ExamGecko
Login
Home / CompTIA / SY0-601 / List of questions
Ask Question

CompTIA SY0-601 Practice Test - Questions Answers, Page 10

List of questions

Question 91

Report Export Collapse

A company is implementing a new SIEM to log and send alerts whenever malicious activity is blocked by its antivirus and web content filters. Which of the following is the primary use case for this scenario?

Implementation of preventive controls
Implementation of preventive controls
Implementation of detective controls
Implementation of detective controls
Implementation of deterrent controls
Implementation of deterrent controls
Implementation of corrective controls
Implementation of corrective controls
Suggested answer: B
Explanation:

A Security Information and Event Management (SIEM) system is a tool that collects and analyzes security-related data from various sources to detect and respond to security incidents. Reference:

CompTIA Security+ Study Guide 601, Chapter 5

asked 02/10/2024
Sumit Sengupta
46 questions

Question 92

Report Export Collapse

Which of the following in a forensic investigation should be priorities based on the order of volatility? (Select TWO).

Page files
Page files
Event logs
Event logs
RAM
RAM
Cache
Cache
Stored files
Stored files
HDD
HDD
Suggested answer: C, D
Explanation:

In a forensic investigation, volatile data should be collected first, based on the order of volatility. RAM and Cache are examples of volatile data. Reference: CompTIA Security+ Study Guide 601, Chapter 11

asked 02/10/2024
Victor Bogdan Grecu
36 questions

Question 93

Report Export Collapse

The Chief Technology Officer of a local college would like visitors to utilize the school's WiFi but must be able to associate potential malicious activity to a specific person. Which of the following would BEST allow this objective to be met?

Requiring all new, on-site visitors to configure their devices to use WPS
Requiring all new, on-site visitors to configure their devices to use WPS
Implementing a new SSID for every event hosted by the college that has visitors
Implementing a new SSID for every event hosted by the college that has visitors
Creating a unique PSK for every visitor when they arrive at the reception area
Creating a unique PSK for every visitor when they arrive at the reception area
Deploying a captive portal to capture visitors' MAC addresses and names
Deploying a captive portal to capture visitors' MAC addresses and names
Suggested answer: D
Explanation:

A captive portal is a web page that requires visitors to authenticate or agree to an acceptable use policy before allowing access to the network. By capturing visitors' MAC addresses and names, potential malicious activity can be traced back to a specific person.

asked 02/10/2024
samer salami
39 questions

Question 94

Report Export Collapse

An analyst Is generating a security report for the management team. Security guidelines recommend disabling all listening unencrypted services. Given this output from Nmap:

CompTIA SY0-601 image Question 85 98175 10022024175359000000

Which of the following should the analyst recommend to disable?

21/tcp
21/tcp
22/tcp
22/tcp
23/tcp
23/tcp
443/tcp
443/tcp
Suggested answer: A
asked 02/10/2024
Shivanth Jha
40 questions

Question 95

Report Export Collapse

As part of a company's ongoing SOC maturation process, the company wants to implement a method to share cyberthreat intelligence data with outside security partners. Which of the following will the company MOST likely implement?

TAXII
TAXII
TLP
TLP
TTP
TTP
STIX
STIX
Suggested answer: A
Explanation:

Trusted Automated Exchange of Intelligence Information (TAXII) is a standard protocol that enables the sharing of cyber threat intelligence between organizations. It allows organizations to automate the exchange of information in a secure and timely manner. Reference: CompTIA Security+ Certification Exam Objectives - 3.6 Given a scenario, implement secure network architecture concepts. Study Guide: Chapter 4, page 167.

asked 02/10/2024
Aleksandar Jovasevic
52 questions

Question 96

Report Export Collapse

A security incident has been resolved Which of the following BEST describes the importance of the final phase of the incident response plan?

It examines and documents how well the team responded discovers what caused the incident, and determines how the incident can be avoided in the future
It examines and documents how well the team responded discovers what caused the incident, and determines how the incident can be avoided in the future
It returns the affected systems back into production once systems have been fully patched, data restored and vulnerabilities addressed
It returns the affected systems back into production once systems have been fully patched, data restored and vulnerabilities addressed
It identifies the incident and the scope of the breach how it affects the production environment, and the ingress point
It identifies the incident and the scope of the breach how it affects the production environment, and the ingress point
It contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach
It contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach
Suggested answer: A
Explanation:

The final phase of an incident response plan is the post-incident activity, which involves examining and documenting how well the team responded, discovering what caused the incident, and determining how the incident can be avoided in the future. Reference: CompTIA Security+ Certification Exam Objectives - 2.5 Given a scenario, analyze potential indicators to determine the type of attack. Study Guide: Chapter 5, page 225.

asked 02/10/2024
Niels de Lange
47 questions

Question 97

Report Export Collapse

Which of the following describes a maintenance metric that measures the average time required to troubleshoot and restore failed equipment?

