SY0-601 practice questions 851–856

1. Question 851 · 856 in bank

   Which of the following employee roles is responsible for protecting an organization's collected personal information?

   • ACTO
   • BDPO
   • CCEO
   • DDBA

   Show answer

   Answer: B

   Explanation

   A data protection officer (DPO) is an enterprise security leadership role required by the General Data Protection Regulation (GDPR). Data protection officers are responsible for overseeing a company's data protection strategy and its implementation to ensure compliance with GDPR requirements

   Source: Adapted from community discussion — stoneface

   Next question

2. Question 852 · 856 in bank

   Against the recommendation of the IT security analyst, a company set all user passwords on a server as `P@55w0rD`. Upon review of the /etc/passwd file, an attacker found the following: alice:a8df3b6c4fd75f0617431fd248f35191df8d237f bob:2d250c5b2976b03d757f324ebd59340df96aa05e chris:ea981ec3285421d014108089f3f3f997ce0f4150 Which of the following BEST explains why the encrypted passwords do not match?

   • APerfect forward secrecy
   • BKey stretching
   • CSalting
   • DHashing

   Show answer

   Answer: C

   Explanation

   Salting refers to adding random data to the input of a hash function to guarantee a unique output. The set password, in this case, is already hashed so to further secure it salting is the next step in cryptography i.e. adding more security to the password. Think of it as "salt bae" making it just that much better.

   Source: Adapted from community discussion — Boogie_79

   Next question

3. Question 853 · 856 in bank

   After gaining access to a dual-homed (i.e., wired and wireless) multifunction device by exploiting a vulnerability in the device's firmware, a penetration tester then gains shell access on another networked asset. This technique is an example of:

   • Aprivilege escalation.
   • Bfootprinting.
   • Cpersistence.
   • Dpivoting.

   Show answer

   Answer: D

   Explanation

   In the given scenario, the penetration tester gains access to a multifunction device with both wired and wireless interfaces. Then, after exploiting a vulnerability in the device's firmware, the tester gains shell access on another networked asset. This technique is an example of "pivoting." Pivoting is a method used by attackers or penetration testers to leverage their initial access to a compromised system or network to gain access to other systems within the same network. In this case, the attacker is using the compromised multifunction device as a pivot point to gain access to other networked assets.

   Source: Adapted from community discussion — Protract8593

   Next question

4. Question 854 · 856 in bank

   Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?

   • ACommon Weakness Enumeration
   • BOSINT
   • CDark web
   • DVulnerability databases

   Show answer

   Answer: C

   Explanation

   Threat intelligence researchers who search for leaked credentials should primarily monitor the dark web. The dark web refers to a part of the internet that is not indexed by traditional search engines and is often used for illicit activities. It is a common marketplace for buying and selling stolen data, including leaked credentials such as usernames and passwords. By monitoring the dark web, threat intelligence researchers can identify if any leaked credentials associated with their organization or clients are being traded or shared. This information can be crucial for organizations to take proactive measures to protect their systems and accounts from unauthorized access.

   Source: Adapted from community discussion — ApplebeesWaiter1122

   Next question

5. Question 855 · 856 in bank

   A security analyst needs to be able to search and correlate logs from multiple sources in a single tool. Which of the following would BEST allow a security analyst to have this ability?

   • ASOAR
   • BSIEM
   • CLog collectors
   • DNetwork-attached storage

   Show answer

   Answer: B

   Explanation

   Every single time I've seen the word correlate in questions, the answer has always been SIEM. From google: SIEM event correlation is an essential part of any SIEM solution. It aggregates and analyzes log data from across your network applications, systems, and devices, making it possible to discover security threats and malicious patterns of behaviors that otherwise go unnoticed and can lead to compromise or data loss.

   Source: Adapted from community discussion — Gravoc

   Next question

6. Question 856 · 856 in bank

   A security analyst is investigating suspicious traffic on the web server located at IP address 10.10.1.1. A search of the WAF logs reveals the following output:

   

   Which of the following is MOST likely occurring?

   • AXSS attack
   • BSQLi attack
   • CReplay attack
   • DXSRF attack

   Show answer

   Answer: B

   Explanation

   Answer: SQLi attack SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for backend database manipulation to access information that was not intended to be displayed. The giveaway here is the 1=1 in the query which is essentially creating a condition that will automatically be true. ====================== Helpful Info: XSS (Cross-Site Scripting) attacks -a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. Replay Attack - a kind of man-in-the-middle attack in which an attacker sniffs messages being sent on a channel to intercept them and resend them under the cloak of authentic messages. CSRF (Cross Sit Request Forgery)- attacks that target functionality that causes a state change on the server, such as changing the victim's email address or password, or purchasing something.

   Source: Adapted from community discussion — rodwave

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 851. 856 questions available.