, wth both a checksum and hash value are used to establish integrity. Why am I even being asked to differentiate between the two?? Upon re-reading the question, it clicked that we are being asked to identify an ALGORITHM that establishes the integrity. A checksum is simply the output of an algorithm, therefore hash seems to be the best answer here.

   Source: Adapted from community discussion — slapster

   Next question

6. Question 786 · 856 in bank

   A forensic analyst needs to prove that data has not been tampered with since it was collected. Which of the following methods will the analyst MOST likely use?

   • ALook for tampering on the evidence collection bag.
   • BEncrypt the collected data using asymmetric encryption.
   • CEnsure proper procedures for chain of custody are being followed.
   • DCalculate the checksum using a hashing algorithm.

   Show answer

   Answer: D

   Explanation

   Answer: Calculate the checksum using a hashing algorithm. (D) A checksum is specifically intended to verify the integrity of data or find data corruption. Comparing a file's original and current checksum. And if a byte or even a piece of the file's data has been changed, the original and current checksum will be different, and therefore you will know whether it's the same file or not. ===================== (A) - This is essentially the physical version of checking if something was tampered but wouldn't work for virtual data (B) - Dont need to encrypt anything (C) - Even if a proper chain of custody was followed, it doesn't guarantee that data hasn't been modified by anyone that had access to the data.

   Source: Adapted from community discussion — rodwave

   Next question

7. Question 787 · 856 in bank

   A network administrator deployed a DNS logging tool that logs suspicious websites that are visited and then sends a daily report based on various weighted metrics. Which of the following best describes the type of control the administrator put in place?

   • APreventive
   • BDeterrent
   • CCorrective
   • DDetective

   Show answer

   Answer: D

   Explanation

   The DNS logging tool is a detective control because it monitors the website visited by the users and reports any suspicious ones based on certain criteria. It does not prevent, deter or correct the behaviour of the users, but rather identifies and notifies the administrator of any potential security risks.

   Source: Adapted from community discussion — johnabayot

   Next question

8. Question 788 · 856 in bank

   A business uses Wi-Fi with content filtering enabled. An employee noticed a coworker accessed a blocked site from a work computer and reported the issue. While investigating the issue, a security administrator found another device providing internet access to certain employees. Which of the following best describes the security risk?

   • AThe host-based security agent is not running on all computers.
   • BA rogue access point is allowing users to bypass controls.
   • CEmployees who have certain credentials are using a hidden SSID.
   • DA valid access point is being jammed to limit availability.

   Show answer

   Answer: B

   Explanation

   The answer is B. Read the question it says "a security administrator found another device providing internet access to certain employees". Thats a rogue access point.

   Source: Adapted from community discussion — DrZoidBergsClaws

   Next question

9. Question 789 · 856 in bank

   While considering the organization's cloud-adoption strategy, the Chief Information Security Officer sets a goal to outsource patching of firmware, operating systems, and applications to the chosen cloud vendor. Which of the following best meets this goal?

   • ACommunity cloud
   • BPaaS
   • CContainerization
   • DPrivate cloud
   • ESaaS
   • FIaaS

   Show answer

   Answer: E

   Explanation

   E. This is because SaaS is the cloud service model that outsources the most responsibilities to the cloud provider, including patching of firmware, operating systems and application. The cloud customer does not need to worry about any of these tasks, as they are handled by the cloud provider.

   Source: Adapted from community discussion — johnabayot

   Next question

10. Question 790 · 856 in bank

    A spoofed identity was detected for a digital certificate. Which of the following are the type of unidentified key and the certificate that could be in use on the company domain?

    • APrivate key and root certificate
    • BPublic key and expired certificate
    • CPrivate key and self-signed certificate
    • DPublic key and wildcard certificate

    Show answer

    Answer: C

    Explanation

    C. Private key and self-signed certificate When a spoofed identity is detected for a digital certificate on the company domain, it typically involves the use of a private key and a self-signed certificate. This scenario suggests that an attacker may have obtained or generated a private key that does not belong to the legitimate certificate owner and created a self-signed certificate to impersonate the legitimate entity.

    Source: Adapted from community discussion — Hs1208

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 781. 856 questions available.