Crack CompTIA SY0-601 Exams with Real Practice Tests, CompTIA Security+ (Plus) Certification

Question #1

An analyst visits an Internet forum looking for information about a tool. The analyst finds a thread that appears to contain relevant information. One of the posts says the following: Which of the following BEST describes the attack that was attempted against the forum readers? A.SQLi attack

B. DLL attack C

View answer

Correct Answer: D

Question #2

A network administrator is concerned about users being exposed to malicious content when accessing company cloud applications. The administrator wants to be able to block access to sites based on the AUP. The users must also be protected because many of them work from home or at remote locations, providing on-site customer support. Which of the following should the administrator employ to meet these criteria?

A. Implement NAC

B. Implement an SWG

View answer

Correct Answer: C

Question #3

In which of the following situations would it be BEST to use a detective control type for mitigation?

A. A company implemented a network load balancer to ensure 99

B. A company designed a backup solution to increase the chances of restoring services in case of a natural disaster

E. A company purchased liability insurance for flood protection on all capital assets

View answer

Correct Answer: B

Question #4

A multinational organization that offers web-based services has datacenters that are located only in the United States; however, a large number of its customers are in Australia, Europe, and China. Payments for services are managed by a third party in the United Kingdom that specializes in payment gateways. The management team is concerned the organization is not compliant with privacy laws that cover some of its customers. Which of the following frameworks should the management team follow?

A. Payment Card Industry Data Security Standard B

View answer

Correct Answer: B

Question #5

A company just developed a new web application for a government agency. The application must be assessed and authorized prior to being deployed. Which of the following is required to assess the vulnerabilities resident in the application?

A. Repository transaction logs

B. Common Vulnerabilities and Exposures C

View answer

Correct Answer: D

Question #6

After consulting with the Chief Risk Officer (CRO), a manager decides to acquire cybersecurity insurance for the company. Which of the following risk management strategies is the manager adopting? A.Risk acceptance

B. Risk avoidance C

View answer

Correct Answer: B

Question #7

A security analyst notices several attacks are being blocked by the NIPS but does not see anything on the boundary firewall logs. The attack seems to have been thwarted. Which of the following resiliency techniques was applied to the network to prevent this attack?

A. NIC teaming B

E. Geographic dispersal

View answer

Correct Answer: D

Question #8

The Chief Security Officer (CSO) at a major hospital wants to implement SSO to help improve security in the environment and protect patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that training and guidance have not been provided to frontline staff, and a risk analysis has not been performed. Which of the following is the MOST likely cause of the CRO’s concerns?

A. SSO would simplify username and password management, making it easier for hackers to guess accounts

B. SSO would reduce password fatigue, but staff would still need to remember more complex passwords

View answer

Correct Answer: D

Question #9

An organization would like to remediate the risk associated with its cloud service provider not meeting its advertised 99.999% availability metrics. Which of the following should the organization consult for the exact requirements for the cloud provider? A.SLA B.BPA C.NDA D.MOU

An organization would like to remediate the risk associated with its cloud service provider not meeting its advertised 99. 99% availability metrics

View answer

Correct Answer: A

Question #10

A company has drafted an insider-threat policy that prohibits the use of external storage devices. Which of the following would BEST protect the company from data exfiltration via removable media?

A. Monitoring large data transfer transactions in the firewall logs

B. Developing mandatory training to educate employees about the removable media policy C

View answer

Correct Answer: C

Question #11

Which of the following BEST describes a social engineering attack that relies on an executive at a small business visiting a fake banking website where credit card and account details are harvested?

A. Whaling

B. Spam C

View answer

Correct Answer: D

Question #12

A host was infected with malware. During the incident response, Joe, a user, reported that he did not receive any emails with links, but he had been browsing the Internet all day. Which of the following would MOST likely show where the malware originated?

A. The DNS logs

B. The web server logs C

View answer

Correct Answer: D

Question #13

Phishing and spear-phishing attacks have been occurring more frequently against a company’s staff. Which of the following would MOST likely help mitigate this issue? A.DNSSEC and DMARC

B. DNS query logging C

View answer

Correct Answer: B

Question #14

A network administrator needs to build out a new datacenter, with a focus on resiliency and uptime. Which of the following would BEST meet this objective? (Choose two.)

A. Dual power supply

B. Off-site backups C

E. Scheduled penetration testing

F. Network-attached storage

View answer

Correct Answer: C

Question #15

A security analyst needs to make a recommendation for restricting access to certain segments of the network using only data-link layer security. Which of the following controls will the analyst MOST likely recommend? A.MAC B.ACL C.BPDU D.ARP

A security analyst needs to make a recommendation for restricting access to certain segments of the network using only data-link layer security. Which of the following controls will the analyst MOST likely recommend? A

View answer

Correct Answer: C

Question #16

A company has limited storage space available and an online presence that cannot be down for more than four hours. Which of the following backup methodologies should the company implement to allow for the FASTEST database restore time in the event of a failure, while being mindful of the limited available storage space?

