Begin your scholarly ascent fortified by the academic treasures embedded within the SY0-601 dumps. Consciously synchronized to the diverse intricacies of the curriculum, the SY0-601 dumps spotlight a broad array of practice questions, fostering enduring proficiency. Whether the coherent narrative of PDFs beckons or the captivating tableau of the VCE format enthralls, the SY0-601 dumps remain an unparalleled companion. A discerning study guide, nestled at the heart of the SY0-601 dumps, demystifies complex topics, ensuring a seamless grasp. With an enduring belief in the transformative power of these resources, we robustly present our 100% Pass Guarantee.
[New On the Scene] Dive deep into exam studies with the free SY0-601 PDF and Exam Questions, pledging a 100% pass rate
Question 1:
DRAG DROP
Determine the types of attacks below by selecting an option from the dropdown list. Determine the types of Attacks from right to specific action.
Select and Place:
Correct Answer:
A. Phishing.
B. Whaling.
C. Vishing.
D. Spim.
E. Social engineering.
A: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.
Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website,
however, is bogus and set up only to steal the information the user enters on the page.
B: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In
whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles.
Hackers who engage in whaling often describe these efforts as “reeling in a big fish,”applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may,
for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that
hackers can pursue whaling, leading C-level or toplevel executives in business and government to stay vigilant about the possibility of cyber threats.
C: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he
or she will profit.
D: SPIM is a term sometimes used to refer to spam over IM (Instant Messaging). It\’s also called just spam, instant spam, or IM marketing. No matter what the name, it consists of unwanted messages transmitted through some form of instant
messaging service, which can include Short Message Service (SMS).
E: Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It is one of the greatest threats that organizations
today encounter.
A social engineer runs what used to be called a “con game.” For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that
compromises the network\’s security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires
immediate network access. Appealing to vanity, appealing to authority, appealing to greed, and old-fashioned eavesdropping are other typical social engineering techniques.
References:
http://www.webopedia.com/TERM/P/phishing.html
http://www.techopedia.com/definition/28643/whaling
http://www.webopedia.com/TERM/V/vishing.html
http://searchsecurity.techtarget.com/definition/social-engineering
Question 2:
To secure an application after a large data breach, an e-commerce site will be resetting all users\’ credentials.
Which of the following will BEST ensure the site\’s users are not compromised after the reset?
A. A password reuse policy
B. Account lockout after three failed attempts
C. Encrypted credentials in transit
D. A geofencing policy based on login history
Correct Answer: A
1) Data breach -> password leak 2) Reset -> new password 3) User\’s reuse password for 1) -> account easily compromised
A password resue policy would mean that you cannot use the same or previously used password. This is also the most common option you see whenever there is a big data leak that was done.
Question 3:
An enterpnse has hired an outside security firm to facilitate penetration testing on its network and applications. The firm has agreed to pay for each vulnerability that ts discovered. Which of the following BEST represents the type of testing that is being used?
A. White-box
B. Red-leam
C. Bug bounty
D. Gray-box
E. Black-box
Correct Answer: C
A bug bounty program provides a monetary incentive for security researchers to discover vulnerabilities. One of the benefits is that bug bounty programs only pay researchers when they find vulnerabilities. Companies don\’t pay researchers for their time.
Reference: https://en.wikipedia.org/wiki/Bug_bounty_program
Question 4:
Which of the following would BEST provide detective and corrective controls for thermal regulation?
A. A smoke detector
B. A fire alarm
C. An HVAC system
D. A fire suppression system
E. Guards
Correct Answer: C
What are the functions of an HVAC system?
An HVAC system is designed to control the environment in which it works. It achieves this by controlling the temperature (THERMAL) of a room through heating and cooling. It also controls the humidity level in that environment by controlling the movement and distribution of air inside the room. So it provides detective and corrective controls for THERMAL regulation.
