A security analyst scans a company's public network and discovers a host is running a remote desktop that can be used to access the production network. Which of the following changes should the security analyst recommend?

Setting up a VPN and placing the jump server inside the firewall

Changing the remote desktop port to a non-standard number

Setting up a VPN and placing the jump server inside the firewall

Using a proxy for web connections from the remote desktop server

Connecting the remote server to the domain and increasing the password length

Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included. Which of the following best describes how the controls should be set up?

Safety controls should fail open.

Remote access points should fail closed.

Logging controls should fail open.

Safety controls should fail open.

Logical security controls should fail closed.

An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to remote work. The organization is looking for a software solution that will allow it to reduce traffic on the VPN and internet circuit, while still providing encrypted tunnel access to the data center and monitoring of remote employee internet traffic. Which of the following will help achieve these objectives?

Deploying a SASE solution to remote employees

Building a load-balanced VPN solution with redundant internet

Purchasing a low-cost SD-WAN solution for VPN traffic

Using a cloud provider to create additional VPN concentrators

A company's end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server. Which of the following best describes what the security analyst is seeing?

Secure DNS cryptographic downgrade

A security analyst receives alerts about an internal system sending a large amount of unusual DNS queries to systems on the internet over short periods of time during non-business hours. Which of the following is most likely occurring?

A worm is propagating across the network.

Ransomware is encrypting files.

Which of the following would help ensure a security analyst is able to accurately measure the overall risk to an organization when a new vulnerability is disclosed?

A full inventory of all hardware and software

Documentation of system classifications

A list of system owners and their departments

Third-party risk assessment documentation

A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of the following should the administrator do first?

Apply classifications to the data.

Block access to cloud storage websites.

Create a rule to block outgoing email attachments.

Apply classifications to the data.

Remove all user permissions from shares on the file server.

Which of the following are cases in which an engineer should recommend the decommissioning of a network device? (Select two).

The device's encryption level cannot meet organizational standards.

The device has been moved from a production environment to a test environment.

The device is configured to use cleartext passwords.

The device is moved to an isolated segment on the enterprise network.

The device is moved to a different location in the enterprise.

The device's encryption level cannot meet organizational standards.

The device is unable to receive authorized updates.

A security analyst receives a SIEM alert that someone logged in to the app admin test account, which is only used for the early detection of attacks. The security analyst then reviews the following application log: Which of the following can the security analyst conclude?

A replay attack is being conducted against the application.

An injection attack is being conducted against a user authentication system.

A service account password may have been changed, resulting in continuous failed logins within the application.

A credentialed vulnerability scanner attack is testing several CVEs against the application.

An organization is having difficulty correlating events from its individual AV. EDR. DLP. SWG. WAF, MDM. HIPS, and CASB systems. Which of the following is the best way to improve the situation?

Utilize a SIEM to centralize logs and dashboards.

Remove expensive systems that generate few alerts.

Modify the systems to alert only on critical issues.

Utilize a SIEM to centralize logs and dashboards.

Implement a new syslog/NetFlow appliance.

CompTIA SY0-701 Practice Test 4 - Free Online Exam Prep & Questions

Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Select two).

Become a Premium Member for full access

Unlock Premium Member

CompTIA SY0-701 Practice Test 4

Question

CompTIA SY0-701 Practice Tests

Practice Tests