A. Implement full tape backups every Sunday at 8:00 p

B. Implement differential backups every Sunday at 8:00 p

View answer

Correct Answer: BD

Question #17

A web server administrator has redundant servers and needs to ensure failover to the secondary server when the primary server goes down. Which of the following should the administrator implement to avoid disruption?

A. NIC teaming B

View answer

Correct Answer: B

Question #18

An organization’s RPO for a critical system is two hours. The system is used Monday through Friday, from 9:00 a.m. to 5:00 p.m. Currently, the organization performs a full backup every Saturday that takes four hours to complete. Which of the following additional backup implementations would be the MOST efficient way for the analyst to meet the business requirements?

A. Incremental backups Monday through Friday at 6:00 p

B. Full backups Monday through Friday at 6:00 p

View answer

Correct Answer: C

Question #19

A company’s Chief Information Security Officer (CISO) recently warned the security manager that the company’s Chief Executive Officer (CEO) is planning to publish a controversial opinion article in a national newspaper, which may result in new cyberattacks. Which of the following would be BEST for the security manager to use in a threat model? A.Hacktivists

B. White-hat hackers C

View answer

Correct Answer: A

Question #20

A user contacts the help desk to report the following: Two days ago, a pop-up browser window prompted the user for a name and password after connecting to the corporate wireless SSID. This had never happened before, but the user entered the information as requested. The user was able to access the Internet but had trouble accessing the department share until the next day. The user is now getting notifications from the bank about unauthorized transactions. Which of the following attack vectors was MOST likel

A. Rogue access point B

View answer

Correct Answer: D

Question #21

A Chief Information Security Officer (CISO) is concerned about the organization’s ability to continue business operations in the event of a prolonged DDoS attack on its local datacenter that consumes database resources. Which of the following will the CISO MOST likely recommend to mitigate this risk?

A. Upgrade the bandwidth available into the datacenter

B. Implement a hot-site failover location

View answer

Correct Answer: B

Question #22

A systems administrator needs to install the same X.509 certificate on multiple servers. Which of the following should the administrator use? A.Key escrow

B. A self-signed certificate C

View answer

Correct Answer: B

Question #23

A security analyst discovers several .jpg photos from a cellular phone during a forensic investigation involving a compromised system. The analyst runs a forensic tool to gather file metadata. Which of the following would be part of the images if all the metadata is still intact?

A. The GPS location

B. When the file was deleted C

View answer

Correct Answer: B

Question #24

An organization regularly scans its infrastructure for missing security patches but is concerned about hackers gaining access to the scanner’s account. Which of the following would be BEST to minimize this risk while ensuring the scans are useful?

A. Require a complex, eight-character password that is updated every 90 days

B. Perform only non-intrusive scans of workstations

View answer

Correct Answer: C

Question #25

A network administrator is setting up wireless access points in all the conference rooms and wants to authenticate devices using PKI. Which of the following should the administrator configure?

A. A captive portal B

View answer

Correct Answer: B

Question #26

A company has three technicians who share the same credentials for troubleshooting system. Every time credentials are changed, the new ones are sent by email to all three technicians. The security administrator has become aware of this situation and wants to implement a solution to mitigate the risk. Which of the following is the BEST solution for company to implement?

A. SSO authentication B

View answer

Correct Answer: C

Question #27

A company recently set up an e-commerce portal to sell its product online. The company wants to start accepting credit cards for payment, which requires compliance with a security standard. Which of the following standards must the company comply with before accepting credit cards on its e-commerce platform? A.PCI DSS

B. ISO 22301 C

View answer

Correct Answer: C

Question #28

The IT department’s on-site developer has been with the team for many years. Each time an application is released, the security team is able to identify multiple vulnerabilities. Which of the following would BEST help the team ensure the application is ready to be released to production?

A. Limit the use of third-party libraries

B. Prevent data exposure queries

View answer

Correct Answer: A

Question #29

A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM. The analyst first looks at the domain controller and finds the following events: To better understand what is going on, the analyst runs a command and receives the following output: Based on the analyst’s findings, which of the following attacks is being executed?

A. Credential harvesting

B. Keylogger C

View answer

Correct Answer: C

Question #30

Which of the following is the purpose of a risk register?

A. To define the level or risk using probability and likelihood

B. To register the risk with the required regulatory agencies C

View answer

Correct Answer: A

Question #31

A security engineer is installing a WAF to protect the company’s website from malicious web requests over SSL. Which of the following is needed to meet the objective?

