ExamGecko
Home / CompTIA / SY0-601 / List of questions
Ask Question

CompTIA SY0-601 Practice Test - Questions Answers, Page 2

Add to Whishlist

List of questions

Question 11

Report Export Collapse

During an incident a company CIRT determine it is necessary to observe the continued network- based transaction between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?

Physical move the PC to a separate internet pint of presence
Physical move the PC to a separate internet pint of presence
Create and apply micro segmentation rules.
Create and apply micro segmentation rules.
Emulate the malware in a heavily monitored DM Z segment.
Emulate the malware in a heavily monitored DM Z segment.
Apply network blacklisting rules for the adversary domain
Apply network blacklisting rules for the adversary domain
Suggested answer: C
Explanation:

To observe the continued network-based transaction between a callback domain and the malware running on an enterprise PC while reducing the risk of lateral spread and the risk that the adversary would notice any changes, the best technique to use is to emulate the malware in a heavily monitored DMZ segment. This is a secure environment that is isolated from the rest of the network and can be heavily monitored to detect any suspicious activity. By emulating the malware in this environment, the activity can be observed without the risk of lateral spread or detection by the adversary. Reference: https://www.sans.org/blog/incident-response-fundamentals-why-is-the-dmz- so-important/

asked 02/10/2024
Daniel Yamamoto
49 questions

Question 12

Report Export Collapse

Which of the following environment utilizes dummy data and is MOST to be installed locally on a system that allows to be assessed directly and modified easily wit each build?

Production
Production
Test
Test
Staging
Staging
Development
Development
Suggested answer: D
Explanation:

The environment that utilizes dummy data and is most likely to be installed locally on a system that allows it to be assessed directly and modified easily with each build is the development environment. The development environment is used for developing and testing software and applications. It is typically installed on a local system, rather than on a remote server, to allow for easy access and modification. Dummy data can be used in the development environment to simulate real-world scenarios and test the software's functionality. Reference:

https://www.techopedia.com/definition/27561/development-environment

asked 02/10/2024
Malik Khabir
40 questions

Question 13

Report Export Collapse

A desktop support technician recently installed a new document-scanning software program on a computer. However, when the end user tried to launch the program, it did not respond. Which of the following is MOST likely the cause?

A new firewall rule is needed to access the application.
A new firewall rule is needed to access the application.
The system was quarantined for missing software updates.
The system was quarantined for missing software updates.
The software was not added to the application whitelist.
The software was not added to the application whitelist.
The system was isolated from the network due to infected software
The system was isolated from the network due to infected software
Suggested answer: C
Explanation:

The most likely cause of the document-scanning software program not responding when launched by the end user is that the software was not added to the application whitelist. An application whitelist is a list of approved software applications that are allowed to run on a system. If the software is not on the whitelist, it may be blocked from running by the system's security policies. Adding the software to the whitelist should resolve the issue and allow the program to run.

Reference: https://www.techopedia.com/definition/31541/application-whitelisting

asked 02/10/2024
Moraes, Jefferson
50 questions

Question 14

Report Export Collapse

A company recently experienced an attack during which its main website was Directed to the attacker's web server, allowing the attacker to harvest credentials from unsuspecting customers, Which of the following should the company implement to prevent this type of attack from occurring In the future?

IPsec
IPsec
SSL/TLS
SSL/TLS
ONSSEC
ONSSEC
SMIME
SMIME
Suggested answer: B
Explanation:

To prevent attacks where the main website is directed to the attacker's web server and allowing the attacker to harvest credentials from unsuspecting customers, the company should implement SSL/TLS (Secure Sockets Layer/Transport Layer Security) to encrypt the communication between the web server and the clients. This will prevent attackers from intercepting and tampering with the communication, and will also help to verify the identity of the web server to the clients.

asked 02/10/2024
Jose Leonardo
31 questions

Question 15

Report Export Collapse

A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL. Which of the following is needed to meet the objective?

