SY0-701 practice questions 241–250

1. Question 241 · 607 in bank

   Which of the following would be the best way to test resiliency in the event of a primary power failure?

   • AParallel processing
   • BTabletop exercise
   • CSimulation testing
   • DProduction failover

   Show answer

   Answer: D

   Explanation

   The correct answer is: D. Production failover Explanation: Production failover tests the resiliency of systems in the event of a primary power failure by switching operations from the primary system to a backup or secondary system in a live environment. It ensures that the failover process works as intended and that systems remain operational during an actual outage. Other Options: A. Parallel processing: Refers to splitting tasks across multiple systems for efficiency and does not test resiliency in case of a power failure. B. Tabletop exercise: A discussion-based exercise to simulate scenarios but does not involve actual testing of systems. C. Simulation testing: Tests a simulated environment but may not reflect real-world conditions as accurately as a production failover. Production failover is the best way to test resiliency because it verifies that systems can handle a power failure in a real, operational environment.

   Source: Adapted from community discussion — Anyio

   Next question

2. Question 242 · 607 in bank

   Which of the following would be the most appropriate way to protect data in transit?

   • ASHA-256
   • BSSL3.0
   • CTLS 1.3
   • DAES-256

   Show answer

   Answer: C

   Explanation

   Chat GPT:The correct answer is C. TLS 1.3. TLS (Transport Layer Security) 1.3 is the most appropriate protocol for protecting data in transit, as it provides encryption, integrity, and secure authentication between two communicating parties. It is an updated, secure version of SSL/TLS and is widely recommended for secure communication over networks. A. SHA-256 is a hashing algorithm, primarily used for ensuring data integrity, not for encrypting data in transit. B. SSL 3.0 is an outdated and vulnerable protocol that should no longer be used for securing data. D. AES-256 is an encryption algorithm, but it is typically used for data at rest or as part of protocols like TLS for data in transit; by itself, it is not a protocol for securing data in transit.

   Source: Adapted from community discussion — 850bc48

   Next question

3. Question 243 · 607 in bank

   Which of the following is a common, passive reconnaissance technique employed by penetration testers in the early phases of an engagement?

   • AOpen-source intelligence
   • BPort scanning
   • CPivoting
   • DExploit validation

   Show answer

   Answer: A

   Explanation

   Chat GPT: The correct answer is A. Open-source intelligence (OSINT). OSINT is a common passive reconnaissance technique where penetration testers gather information from publicly available sources, such as websites, social media, and databases, without directly interacting with the target systems. This helps them learn more about the target while minimizing the chances of detection. Options B, C, and D involve more active techniques, which usually come later in the penetration testing process: B. Port scanning is an active technique to identify open ports and services on a target. C. Pivoting refers to using a compromised system to gain access to other systems within a network. D. Exploit validation involves testing vulnerabilities to confirm whether they can be successfully exploited.

   Source: Adapted from community discussion — 850bc48

   Next question

4. Question 244 · 607 in bank

   Which of the following threat actors is the most likely to seek financial gain through the use of ransomware attacks?

   • AOrganized crime
   • BInsider threat
   • CNation-state
   • DHacktivists

   Show answer

   Answer: A

   Next question

5. Question 245 · 607 in bank

   Which of the following threat actors is the most likely to use large financial resources to attack critical systems located in other countries?

   • AInsider
   • BUnskilled attacker
   • CNation-state
   • DHacktivist

   Show answer

   Answer: C

   Explanation

   o Nation-state actors are government-backed groups or organizations that engage in cyber activities as part of national interests. They have significant financial and technical resources and often target critical infrastructure, defense systems, and other high-value targets in foreign countries. The nation-state is the most likely threat actor to use vast financial resources for international cyber attacks, aligning with the scenario's description of attacking critical systems across borders.

   Source: Adapted from community discussion — dbrowndiver

   Next question

6. Question 246 · 607 in bank

   Which of the following would a systems administrator follow when upgrading the firmware of an organization’s router?

   • ASoftware development life cycle
   • BRisk tolerance
   • CCertificate signing request
   • DMaintenance window

   Show answer

   Answer: D

   Explanation

   The correct answer is D. Maintenance window. Explanation: When upgrading the firmware of an organization's router, a systems administrator would typically follow a maintenance window.

   Source: Adapted from community discussion — Segunmx

   Next question

7. Question 247 · 607 in bank

   A systems administrator needs to ensure the secure communication of sensitive data within the organization’s private cloud. Which of the following is the best choice for the administrator to implement?

   • AIPSec
   • BSHA-1
   • CRSA
   • DTGT

   Show answer

   Answer: A

   Explanation

   The answer is A. IPSec (Internet Protocol Security) is a suite of protocols used to secure Internet Protocol (IP) communications. It authenticates and encrypts each IP packet in a communication session, providing confidentiality, data integrity, and authentication. It is commonly used for creating secure Virtual Private Networks (VPNs) and is ideal for securing communication in a private cloud.

   Source: Adapted from community discussion — Segunmx

   Next question

8. Question 248 · 607 in bank

   Which of the following should an internal auditor check for first when conducting an audit of the organization’s risk management program?

   • APolicies and procedures
   • BAsset management
   • CVulnerability assessment
   • DBusiness impact analysis

   Show answer

   Answer: A

   Explanation

   The correct answer is: A. Policies and procedures Explanation: When conducting an audit of an organization's risk management program, the internal auditor should first review the policies and procedures. These documents form the foundation of the risk management program by outlining the organization’s approach, goals, roles, responsibilities, and processes for managing risks.

   Source: Adapted from community discussion — ViciousAkira

   Next question

9. Question 249 · 607 in bank

   Select 2

   Which of the following activities are associated with vulnerability management? (Choose two.)

   • AReporting
   • BPrioritization
   • CExploiting
   • DCorrelation
   • EContainment
   • FTabletop exercise

   Show answer

   Answer: AB

   Explanation

   A. Reporting: Regularly documenting and reporting on vulnerabilities, including their status, potential risks, and the actions taken to remediate them, is a core part of the vulnerability management process. This helps to track progress and ensure that vulnerabilities are addressed in a timely manner. B. Prioritization: Given that not all vulnerabilities are equally critical, prioritizing them based on factors like the severity of the vulnerability, the risk to the organization, and the potential impact is essential. This helps to allocate resources efficiently and address the most pressing vulnerabilities first NOT E. Containment. Containment is an activity typically associated with incident response or a breach management process. While related to managing security risks, containment is not specifically a part of vulnerability management, which focuses more on identifying, assessing, and mitigating vulnerabilities.

   Source: Adapted from community discussion — laternak26

   Next question

10. Question 250 · 607 in bank

    An administrator wants to perform a risk assessment without using proprietary company information. Which of the following methods should the administrator use to gather information?

    • ANetwork scanning
    • BPenetration testing
    • COpen-source intelligence
    • DConfiguration auditing

    Show answer

    Answer: C

    Explanation

    The correct answer is: C. Open-source intelligence Explanation: Open-source intelligence (OSINT) involves gathering publicly available information from sources such as websites, social media, forums, and other publicly accessible data to perform a risk assessment. This method allows an administrator to gather useful insights without accessing or relying on proprietary company information.

    Source: Adapted from community discussion — ViciousAkira

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 241. 607 questions available.