A. A reverse proxy B

View answer

Correct Answer: A

Question #32

A small company that does not have security staff wants to improve its security posture. Which of the following would BEST assist the company? A.MSSP B.SOAR C.IaaS D.PaaS

A small company that does not have security staff wants to improve its security posture. Which of the following would BEST assist the company? A

View answer

Correct Answer: B

Question #33

An attacker is attempting to exploit users by creating a fake website with the URL www.validwebsite.com. The attacker’s intent is to imitate the look and feel of a legitimate website to obtain personal information from unsuspecting users. Which of the following social-engineering attacks does this describe?

A. Information elicitation

B. Typo squatting C

View answer

Correct Answer: D

Question #34

After segmenting the network, the network manager wants to control the traffic between the segments. Which of the following should the manager use to control the network traffic? A.A DMZ B.A VPN C.A VLAN D.An ACL

After segmenting the network, the network manager wants to control the traffic between the segments. Which of the following should the manager use to control the network traffic? A

View answer

Correct Answer: AB

Question #35

A large enterprise has moved all its data to the cloud behind strong authentication and encryption. A sales director recently had a laptop stolen, and later enterprise data was found to have been compromised from a local database. Which of the following was the MOST likely cause?

A. Shadow IT

B. Credential stuffing C

E. Bluejacking

View answer

Correct Answer: B

Question #36

Which of the following scenarios would make DNS sinkhole effective in thwarting an attack?

A. An attacker is sniffing traffic to port 53, and the server is managed using unencrypted usernames and passwords

B. An organization is experiencing excessive traffic on port 53 and suspects an attacker is trying to DoS the domain name server

View answer

Correct Answer: A

Question #37

The process of passively gathering information prior to launching a cyberattack is called:

A. tailgating

B. reconnaissance

View answer

Correct Answer: B

Question #38

An enterprise has hired an outside security firm to conduct penetration testing on its network and applications. The firm has been given all the developer’s documentation about the internal architecture. Which of the following BEST represents the type of testing that will occur?

A. Bug bounty

B. White-box C

View answer

Correct Answer: D

Question #39

Which of the following types of controls is a turnstile? A.Physical B.Detective C.Corrective D.Technical

Which of the following types of controls is a turnstile? A. hysical B

View answer

Correct Answer: A

Question #40

A security analyst is reviewing a penetration-testing report from a third-party contractor. The penetration testers used the organization’s new API to bypass a driver to perform privilege escalation on the organization’s web servers. Upon looking at the API, the security analyst realizes the particular API call was to a legacy system running an outdated OS. Which of the following is the MOST likely attack type?

A. Request forgery

B. Session replay C

View answer

Correct Answer: B

Question #41

A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom. Which of the following would BEST prevent this attack from reoccurring? A.Configure the perimeter firewall to deny inbound external connections to SMB ports. B.Ensure endpoint detection and response systems are alerting on suspicious SMB connections. C.Deny unauthenticated users access to shared network folders. D.Verify

A recently discovered zero-day exploit utilizes an unknown vulnerability in the SMB network protocol to rapidly infect computers. Once infected, computers are encrypted and held for ransom

View answer

Correct Answer: A

Question #42

A company is implementing a new SIEM to log and send alerts whenever malicious activity is blocked by its antivirus and web content filters. Which of the following is the primary use case for this scenario?

A. Implementation of preventive controls

B. Implementation of detective controls C

View answer

Correct Answer: A

Question #43

A security administrator checks the table of a network switch, which shows the following output: Which of the following is happening to this switch?

A. MAC flooding

B. DNS poisoning C

View answer

Correct Answer: C

Question #44

A company recently transitioned to a strictly BYOD culture due to the cost of replacing lost or damaged corporate-owned mobile devices. Which of the following technologies would be BEST to balance the BYOD culture while also protecting the company’s data?

A. Containerization

B. Geofencing C

View answer

Correct Answer: C

Question #45

Which of the following is MOST likely to outline the roles and responsibilities of data controllers and data processors? A.SSAE SOC 2 B.PCI DSS C.GDPR D.ISO 31000

Which of the following is MOST likely to outline the roles and responsibilities of data controllers and data processors? A. SAE SOC 2 B

View answer

Correct Answer: C

Question #46

The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and servers. Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in the future?

A. Install a NIDS device at the boundary

B. Segment the network with firewalls

View answer

Correct Answer: B

Question #47

A security analyst is reviewing logs on a server and observes the following output: Which of the following is the security analyst observing?