RTO
RTO
MTBF
MTBF
MTTR
MTTR
RPO
RPO
Suggested answer: C
Explanation:

Mean Time To Repair (MTTR) is a maintenance metric that measures the average time required to troubleshoot and restore failed equipment. Reference: CompTIA Security+ Certification Exam Objectives - 4.6 Explain the importance of secure coding practices. Study Guide: Chapter 7, page 323.

asked 02/10/2024
Allam Sunandhareddy
45 questions

Question 98

Report Export Collapse

Which of the following should a technician consider when selecting an encryption method for data that needs to remain confidential for a specific length of time?

The key length of the encryption algorithm
The key length of the encryption algorithm
The encryption algorithm's longevity
The encryption algorithm's longevity
A method of introducing entropy into key calculations
A method of introducing entropy into key calculations
The computational overhead of calculating the encryption key
The computational overhead of calculating the encryption key
Suggested answer: B
Explanation:

When selecting an encryption method for data that needs to remain confidential for a specific length of time, the longevity of the encryption algorithm should be considered to ensure that the data remains secure for the required period. Reference: CompTIA Security+ Certification Exam Objectives - 3.2 Given a scenario, use appropriate cryptographic methods. Study Guide: Chapter 4, page 131.

asked 02/10/2024
om Kumar
46 questions

Question 99

Report Export Collapse

A network analyst is investigating compromised corporate information. The analyst leads to a theory that network traffic was intercepted before being transmitted to the internet. The following output was captured on an internal host:

CompTIA SY0-601 image Question 90 98180 10022024175359000000

Based on the IoCS, which of the following was the MOST likely attack used to compromise the network communication?

Denial of service
Denial of service
ARP poisoning
ARP poisoning
Command injection
Command injection
MAC flooding
MAC flooding
Suggested answer: B
Explanation:

ARP poisoning (also known as ARP spoofing) is a type of attack where an attacker sends falsified ARP messages over a local area network to link the attacker's MAC address with the IP address of another host on the network. Reference: CompTIA Security+ Certification Exam Objectives - 2.5 Given a scenario, analyze potential indicators to determine the type of attack. Study Guide: Chapter 6, page 271.

asked 02/10/2024
Frederico Dionísio
46 questions

Question 100

Report Export Collapse

A security analyst is investigating a phishing email that contains a malicious document directed to the company's Chief Executive Officer (CEO). Which of the following should the analyst perform to understand the threat and retrieve possible IoCs?

Run a vulnerability scan against the CEOs computer to find possible vulnerabilities
Run a vulnerability scan against the CEOs computer to find possible vulnerabilities
Install a sandbox to run the malicious payload in a safe environment
Install a sandbox to run the malicious payload in a safe environment
Perform a traceroute to identify the communication path
Perform a traceroute to identify the communication path
Use netstat to check whether communication has been made with a remote host
Use netstat to check whether communication has been made with a remote host
Suggested answer: B
Explanation:

To understand the threat and retrieve possible Indicators of Compromise (IoCs) from a phishing email containing a malicious document, a security analyst should install a sandbox to run the malicious payload in a safe environment. Reference: CompTIA Security+ Certification Exam Objectives - 2.5 Given a scenario, analyze potential indicators to determine the type of attack. Study Guide: Chapter 5, page 209.

asked 02/10/2024
Muhammad Imran Khan
38 questions
Total 603 questions
Go to page: of 61
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

A security analyst notices an unusual amount of traffic hitting the edge of the network. Upon examining the logs, the analyst identifies a source IP address and blocks that address from communicating with the network. Even though the analyst is blocking this address, the attack is still ongoing and coming from a large number of different source IP addresses. Which of the following describes this type of attack?
A desktop support technician recently installed a new document-scanning software program on a computer. However, when the end user tried to launch the program, it did not respond. Which of the following is MOST likely the cause?
Which Of the following will provide the best physical security countermeasures to Stop intruders? (Select two).
Which of the following can be used to calculate the total loss expected per year due to a threat targeting an asset?
A penetration tester was able to compromise a host using previously captured network traffic. Which of the following is the result of this action?
A candidate attempts to go to but accidentally visits http://comptiia.org . The malicious website looks exactly like the legitimate website. Which of the following best describes this type of attack?
Which of the following is a solution that can be used to stop a disgruntled employee from copying confidential data to a USB drive?
one of the attendees starts to notice delays in the connection. and the HTTPS site requests are reverting to HTTP. Which of the following BEST describes what is happening?
DRAG DROP A data owner has been tasked with assigning proper data classifications and destruction methods for various types of data contained within the environment.
A new vulnerability enables a type of malware that allows the unauthorized movement of data from a system Which of the following would detect this behavior?