Question 5:
An organization implemented a process that compares the settings currently configured on systems against secure configuration guidelines in order to identify any gaps Which of the following control types has the organization implemented?
A. Compensating
B. Corrective
C. Preventive
D. Detective
Correct Answer: D
The organization has implemented a detective control. A detective control is a security control that is used to detect security incidents or policy violations after they have occurred. In this case, the organization has implemented a process that compares the settings currently configured on systems against secure configuration guidelines in order to identify any gaps. This is an example of a detective control, as it is designed to detect any deviations from the organization\’s secure configuration standards. Detective controls are typically used in conjunction with other types of controls, such as preventive controls, which are designed to prevent incidents from occurring, and corrective controls, which are used to correct any issues that are detected. Compensating controls are used to address risks that cannot be mitigated by other means.
Question 6:
An organization recently released a software assurance policy that requires developers to run code scans each night on the repository. After the first night, the security team alerted the developers that more than 2,000 findings were reported and need to be addressed. Which of the following is the MOST likely cause for the high number of findings?
A. The vulnerability scanner was not properly configured and generated a high number of false positives
B. Third-party libraries have been loaded into the repository and should be removed from the codebase.
C. The vulnerability scanner found several memory leaks during runtime, causing duplicate reports for the same issue.
D. The vulnerability scanner was not loaded with the correct benchmarks and needs to be updated.
Correct Answer: A
The most likely cause for the high number of findings is that the vulnerability scanner was not properly configured and generated a high number of false positives. False positive results occur when a vulnerability scanner incorrectly identifies a non-vulnerable system or application as being vulnerable. This can happen due to incorrect configuration, over- sensitive rule sets, or outdated scan databases.
https://www.professormesser.com/security-plus/sy0-601/sy0-601-video/sy0-601-comptia- security-plus- course/
Question 7:
A security analyst discovers that one of the web APIs is being abused by an unknown third party. Logs indicate that the third party is attempting to manipulate the parameters being passed to the API endpoint. Which of the following solutions would best help to protect against the attack?
A. DLP
B. SIEM
C. NIDS
D. WAF
Correct Answer: D
A Web Application Firewall (WAF) is a security solution specifically designed to protect web applications and APIs from various attacks, including those that attempt to manipulate parameters and exploit vulnerabilities in the application layer. It sits between the clients (users or third parties) and the web server, inspecting the HTTP/HTTPS traffic and filtering out malicious requests.
In this scenario, the security analyst has identified that the web API is being abused by an unknown third party attempting to manipulate the parameters being passed to the API endpoint. A WAF would be able to analyze and validate the incoming requests to the API, blocking any requests that contain suspicious or malicious parameters. It can enforce security policies, perform input validation, and protect against common web application attacks like SQL injection, cross-site scripting (XSS), and parameter tampering.
Question 8:
An analyst visits an internet forum looking for information about a tool. The analyst finds a threat that appears to contain relevant information. One of the posts says the following:
Which of the following BEST describes the attack that was attempted against the forum readers?
A. SOU attack
B. DLL attack
C. XSS attack
D. API attack
Correct Answer: C
Cross-site scripting attacks may occur anywhere that possibly malicious users are allowed to post unregulated material to a trusted website for the consumption of other valid users. The most common example can be found in bulletin-board websites which provide web based mailing list-style functionality. https://owasp.org/www-community/attacks/xss/ https://www.acunetix.com/websitesecurity/cross-site-scripting/
Question 9:
A third party asked a user to share a public key for secure communication. Which of the following file formats should the user choose to share the key?
A. .pfx
B. .csr
C. .pvk
D. .cer
Correct Answer: D
Question 10:
An attacker was eavesdropping on a user who was shopping online. The attacker was able to spoof the IP address associated with the shopping site. Later, the user received an email regarding the credit card statement with unusual purchases. Which of the following attacks took place?
A. On-path attack
B. Protocol poisoning
C. Domain hijacking
D. Bluejacking
Correct Answer: A
On path attack is often known as man in the middle.
