CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 121:

  An organization recently released a zero-trust policy that will enforce who is able to remotely access certain data. Authenticated users who access the data must have a need to know, depending on their level of permissions.

  Which of the following is the first step the organization should take when implementing the policy?

  A. Determine a quality CASB solution.

  B. Configure the DLP policies by user groups.

  C. Implement agentless NAC on boundary devices.

  D. Classify all data on the file servers.

  Correct Answer: D

  zero trust is a security strategy that assumes breach and verifies each request as though it originates from an untrusted network12. A zero trust policy is a set of "allow rules" that specify conditions for accessing certain resources3. According to one source4, the first step in implementing a zero trust policy is to identify and classify all data and assets in the organization. This helps to determine the level of sensitivity and risk associated with each resource and apply appropriate access controls. Classifying all data on the file servers is the first step in implementing a zero trust policy because it helps to determine the level of sensitivity and risk associated with each resource and apply appropriate access controls. Reference: Zero Trust implementation guidance | Microsoft Learn

• Question 122:

  Which of the following should be addressed first on security devices before connecting to the network?

  A. Open permissions

  B. Default settings

  C. API integration configuration

  D. Weak encryption

  Correct Answer: B

  Before connecting security devices to the network, it is crucial to address default settings first. Manufacturers often ship devices with default settings that include default usernames, passwords, and configurations. These settings are widely known and can be easily exploited by attackers. Changing default settings helps to secure the device and prevent unauthorized access. Reference: CompTIA Security+ SY0-501 Exam Objectives, Section 3.2: "Given a scenario, implement secure systems design." (https://www.comptia.jp/pdf/Security%2B%20SY0-501%20Exam%20Objectives.pdf)

• Question 123:

  A security analyst is reviewing packet capture data from a compromised host On the In the packet capture. analyst locates packets that contain large of text, Which of following is most likely installed on compromised host?

  A. Keylogger

  B. Spyware

  C. Torjan

  D. Ransomware

  Correct Answer: A

  A keylogger is a type of malware that records the keystrokes of the user and sends them to a remote attacker. The attacker can use the keystrokes to steal the user's credentials, personal information, or other sensitive data. A keylogger can generate packets that contain large amounts of text, as the packet capture data shows.

• Question 124:

  Which of the following best describes the situation where a successfully onboarded employee who is using a fingerprint reader is denied access at the company's mam gate?

  A. Crossover error rate

  B. False match raw

  C. False rejection

  D. False positive

  Correct Answer: C

  False rejection Short A false rejection occurs when a biometric system fails to recognize an authorized user and denies access. This can happen due to poor quality of the biometric sample, environmental factors, or system errors.

  References:

  https://www.comptia.org/blog/what-is-biometrics

• Question 125:

  Which of the following security controls can be used to prevent multiple from using a unique card swipe and being admitted to a entrance?

  A. Visitor logs

  B. Faraday cages

  C. Access control vestibules

  D. Motion detection sensors

  Correct Answer: C

  Access control vestibules are physical security controls that consist of two sets of doors or gates that create a small enclosed space between them. Only one door or gate can be opened at a time, and only one person can enter or exit the vestibule at a time. Access control vestibules can prevent multiple people from using a unique card swipe and being admitted to a secure entrance, as they require each person to authenticate individually and prevent tailgating or piggybacking.

• Question 126:

  Which of the following is required in order (or an IDS and a WAF to be effective on HTTPS traffic?

  A. Hashing

  B. DNS sinkhole

  C. TLS inspection

  D. Data masking

  Correct Answer: C

  TLS (Transport Layer Security) is a protocol that is used to encrypt data sent over HTTPS (Hypertext Transfer Protocol Secure). In order for an intrusion detection system (IDS) and a web application firewall (WAF) to be effective on HTTPS traffic, they must be able to inspect the encrypted traffic. TLS inspection allows the IDS and WAF to decrypt and inspect the traffic, allowing them to detect any malicious activity.

  References:

  [1] CompTIA Security+ Study Guide Exam SY0-601 [1], Sixth Edition, Chapter 11, "Network Security Monitoring" [2] CompTIA Security+ Get Certified Get Ahead: SY0-501 Study Guide, Chapter 7, "Intrusion Detection and Prevention"

• Question 127:

  A company that provides an online streaming service made its customers' personal data including names and email addresses publicly available in a cloud storage service. As a result, the company experienced an increase m the number of requests to delete user accounts. Which of the following best describes the consequence of tins data disclosure?

  A. Regulatory tines

  B. Reputation damage

  C. Increased insurance costs

  D. Financial loss

  Correct Answer: B

  Reputation damage Short Reputation damage is the loss of trust or credibility that a company suffers when its customers' personal data is exposed or breached. This can lead to customer dissatisfaction, loss of loyalty, and requests to delete user accounts. References: https://www.comptia.org/content/guides/what-is-cybersecurity

• Question 128:

  Which of the following can be used to detect a hacker who is stealing company data over port 80?

  A. Web application scan

  B. Threat intelligence

  C. Log aggregation

  D. Packet capture

  Correct Answer: D

  Using a SIEM tool to monitor network traffic in real-time and detect any anomalies or malicious activities Monitoring all network protocols and ports to detect suspicious volumes of traffic or connections to uncommon IP addresses Monitoring for outbound traffic patterns that indicate malware communication with command and control servers, such as beaconing or DNS tunneling Using a CASB tool to control access to cloud resources and prevent data leaks or downloads Encrypting data at rest and in transit and enforcing strong authentication and authorization policies

• Question 129:

  A company is enhancing the security of the wireless network and needs to ensure only employees with a valid certificate can authenticate to the network. Which of the following should the company implement?

  A. PEAP

  B. PSK

  C. WPA3

  D. WPS

  Correct Answer: A

  PEAP stands for Protected Extensible Authentication Protocol, which is a protocol that can provide secure authentication for wireless networks. PEAP can use certificates to authenticate the server and the client, or only the server. PEAP can also use other methods, such as passwords or tokens, to authenticate the client. PEAP can ensure only employees with a valid certificate can authenticate to the network.

• Question 130:

  A cybersecurity analyst needs to adopt controls to properly track and log user actions to an individual. Which of the following should the analyst implement?

  A. Non-repudiation

  B. Baseline configurations

  C. MFA

  D. DLP

  Correct Answer: A

  Non-repudiation is the process of ensuring that a party involved in a transaction or communication cannot deny their involvement. By implementing non-repudiation controls, a cybersecurity analyst can properly track and log user actions, attributing them to a specific individual. This can be achieved through methods such as digital signatures, timestamps, and secure logging mechanisms.

  References:

  1. CompTIA Security+ Certification Exam Objectives (SY0-601): https://www.comptia.jp/pdf/CompTIA%20Security%2B%20SY0- 601%20Exam%20Objectives.pdf