CompTIA CompTIA Certifications SY0-601 Questions & Answers

• Question 141:

  Which Of the following control types is patch management classified under?

  A. Deterrent

  B. Physical

  C. Corrective

  D. Detective

  Correct Answer: C

  Patch management is a process that involves applying updates or fixes to software to address bugs, vulnerabilities, or performance issues. Patch management is classified under corrective control type, which is a type of control that aims to restore normal operations after an incident or event has occurred. Corrective controls can help mitigate the impact or damage caused by an incident or event and prevent it from happening again. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://www.csoonline.com/article/2124681/why-third-party-security-is-your- security.html

• Question 142:

  A company a "right to forgotten" request To legally comply, the company must remove data related to the requester from its systems. Which Of the following Company most likely complying with?

  A. NIST CSF

  B. GDPR

  C. PCI OSS

  D. ISO 27001

  Correct Answer: B

  GDPR stands for General Data Protection Regulation, which is a law that regulates data protection and privacy in the European Union (EU) and the European Economic Area (EEA). GDPR also applies to the transfer of personal data outside the EU and EEA areas. GDPR grants individuals the right to request the deletion or removal of their personal data from an organization's systems under certain circumstances. This right is also known as the "right to be forgotten" or the "right to erasure". An organization that receives such a request must comply with it within a specified time frame, unless there are legitimate grounds for retaining the data.

  References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://gdpr-info.eu/issues/right-to-be-forgotten/

• Question 143:

  Which of the following is a solution that can be used to stop a disgruntled employee from copying confidential data to a USB drive?

  A. DLP

  B. TLS

  C. AV

  D. IDS

  Correct Answer: A

  DLP stands for data loss prevention, which is a set of tools and processes that aim to prevent unauthorized access, use, or transfer of sensitive data. DLP can help mitigate the risk of data exfiltration by disgruntled employees or external attackers by monitoring and controlling data flows across endpoints, networks, and cloud services. DLP can also detect and block attempts to copy, transfer, or upload sensitive data to a USB drive or other removable media based on predefined policies and rules.

  References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://www.microsoft.com/en-us/security/business/ security-101/what-is-data-loss- prevention-dlp

• Question 144:

  A data cento has experienced an increase in under-voltage events Mowing electrical grid maintenance outside the facility These events are leading to occasional losses of system availability.

  Which of the following would be the most cost-effective solution for the data center 10 implement?

  A. Uninterruptible power supplies with battery backup

  B. Managed power distribution units lo track these events

  C. A generator to ensure consistent, normalized power delivery

  D. Dual power supplies to distribute the load more evenly

  Correct Answer: A

  Uninterruptible power supplies with battery backup would be the most cost-effective solution for the data center to implement to prevent under-voltage events following electrical grid maintenance outside the facility. An uninterruptible power supply (UPS) is a device that provides emergency power to a load when the main power source fails or drops below an acceptable level. A UPS with battery backup can help prevent under-voltage events by switching to battery power when it detects a voltage drop or outage in the main power source. A UPS with battery backup can also protect the data center equipment from power surges or spikes. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://www.apc.com/us/en/faqs/FA158852/

• Question 145:

  A security administrator is integrating several segments onto a single network. One of the segments, which includes legacy devices, presents a significant amount of risk to the network.

  Which of the following would allow users to access to the legacy devices without compromising the security of the entire network?

  A. NIDS

  B. MAC filtering

  C. Jump server

  D. IPSec

  E. NAT gateway

  Correct Answer: C

  A jump server is a device that acts as an intermediary between users and other devices on a network. A jump server can provide a secure and controlled access point to the legacy devices without exposing them directly to the network. A jump server can also enforce authentication, authorization, logging, and auditing policies.

• Question 146:

  A company would like to move to the cloud. The company wants to prioritize control and security over cost and ease of management. Which of the following cloud models would best suit this company's priorities?