A. A rainbow table attack

B. A password-spraying attack C

View answer

Correct Answer: A

Question #48

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use? A.RAID 0 B.RAID 1 C.RAID 5 D.RAID 10

A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously

View answer

Correct Answer: C

Question #49

A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. Upon investigation, a security analyst identifies the following: The legitimate website’s IP address is 10.1.1.20 and eRecruit.local resolves to this IP. The forged website’s IP address appears to be 10.2.12.99, based on NetFlow records. All three of the organization’s DNS servers show the website correctly resolves to the legitimate IP. DNS query logs show one of the

A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site. Upon investigation, a security analyst identifies the following: The legitimate website’s IP address is 10

View answer

Correct Answer: A

Question #50

Which of the following scenarios BEST describes a risk reduction technique?

A. A security control objective cannot be met through a technical change, so the company purchases insurance and is no longer concerned about losses from data breaches

B. A security control objective cannot be met through a technical change, so the company implements a policy to train users on a more secure method of operation

View answer

Correct Answer: C

Question #51

Which of the following cloud models provides clients with servers, storage, and networks but nothing else?

A. SaaS

B. PaaS C

View answer

Correct Answer: A

Question #52

A network engineer needs to create a plan for upgrading the wireless infrastructure in a large office. Priority must be given to areas that are currently experiencing latency and connection issues. Which of the following would be the BEST resource for determining the order of priority?

A. Nmap

B. Heat maps C

View answer

Correct Answer: A

Question #53

A security analyst is performing a packet capture on a series of SOAP HTTP requests for a security assessment. Theanalyst redirects the output to a file. After the capture is complete, the analyst needs to review the first transactions quicklyand then search the entire series of requests for a particular string. Which of the following would be BEST to use toaccomplish this task? (Choose two.)

A. head

B. tcpdump C

F. openssl G

View answer

Correct Answer: C

Question #54

A local coffee shop runs a small WiFi hotspot for its customers that utilizes WPA2-PSK. The coffee shop would like to stay current with security trends and wants to implement WPA3 to make its WiFi even more secure. Which of the following technologies will the coffee shop MOST likely use in place of PSK? A.WEP B.MSCHAP C.WPS D.SAE

A local coffee shop runs a small WiFi hotspot for its customers that utilizes WPA2-PSK. The coffee shop would like to stay current with security trends and wants to implement WPA3 to make its WiFi even more secure

View answer

Correct Answer: B

Question #55

An organization has a growing workforce that is mostly driven by additions to the sales department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering if the organization may need to scale down just as quickly as it scaled up. The CIO is also concerned about the organization’s security and customer privacy. Which of the following would be BEST to address the CIO’s concerns?

A. Disallow new hires from using mobile devices for six months

View answer

Correct Answer: D

Question #56

A security audit has revealed that a process control terminal is vulnerable to malicious users installing and executing software on the system. The terminal is beyond end-of-life support and cannot be upgraded, so it is placed on a protected network segment. Which of the following would be MOST effective to implement to further mitigate the reported vulnerability?

A. DNS sinkholing

B. DLP rules on the terminal C

View answer

Correct Answer: B

Question #57

A security analyst receives the configuration of a current VPN profile and notices the authentication is only applied to the IP datagram portion of the packet. Which of the following should the analyst implement to authenticate the entire packet? A.AH B.ESP C.SRTP D.LDAP

A security analyst receives the configuration of a current VPN profile and notices the authentication is only applied to the IP datagram portion of the packet. Which of the following should the analyst implement to authenticate the entire packet? A

View answer

Correct Answer: A

Question #58

To secure an application after a large data breach, an e-commerce site will be resetting all users’ credentials. Which of the following will BEST ensure the site’s users are not compromised after the reset?

A. A password reuse policy

B. Account lockout after three failed attempts C

View answer

Correct Answer: A

Question #59

A cybersecurity manager has scheduled biannual meetings with the IT team and department leaders to discuss how they would respond to hypothetical cyberattacks. During these meetings, the manager presents a scenario and injects additional information throughout the session to replicate what might occur in a dynamic cybersecurity event involving the company, its facilities, its data, and its staff. Which of the following describes what the manager is doing?

A. Developing an incident response plan

B. Building a disaster recovery plan C

View answer

Correct Answer: A

Question #60

While checking logs, a security engineer notices a number of end users suddenly downloading files with the .tar.gz extension. Closer examination of the files reveals they are PE32 files. The end users state they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an external email containing an infected MHT file with an href link a week prior. Which of the following is MOST likely occurring?

A. A RAT was installed and is transferring additional exploit tools

B. The workstations are beaconing to a command-and-control server

View answer

Correct Answer: D

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Crack CompTIA SY0-601 Exams with Real Practice Tests, CompTIA Security+ (Plus) Certification | SPOTO

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Crack CompTIA SY0-601 Exams with Real Practice Tests, CompTIA Security+ (Plus) Certification | SPOTO

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now