CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 1191:

  Remote workers in an organization use company-provided laptops with locally installed applications and locally stored data Users can store data on a remote server using an encrypted connection. The organization discovered data stored on a laptop had been made available to the public Which of the following security solutions would mitigate the risk of future data disclosures?

  A. FDE

  B. TPM

  C. HIDS D. VPN

  Correct Answer: A

• Question 1192:

  During an incident, a company's CIRT determines it is necessary to observe the continued network-based transactions between a callback domain and the malware running on an enterprise PC.

  Which of the following techniques would be BEST to enable this activity while reducing the nsk of lateral spread and the nsk that the adversary would notice any changes?

  A. Physically move the PC to a separate Internet point of presence.

  B. Create and apply microsegmentation rules,

  C. Emulate the malware in a heavily monitored DMZ segment

  D. Apply network blacklisting rules for the adversary domain

  Correct Answer: B

  AH secure in entire packet

• Question 1193:

  Which of the following function as preventive, detective, and deterrent controls to reduce the risk of physical theft? (Select TWO).

  A. Mantraps

  B. Security guards

  C. Video surveillance

  D. Fences

  E. Bollards

  F. Antivirus

  Correct Answer: AB

  A - a mantrap can trap those personnal with bad intension(preventive), and kind of same as detecting, since you will know if someone is trapped there(detective), and it can deter those personnal from approaching as well(deterrent) B security guards can sure do the same thing as above, preventing malicious personnal from entering(preventive+deterrent), and notice those personnal as well(detective)

• Question 1194:

  A network analyst is setting up a wireless access point for a home office in a remote, rural location. The requirement is that users need to connect to the access point securely but do not want to have to remember passwords

  Which of the following should the network analyst enable to meet the requirement?

  A. MAC address filtering

  B. 802.1X

  C. Captive portal

  D. WPS

  Correct Answer: D

• Question 1195:

  A security analyst wants to verify that a client-server (non-web) application is sending encrypted traffic. Which of the following should the analyst use?

  A. openssl

  B. hping

  C. netcat

  D. tcpdump

  Correct Answer: D

  tcpdump for sure. OpenSSL is what might be used to secure traffic, but tcpdump is a packet analyzer that will show you if data is being sent in the clear. It will verify OpenSSL is working.

• Question 1196:

  An organization wants to integrate its incident response processes into a workflow with automated decision points and actions based on predefined playbooks. Which of the following should the organization implement?

  A. SIEM

  B. SOAR

  C. EDR

  D. CASB

  Correct Answer: B

• Question 1197:

  Which of the following would MOST likely be identified by a credentialed scan but would be missed by an uncredentialed scan?

  A. Vulnerabilities with a CVSS score greater than 6.9.

  B. Critical infrastructure vulnerabilities on non-IP protocols.

  C. CVEs related to non-Microsoft systems such as printers and switches.

  D. Missing patches for third-party software on Windows workstations and servers.

  Correct Answer: D

  https://subscription.packtpub.com/book/networking_and_servers/9781789348019/8/ch08lvl1sec91/

  credentialed-versus-non-credentialed-scans A non-credentialed scan will monitor the network and see any vulnerabilities that an attacker would easily find; we should fix the vulnerabilities found with a non-credentialed scan first, as this is what the hacker will see when they enter your network. For example, an administrator runs a non-credentialed scan on the network and finds that there are three missing patches. The scan does not provide many details on these missing patches. The administrator installs the missing patches to keep the systems up to date as they can only operate on the information produced for them.

• Question 1198:

  When planning to build a virtual environment, an administrator needs to achieve the following:

  1.

  Establish policies to limit who can create new VMs.

  2.

  Allocate resources according to actual utilization.

  3.

  Require justification for requests outside of the standard requirements.

  4.

  Create standardized categories based on size and resource requirements.

  Which of the following is the administrator MOST likely trying to do?

  A. Implement IaaS replication

  B. Product against VM escape

  C. Deploy a PaaS

  D. Avoid VM sprawl

  Correct Answer: D

  from the comptia official textbook: "VM sprawl occurs when an organization deploys numerous virtual machines without an overarching IT management or security plan in place. Although VMs are easy to create and clone, they have the same licensing and security management requirements as a metalinstalled OS. Uncontrolled VM creation can quickly lead to a situation where manual oversight cannot keep up with system demand. To prevent or avoid VM sprawl, a policy for developing and deploying VMs must be established and enforced. This should include establishing a library of initial or foundation VM images that are to be used to develop and deploy new services. In some instances, VM sprawl relates to the use of lower-powered equipment that results in poorly performing VMs."

• Question 1199:

  A major clothing company recently lost a large amount of proprietary information.

  The security officer must find a solution to ensure this never happens again .

  Which of the following is the BEST technical implementation to prevent this from happening again?

  A. Configure DLP solutions

  B. Disable peer-to-peer sharing

  C. Enable role-based access controls.

  D. Mandate job rotation.

  E. Implement content filters

  Correct Answer: A

• Question 1200:

  The Chief Information Security Officer directed a risk reduction in shadow IT and created a policy requiring all unsanctioned high-risk SaaS applications to be blocked from user access

  Which of the following is the BEST security solution to reduce this risk?

  A. CASB

  B. VPN concentrator

  C. MFA

  D. VPC endpoint

  Correct Answer: A