CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 1311:

  A vendor needs to remotely and securely transfer files from one server to another using the command line. Which of the following protocols should be implemented to allow for this type of access? (Choose two.)

  A. SSH

  B. SNMP

  C. RDP

  D. S/MIME

  E. SMTP

  F. SFTP

  Correct Answer: AF

• Question 1312:

  A security analyst needs to propose a remediation plan for each item in a risk register. The item with the highest priority requires employees to have separate logins for SaaS solutions and different password complexity requirements for each solution. Which of the following implementation plans will most likely resolve this security issue?

  A. Creating a unified password complexity standard

  B. Integrating each SaaS solution with the identity provider

  C. Securing access to each SaaS by using a single wildcard certificate

  D. Configuring geofencing on each SaaS solution

  Correct Answer: B

• Question 1313:

  Callers speaking a foreign language are using company phone numbers to make unsolicited phone calls to a partner organization. A security analyst validates through phone system logs that the calls are occurring and the numbers are not being spoofed. Which of the following is the most likely explanation?

  A. The executive team is traveling internationally and trying to avoid roaming charges.

  B. The company's SIP server security settings are weak.

  C. Disgruntled employees are making calls to the partner organization.

  D. The service provider has assigned multiple companies the same numbers.

  Correct Answer: B

• Question 1314:

  Which of the following best describes a penetration test that resembles an actual external attack?

  A. Known environment

  B. Partially known environment

  C. Bug bounty

  D. Unknown environment

  Correct Answer: D

• Question 1315:

  A security analyst is reviewing the following system command history on a computer that was recently utilized in a larger attack on the corporate infrastructure:

  

  Which of the following best describes what the analyst has discovered?

  A. A successful privilege escalation attack by a local user

  B. A user determining what level of permissions the user has

  C. A systems administrator performing routine maintenance

  D. An attempt to utilize living-off-the-land binaries

  Correct Answer: A

• Question 1316:

  A security administrator is reviewing reports about suspicious network activity occurring on a subnet. Users on the network report that connectivity to various websites is intermittent. The administrator logs in to a workstation and reviews the following command output:

  

  Which of the following best describes what is occurring on the network?

  A. ARP poisoning

  B. On-path attack

  C. URL redirection

  D. IP address conflicts

  Correct Answer: A

  ARP poisoning. This is a type of attack where an attacker sends false ARP messages to a network to associate their own MAC address with the IP addresses of other devices. This allolws the attacker to intercept, modify, or block the network

  traffic intended for those devices.

  The command output shows the same MAC address is associated with multiple IP addresses on the network, which is a sign of ARP poisoning. The attacker is likely using the this techinque to perform a man-in-the-middle attack and disrupt

  the network connectivity of the users.

• Question 1317:

  A web application for a bank displays the following output when showing details about a customer's bank account:

  

  Which of the following techniques is most likely implemented in this web application?

  A. Data minimization

  B. Data scrambling

  C. Data masking

  D. Anonymization

  Correct Answer: C

• Question 1318:

  The security operations center is researching an event concerning a suspicious IP address. A security analyst looks at the following event logs and discovers that a significant portion of the user accounts have experienced failed log-in attempts when authenticating from the same IP address: Which of the following most likely describes the attack that took place?

  

  A. Spraying

  B. Brute-force

  C. Dictionary

  D. Rainbow table

  Correct Answer: A

  The answer should be spraying because they were attempting to log in with different user accounts.

• Question 1319:

  A security analyst finds a rogue device during a monthly audit of current endpoint assets that are connected to the network. The corporate network utilizes 802.1 X for access control. To be allowed on the network, a device must have a known hardware address, and a valid username and password must be entered in a captive portal. The following is the audit report:

  

  Which of the following is the most likely way a rogue device was allowed to connect?

  A. A user performed a MAC cloning attack with a personal device.

  B. A DHCP failure caused an incorrect IP address to be distributed.

  C. An administrator bypassed the security controls for testing.

  D. DNS hijacking let an attacker intercept the captive portal traffic.

  Correct Answer: A

• Question 1320:

  A security administrator recently reset local passwords and the following values were recorded in the system:

  

  Which of the following is the security administrator most likely protecting against?

  A. Account sharing

  B. Weak password complexity

  C. Pass-the-hash attacks

  D. Password compromise

  Correct Answer: C