CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 111:

  Multiple beaconing activities to a malicious domain have been observed. The malicious domain is hosting malware from various endpoints on the network. Which of the following technologies would be best to correlate the activities between the different endpoints?

  A. Firewall

  B. SIEM

  C. IPS

  D. Protocol analyzer

  Correct Answer: B

  SIEM stands for Security Information and Event Management, which is a technology that collects, analyzes, and correlates data from multiple sources, such as firewall logs, IDS/IPS alerts, network devices, applications, and endpoints. SIEM provides real-time monitoring and alerting of security events, as well as historical analysis and reporting for compliance and forensic purposes. A SIEM technology would be best to correlate the activities between the different endpoints that are beaconing to a malicious domain. A SIEM can detect the malicious domain by comparing it with threat intelligence feeds or known indicators of compromise (IOCs). A SIEM can also identify the endpoints that are communicating with the malicious domain by analyzing the firewall logs and other network traffic data. A SIEM can alert the security team of the potential compromise and provide them with relevant information for investigation and remediation. A security analyst reviews web server logs and notices the following line:

  104.35. 45.53 [22/May/2020:07 : 00:58 +0100] "GET . UNION ALL SELECT user login, user _ pass, user email from wp users---- HTTP/I.I" 200 1072 http://www.example.com/wordpress/wp--admin/

• Question 112:

  Which of the following processes would most likely help an organization that has conducted an incident response exercise to improve performance and identify challenges?

  A. Lessons learned

  B. Identification

  C. Simulation

  D. Containment

  Correct Answer: A

  Lessons learned is a process that would most likely help an organization that has conducted an incident response exercise to improve performance and identify challenges. Lessons learned is a process that involves reviewing and evaluating the incident response exercise to identify what went well, what went wrong, and what can be improved. Lessons learned can help an organization enhance its incident response capabilities, address any gaps or weaknesses, and update its incident response plan accordingly.

  References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://www.sans.org/reading-room/whitepapers/incident/incident-handlers- handbook- 33901

• Question 113:

  A company was recently breached Pan of the company's new cybersecurity strategy is to centralize? the togs horn all security devices.

  Which of the following components forwards the logs to a central source?

  A. Log enrichment

  B. Log queue

  C. Log parser

  D. Log collector

  Correct Answer: D

  A log collector is a component that forwards the logs from all security devices to a central source. A log collector can be a software tool or a hardware appliance that collects logs from various sources, such as firewalls, routers, servers, applications, or endpoints. A log collector can also perform functions such as log filtering, parsing, aggregation, normalization, and enrichment. A log collector can help centralize logging by sending the collected logs to a central log server or a security information and event management (SIEM) system for further analysis and correlation.

  References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0- 601-exam-objectives https://geekflare.com/open-source-centralized-logging/

• Question 114:

  A security operations technician is searching the log named /vax/messages for any events that were associated with a workstation with the IP address 10.1.1.1.

  Which of the following would provide this information?

  A. cat /var/messages | grep 10.1.1.1

  B. grep 10.1.1.1 | cat /var/messages

  C. grep /var/messages | cat 10.1.1.1

  D. cat 10.1.1.1 | grep /var/messages

  Correct Answer: A

  the cat command reads the file and streams its content to standard output. The | symbol connects the output of the left command with the input of the right command. The grep command returns all lines that match the regex. The cut command splits each line into fields based on a delimiter and extracts a specific field.

• Question 115:

  An attacker is using a method to hide data inside of benign files in order to exfiltrate confidential data. Which of the following is the attacker most likely using?

  A. Base64 encoding

  B. Steganography

  C. Data encryption

  D. Perfect forward secrecy

  Correct Answer: B

  Steganography is a technique for hiding data inside of benign files such as images, audio, or video. This can be used to exfiltrate confidential data without raising suspicion or detection. References: How to Hide Files Inside Files [Images, Folder] - Raymond.CC Blog; How to Hide Data in a Secret Text File Compartment - How-To Geek; How to Hide Data Within an Image - Medium

• Question 116:

  Which of the following allow access to remote computing resources, a operating system and centrdized configuration and data?

  A. Containers

  B. Edge computing

  C. Thin client

  D. Infrastructure as a service

  Correct Answer: C

  Thin clients are devices that have minimal hardware and software components and rely on a remote server to provide access to computing resources, an operating system, and centralized configuration and data. Thin clients can reduce the cost, complexity, and security risks of managing multiple devices.

• Question 117:

  An organization wants to quickly assess how effectively the IT team hardened new laptops.

  Which of the following would be the best solution to perform this assessment?

  A. Install a SIEM tool and properly configure it to read the OS configuration files.

  B. Load current baselines into the existing vulnerability scanner.

  C. Maintain a risk register with each security control marked as compliant or non-compliant.

  D. Manually review the secure configuration guide checklists.

  Correct Answer: D

• Question 118:

  A police department is using the cloud to share information city officials.

  Which of the cloud models describes this scenario?

  A. Hybrid

  B. private

  C. pubic

  D. Community

  Correct Answer: D

  A community cloud model describes a scenario where a cloud service is shared among multiple organizations that have common goals, interests, or requirements. A community cloud can be hosted by one of the organizations, a third-party provider, or a combination of both. A community cloud can offer benefits such as cost savings, security, compliance, and collaboration. A police department using the cloud to share information with city officials is an example of a community cloud model.

  References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://www.ibm.com/cloud/learn/community-cloud

• Question 119:

  A security engineer is concerned the strategy for detection on endpoints is too heavily dependent on previously defined attacks. The engineer wants a tool that can monitor for changes to key files and network traffic for the device. Which of the following tools should the engineer select?

  A. HIDS

  B. AV

  C. NGF-W

  D. DLP

  Correct Answer: A

  The security engineer should select a Host Intrusion Detection System (HIDS) to address the concern. HIDS monitors and analyzes the internals of a computing system, such as key files and network traffic, for any suspicious activity. Unlike antivirus software (AV), which relies on known signatures of malware, HIDS can detect anomalies, policy violations, and previously undefined attacks by monitoring system behavior and the network traffic of the device.

  References:

  1.

  CompTIA Security+ Certification Exam Objectives (SY0-601): https://www.comptia.jp/pdf/Security%2B%20SY0-601%20Exam%20Objectives.pdf

  2.

  Scarfone, K., and Mell, P. (2007). Guide to Intrusion Detection and Prevention Systems (IDPS): Recommendations of the National Institute of Standards and Technology. NIST Special Publication 800-94. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf

• Question 120:

  A financial institution recently joined a bug bounty program to identify security issues in the institution's new public platform. Which of the following best describes who the institution is working with to identify security issues?

  A. Script kiddie

  B. Insider threats

  C. Malicious actor

  D. Authorized hacker

  Correct Answer: D

  An authorized hacker, also known as an ethical hacker or a white hat hacker, is someone who uses their skills and knowledge to find and report security issues in a system or application with the permission of the owner. An authorized hacker follows the rules and guidelines of the bug bounty program and does not cause any harm or damage to the system or its users.