  A. Public

  B. Hybrid

  C. Community

  D. Private

  Correct Answer: D

  A private cloud model would best suit the company's priorities of control and security over cost and ease of management. In a private cloud, the infrastructure is dedicated to a single organization, providing greater control over the environment and the ability to implement strict security measures. This is in contrast to public, community, or hybrid cloud models, where resources are shared among multiple organizations, potentially compromising control and security. While private clouds can be more expensive and more difficult to manage, they the highest level of control and security for the company.

  Reference:

  -

  CompTIA Security+ Certification Exam Objectives (SY0-601), Section 3.2: "Explain the importance of secure staging deployment concepts."

  -

  Cisco: Private Cloud - https://www.cisco.com/c/en/us/solutions/cloud/private-cloud.html

• Question 147:

  Which of the following is a security implication of newer 1CS devices that are becoming more common in corporations?

  A. Devices with celular communication capabilities bypass traditional network security controls

  B. Many devices do not support elliptic-curve encryption algorithms due to the overhead they require.

  C. These devices often lade privacy controls and do not meet newer compliance regulations

  D. Unauthorized voice and audio recording can cause loss of intellectual property

  Correct Answer: D

  Industrial control systems (ICS) are devices that monitor and control physical processes, such as power generation, manufacturing, or transportation. Newer ICS devices may have voice and audio capabilities that can be exploited by

  attackers to eavesdrop on sensitive conversations or capture confidential information. This can result in the loss of intellectual property or trade secrets.

  References:

  https://www.comptia.org/content/guides/what-is-industrial-control-system-security

• Question 148:

  A small, local company experienced a ransomware attack. The company has one web- facing server and a few workstations. Everything is behind an ISP firewall. A single web- facing server is set up on the router to forward all ports so that the server is viewable from the internet. The company uses an older version of third-party software to manage the website. The assets were never patched. Which of the following should be done to prevent an attack like this from happening again? (Select three).

  A. Install DLP software to prevent data loss.

  B. Use the latest version of software.

  C. Install a SIEM device.

  D. Implement MDM.

  E. Implement a screened subnet for the web server.

  F. Install an endpoint security solution.

  G. Update the website certificate and revoke the existing ones.

  H. Deploy additional network sensors.

  Correct Answer: BEF

• Question 149:

  A desktop computer was recently stolen from a desk located in the lobby of an office building. Which of the following would be the best way to secure a replacement computer and deter future theft?

  A. Installing proximity card readers on all entryway doors

  B. Deploying motion sensor cameras in the lobby

  C. Encrypting the hard drive on the new desktop

  D. Using cable locks on the hardware

  Correct Answer: D

  Using cable locks on the hardware can be an effective way to secure a desktop computer and deter future theft. Cable locks are physical security devices that attach to the computer case and to a nearby stationary object, such as a desk or wall. This makes it more difficult for a thief to remove the computer without damaging it or attracting attention. Installing proximity card readers on all entryway doors can enhance physical security by limiting access to authorized individuals. Deploying motion sensor cameras in the lobby can also help deter theft by capturing images of any unauthorized individuals entering the premises or attempting to steal the computer. Encrypting the hard drive on the replacement desktop can also help protect sensitive data in the event of theft, but it does not provide physical security for the device itself.

• Question 150:

  A security investigation revealed mat malicious software was installed on a server using a server administrator credentials. During the investigation the server administrator explained that Telnet was regularly used to log in. Which of the blowing most likely occurred?

  A. A spraying attack was used to determine which credentials to use

  B. A packet capture tool was used to steal the password

  C. A remote-access Trojan was used to install the malware

  D. A directory attack was used to log in as the server administrator

  Correct Answer: B

  Telnet is an insecure protocol that transmits data in cleartext over the network. This means that anyone who can intercept the network traffic can read the data, including the username and password of the server administrator. A packet capture tool is a software or hardware device that can capture and analyze network packets. An attacker can use a packet capture tool to steal the password and use it to install malicious software on the server.

  References: https:// www.comptia.org/content/guides/what-is-network-security