Question 11:
A company\’s end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server. Which of the following best describes what the security analyst is seeing?
A. Concurrent session usage
B. Secure DNS cryptographic downgrade
C. On-path resource consumption
D. Reflected denial of service
Correct Answer: D
In a reflected denial of service (DoS) attack, the attacker sends requests to a large number of public servers, spoofing the source IP address to make it appear as if the requests are coming from the target server. These public servers, acting as amplifiers, then send the responses back to the target server, overwhelming it with inbound traffic.
In this case, the DNS server is receiving a flood of inbound traffic due to the DNS requests being amplified by other servers. The DNS server\’s CPU, disk, and memory usage are minimal because it is only processing legitimate DNS queries sent to it. However, the network interface is overwhelmed with amplified responses, causing the end users to be unable to reach external websites.
Question 12:
A company suspects that some corporate accounts were compromised. The number of suspicious logins from locations not recognized by the users is increasing Employees who travel need their accounts protected without the nsk of blocking legitimate login requests that may be made over new sign-in properties. Which of the following security controls can be implemented?
A. Enforce MFA when an account request reaches a nsk threshold
B. Implement geofencing to only allow access from headquarters
C. Enforce time-based login requests that align with business hours
D. Shift the access control scheme to a discretionary access control
Correct Answer: A
MFA increases security because even if one credential becomes compromised, unauthorized users will be unable to meet the second authentication requirement and will not be able to access the targeted physical space, computing device, network, or database.
Enforce MFA when an account request reaches a risk threshold.
This is likely the most convenient implementation that would work for all employees as an additional element(s) would need to be needed for authentication/authorization. ========================
(B)
– Implementing geofencing to only allow access from headquarters might stop the suspicious logins, however, it would be inconvenient for employees not physically located near headquarters such as the traveling employees.
(C)
Enforcing time-based login requests to align with business hours could also be inconvenient for traveling/global employees that work in different times compared the business\’s normal business hours.
(D)
With Discretionary access control, the owner of a resource can decide who can have access to the resource and you can modify the access at anytime. The option to shift the access control scheme to a discretionary access control wouldn\’t really address the login issue either if the account of someone who is authorized to access a resource was compromised. The attacker can still access the resource using their credentials.
Question 13:
A systems administrator is troubleshooting a server\’s connection to an internal web server. The administrator needs to determine the correct ports to use. Which of the following tools BEST shows which ports on the web server are in a listening state?
A. ipconfig
B. ssh
C. Ping
D. Netstat
Correct Answer: D
A. ipconfig – Just shows you the IP information for your current machine
B. ssh – this is used for file transfers (ftp etc etc)
C. ping – this is just to reach out to a node to get a response from it
https://www.sciencedirect.com/topics/computer-science/listening-port
Question 14:
A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application.
The security administrator isolated the switch on a separate VLAN and set up a patch routine. Which of the following steps should also be taken to harden the smart switch?
A. Set up an air gap for the switch.
B. Change the default password for the switch.
C. Place the switch In a Faraday cage.
D. Install a cable lock on the switch
Correct Answer: B
A. Set up an air gap for the switch. – it uses cloud monitoring, this doesn\’t work
B. Change the default password for the switch. – only one that makes sense, seems to easy, but the other answers are ridiculous given the information.
C. Place the switch in a Faraday cage. – this is a red haring
D. Install a cable lock on the switch. – you don\’t do this with switches, like physically locking a switch in place – you could put cable locks on the individual patch cable, but not the switch itself, this is typically secured behind a locked door or locked rack door.
Question 15:
A company requires hard drives to be securely wiped before sending decommissioned systems to recycling. Which of the following best describes this policy?
A. Enumeration
B. Sanitization
C. Destruction
D. Inventory
Correct Answer: B
Data sanitization involves purposely, permanently deleting, or destroying data from a storage device, to ensure it cannot be recovered.