CompTIA SY0-701 Practice Test - Questions Answers, Page 20

In a cloud environment, high availability is typically ensured through the use of a load balancer. A load balancer distributes network or application traffic across multiple servers, ensuring that no single server becomes overwhelmed and that services remain available even if one or more servers fail. This setup enhances the reliability and availability of applications.

Load balancer: Ensures high availability by distributing traffic across multiple servers or instances, preventing overload and ensuring continuous availability.

Access broker: Typically refers to a service that facilitates secure access to resources, not directly related to high availability.

Cloud HSM (Hardware Security Module): Provides secure key management in the cloud but does not specifically ensure high availability.

WAF (Web Application Firewall): Protects web applications by filtering and monitoring HTTP traffic but is not primarily focused on ensuring high availability.

To secure an on-site data center against intrusion from an insider, the best measure is to use an access badge system. Access badges control who can enter restricted areas by verifying their identity and permissions, thereby preventing unauthorized access from insiders.

Access badge: Provides controlled and monitored access to restricted areas, ensuring that only authorized personnel can enter.

Bollards: Provide physical barriers to prevent vehicle access but do not prevent unauthorized personnel entry.

Motion sensor: Detects movement but does not control or restrict access.

Video surveillance: Monitors and records activity but does not physically prevent intrusion.

A honeypot is most likely to be deployed to obtain and analyze attacker activity and techniques. A honeypot is a decoy system set up to attract attackers, providing an opportunity to study their methods and behaviors in a controlled environment without risking actual systems.

Honeypot: A decoy system designed to lure attackers, allowing administrators to observe and analyze attack patterns and techniques.

Firewall: Primarily used to block unauthorized access to networks, not for observing attacker behavior.

IDS (Intrusion Detection System): Detects and alerts on malicious activity but does not specifically engage attackers to observe their behavior.

Layer 3 switch: Used for routing traffic within networks, not for analyzing attacker techniques.

A UPS (Uninterruptible Power Supply) would most likely mitigate the impact of an extended power outage on a company's environment. A UPS provides backup power and ensures that systems continue to run during short-term power outages, giving enough time to perform an orderly shutdown or switch to a longer-term power solution like a generator.

Hot site: A fully operational offsite data center that can be used if the primary site becomes unavailable. It's more suitable for disaster recovery rather than mitigating short-term power outages.

UPS: Provides immediate backup power, protecting against data loss and hardware damage during power interruptions.

Snapshots: Used for data backup and recovery, not for power outage mitigation.

SOAR (Security Orchestration, Automation, and Response): A platform for automating security operations, not related to power outage mitigation.

The most likely reason the download was blocked, resulting in a false positive, is a misconfiguration in the endpoint protection software. False positives occur when legitimate actions are incorrectly identified as threats due to incorrect settings or overly aggressive rules in the security software.

Misconfiguration in the endpoint protection software: Common cause of false positives, where legitimate activities are flagged incorrectly due to improper settings.

Zero-day vulnerability: Refers to previously unknown vulnerabilities, which are less likely to be associated with a false positive.

Supply chain attack: Involves compromising the software supply chain, which is a broader and more severe issue than a simple download being blocked.

Incorrect file permissions: Would prevent access to files but not typically cause an alert in endpoint protection software.

To prevent an accounting clerk from sending money to an attacker's bank account due to fraudulent instructions, the most effective measure would be updating the processes for sending wire transfers. This can include implementing verification steps, such as requiring multiple approvals for changes in payment instructions and directly confirming new account details with trusted sources.

Updating processes for sending wire transfers: Involves adding verification and approval steps to prevent fraudulent transfers.

Standardizing security incident reporting: Important for handling incidents but not specifically focused on preventing fraudulent wire transfers.

Executing regular phishing campaigns: Helps raise awareness but may not directly address the process vulnerability.

Implementing insider threat detection measures: Useful for detecting malicious activities but does not directly prevent fraudulent transfer instructions.

An NGFW (Next-Generation Firewall) utilizing application inspection could have identified and blocked the unusual use of HTTP over port 53. Application inspection allows NGFWs to analyze traffic at the application layer, identifying and blocking suspicious or non-standard protocol usage, such as HTTP traffic on DNS port 53.

NGFW utilizing application inspection: Inspects traffic at the application layer and can block non-standard protocol usage, such as HTTP over port 53.

WAF utilizing SSL decryption: Focuses on protecting web applications and decrypting SSL traffic but may not detect the use of HTTP over port 53.

UTM utilizing a threat feed: Provides comprehensive security but may not focus specifically on application layer inspection.

SD-WAN utilizing IPSec: Enhances secure WAN connections but is not primarily designed to inspect and block specific application traffic.

Patch availability most impacts an administrator's ability to address Common Vulnerabilities and Exposures (CVEs) discovered on a server. If a patch is not available for a discovered vulnerability, the administrator cannot remediate the issue directly through patching, which leaves the system exposed until a patch is released.

Patch availability: Directly determines whether a discovered vulnerability can be fixed promptly. Without available patches, administrators must look for other mitigation strategies.

Rescanning requirements: Important for verifying the effectiveness of patches but secondary to the availability of the patches themselves.

Organizational impact: Considers the potential consequences of vulnerabilities but does not directly impact the ability to apply patches.

Risk tolerance: Influences how the organization prioritizes addressing vulnerabilities but does not affect the actual availability of patches.

A false positive occurs when a vulnerability scan identifies a vulnerability that is not actually present on the systems that were scanned. This means that the scan has incorrectly flagged a system as vulnerable.

False positive: Incorrectly identifies a vulnerability that does not exist on the scanned systems.

False negative: Fails to identify an existing vulnerability on the system.

True positive: Correctly identifies an existing vulnerability.

True negative: Correctly identifies that there is no vulnerability.