A reverse proxy
A reverse proxy
A decryption certificate
A decryption certificate
A split-tunnel VPN
A split-tunnel VPN
Load-balanced servers
Load-balanced servers
Suggested answer: B
Explanation:

A Web Application Firewall (WAF) is a security solution that protects web applications from various types of attacks such as SQL injection, cross-site scripting (XSS), and others. It is typically deployed in front of web servers to inspect incoming traffic and filter out malicious requests. To protect the company’s website from malicious web requests over SSL, a decryption certificate is needed to decrypt the SSL traffic before it reaches the WAF. This allows the WAF to inspect the traffic and filter out malicious requests.

asked 02/10/2024
Takenobu Tanida
37 questions

Question 16

Report Export Collapse

A security analyst has received several reports of an issue on an internal web application. Users state they are having to provide their credentials twice to log in. The analyst checks with the application team and notes this is not an expected behavior. After looking at several logs, the analyst decides to run some commands on the gateway and obtains the following output:

CompTIA SY0-601 image Question 7 98097 10022024175358000000

Which of the following BEST describes the attack the company is experiencing?

MAC flooding
MAC flooding
URL redirection
URL redirection
ARP poisoning
ARP poisoning
DNS hijacking
DNS hijacking
Suggested answer: C
Explanation:

The output of the β€œnetstat -ano” command shows that there are two connections to the same IP address and port number. This indicates that there are two active sessions between the client and server.

The issue of users having to provide their credentials twice to log in is known as a double login prompt issue. This issue can occur due to various reasons such as incorrect configuration of authentication settings, incorrect configuration of web server settings, or issues with the client’s browser.

Based on the output of the β€œnetstat -ano” command, it is difficult to determine the exact cause of the issue. However, it is possible that an attacker is intercepting traffic between the client and server and stealing user credentials. This type of attack is known as C. ARP poisoning. ARP poisoning is a type of attack where an attacker sends fake ARP messages to associate their MAC address with the IP address of another device on the network. This allows them to intercept traffic between the two devices and steal sensitive information such as user credentials.

asked 02/10/2024
Olga Trofimova
38 questions

Question 17

Report Export Collapse

A company recently experienced an attack during which 5 main website was directed to the atack- er’s web server, allowing the attacker to harvest credentials from unsuspecting customers. Which of the following should the company Implement to prevent this type of attack from occurring in the future?

IPSec
IPSec
SSL/TLS
SSL/TLS
DNSSEC
DNSSEC
S/MIME
S/MIME
Suggested answer: C
Explanation:

The attack described in the question is known as a DNS hijacking attack. In this type of attack, an attacker modifies the DNS records of a domain name to redirect traffic to their own server. This allows them to intercept traffic and steal sensitive information such as user credentials. To prevent this type of attack from occurring in the future, the company should implement C. DNSSEC.

DNSSEC (Domain Name System Security Extensions) is a security protocol that adds digital signatures to DNS records. This ensures that DNS records are not modified during transit and prevents DNS hijacking attacks.

asked 02/10/2024
Scott Wells
46 questions

Question 18

Report Export Collapse

A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL. Which of the following is needed to meet the objective?

A reverse proxy
A reverse proxy
A decryption certificate
A decryption certificate
A spill-tunnel VPN
A spill-tunnel VPN
Load-balanced servers
Load-balanced servers
Suggested answer: B
Explanation:

A Web Application Firewall (WAF) is a security solution that protects web applications from various types of attacks such as SQL injection, cross-site scripting (XSS), and others. It is typically deployed in front of web servers to inspect incoming traffic and filter out malicious requests. To protect the company’s website from malicious web requests over SSL, a decryption certificate is needed to decrypt the SSL traffic before it reaches the WAF. This allows the WAF to inspect the traffic and filter out malicious requests.

asked 02/10/2024
Maurice Nicholson
34 questions

Question 19

Report Export Collapse

Which of the following BEST describes a social-engineering attack that relies on an executive at a small business visiting a fake banking website where credit card and account details are harvested?

Whaling
Whaling
Spam
Spam
Invoice scam
Invoice scam
Pharming
Pharming
Suggested answer: A
Explanation:

A social engineering attack that relies on an executive at a small business visiting a fake banking website where credit card and account details are harvested is known as whaling. Whaling is a type of phishing attack that targets high-profile individuals, such as executives, to steal sensitive information or gain access to their accounts.

asked 02/10/2024
Hector Moreno
47 questions

Question 20

Report Export Collapse

If a current private key is compromised, which of the following would ensure it cannot be used to decrypt ail historical data?

Perfect forward secrecy
Perfect forward secrecy
Elliptic-curve cryptography
Elliptic-curve cryptography
Key stretching
Key stretching
Homomorphic encryption
Homomorphic encryption
Suggested answer: B
Explanation:


asked 02/10/2024
Sairam Emmidishetti
43 questions
Total 603 questions
Go to page: of 61
Search

Related questions