CompTIA Security+ Certification Exam SY0-601 Dumps V11.02 Is Online

1. An incident response technician collected a mobile device during an investigation.

Which of the following should the technician do to maintain chain of custody?

2. An organization that is located in a flood zone is MOST likely to document the concerns associated with the restoration of IT operation in a:

3. A security analyst is reviewing the output of a web server log and notices a particular account is attempting to transfer large amounts of money:

Which of the following types of attack is MOST likely being conducted?

4. Which of the following is the BEST reason to maintain a functional and effective asset management policy that aids in ensuring the security of an organization?

5. Which of the following scenarios would make a DNS sinkhole effective in thwarting an attack?

6. A company is implementing MFA for all applications that store sensitive data. The IT manager wants MFA to be non-disruptive and user friendly.

Which of the following technologies should the IT manager use when implementing MFA?

7. An attacker has successfully exfiltrated several non-salted password hashes from an online system. Given the logs below:

Which of the following BEST describes the type of password attack the attacker is performing?

8. A security analyst receives a SIEM alert that someone logged in to the appadmin test account, which is only used for the early detection of attacks.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

The security analyst then reviews the following application log:

Which of the following can the security analyst conclude?

9. A technician needs to prevent data loss in a laboratory. The laboratory is not connected to any external networks.

Which of the following methods would BEST prevent data? (Select TWO)

10. A security administrator suspects there may be unnecessary services running on a server.

Which of the following tools will the administrator MOST likely use to confirm the suspicions?

11. A security analyst is reviewing information regarding recent vulnerabilities.

Which of the following will the analyst MOST likely consult to validate which platforms have been affected?

12. Which of the following describes the ability of code to target a hypervisor from inside

13. In which of the following situations would it be BEST to use a detective control type for mitigation?

14. A security analyst needs to implement an MDM solution for BYOD users that will allow the company to retain control over company emails residing on the devices and limit data exfiltration that might occur if the devices are lost or stolen.

Which of the following would BEST meet these requirements? (Select TWO).

15. The Chief Security Officer (CSO) at a major hospital wants to implement SSO to help improve in the environment patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that training and guidance have been provided to frontline staff, and a risk analysis has not been performed.

Which of the following is the MOST likely cause of the CRO’s concerns?

16. When selecting a technical solution for identity management, an architect chooses to go from an in-house to a third-party SaaS provider.

Which of the following risk management strategies is this an example of?

17. A forensics investigator is examining a number of unauthorized payments the were reported on the company's website. Some unusual log entries show users received an email for an unwanted mailing list and clicked on a link to attempt to unsubscribe. One of the users reported the email to the phishing team, and the forwarded email revealed the link to be:

Which of the following will the forensics investigator MOST likely determine has occurred?

18. Which of the following should be put in place when negotiating with a new vendor about the timeliness of the response to a significant outage or incident?

19. Which of the following will MOST likely cause machine learning and Al-enabled systems to operate with unintended consequences?

20. A network engineer needs to build a solution that will allow guests at the company’s headquarters to access the Internet via WiFi. This solution should not allow access to the internal corporate network, but it should require guests to sign off on the acceptable use policy before accessing the Internet.

Which of the following should the engineer employ to meet these requirements?

21. Which of the following provides the BEST protection for sensitive information and data stored in cloud-based services but still allows for full functionality and searchability of data within the cloud-based services?

22. An analyst needs to identify the applications a user was running and the files that were open before the user’s computer was shut off by holding down the power button.

Which of the following would MOST likely contain that information?

23. An organization's RPO for a critical system is two hours. The system is used Monday through Friday, from 9:00 am to 5:00 pm. Currently, the organization performs a full backup every Saturday that takes four hours to complete.

Which of the following additional backup implementations would be the BEST way for the analyst to meet the business requirements?

24. An organization has hired a security analyst to perform a penetration test. The analyst captures 1Gb worth of inbound network traffic to the server and transfer the pcap back to the machine for analysis.

Which of the following tools should the analyst use to further review the pcap?

25. An attacker was easily able to log in to a company's security camera by performing a basic online search for a setup guide for that particular camera brand and model.

Which of the following BEST describes the configurations the attacker exploited?

26. A Chief Security Officer (CSO) is concerned about the amount of PII that is stored locally on each salesperson’s laptop. The sales department has a higher-than-average rate of lost equipment.

Which of the following recommendations would BEST address the CSO’s concern?

27. A user contacts the help desk to report the following:

✑ Two days ago, a pop-up browser window prompted the user for a name and password after connecting to the corporate wireless SSID. This had never happened before, but the user entered the information as requested.

✑ The user was able to access the Internet but had trouble accessing the department share until the next day.

✑ The user is now getting notifications from the bank about unauthorized transactions.

Which of the following attack vectors was MOST likely used in this scenario?

28. A security analyst is investigation an incident that was first reported as an issue connecting to network shares and the internet, while reviewing logs and tool output, the analyst sees the following:

Which of the following attacks has occurred?

29. Which of the following organizational policies are MOST likely to detect fraud that is being conducted by existing employees? (Select TWO).

30. A company was recently breached Part of the company's new cybersecurity strategy is to centralize the logs from all security devices

Which of the following components forwards the logs to a central source?

31. A cloud administrator is configuring five compute instances under the same subnet in a VPC Three instances are required to communicate with one another, and the other two must he logically isolated from all other instances in the VPC.

Which of the following must the administrator configure to meet this requirement?

32. Phishing and spear-phishing attacks have been occurring more frequently against a company’s staff.

Which of the following would MOST likely help mitigate this issue?

33. A small company that does not have security staff wants to improve its security posture.

Which of the following would BEST assist the company?

34. A security analyst is investigating an incident to determine what an attacker was able to do on a compromised laptop.

The analyst reviews the following SIEM log:

Which of the following describes the method that was used to compromise the laptop?

35. A security analyst has received an alert about being sent via email. The analyst’s Chief information Security Officer (CISO) has made it clear that PII must be handle with extreme care.

From which of the following did the alert MOST likely originate?

36. A pharmaceutical sales representative logs on to a laptop and connects to the public WiFi to check emails and update reports.

Which of the following would be BEST to prevent other devices on the network from directly accessing the laptop? (Choose two.)

37. Which of the following technical controls is BEST suited for the detection and prevention of buffer overflows on hosts?

38. A security analyst Is hardening a Linux workstation and must ensure It has public keys forwarded to remote systems for secure login

Which of the following steps should the analyst perform to meet these requirements? (Select TWO).

39. A cybersecurity analyst reviews the log files from a web server and sees a series of files that indicates a directory-traversal attack has occurred.

Which of the following is the analyst MOST likely seeing?

A)

B)

C)

D)

40. A global pandemic is forcing a private organization to close some business units and reduce staffing at others.

Which of the following would be BEST to help the organization’s executives determine the next course of action?

41. Joe, a user at a company, clicked an email link led to a website that infected his workstation. Joe, was connected to the network, and the virus spread to the network shares. The protective measures failed to stop this virus, and It has continues to evade detection.

Which of the following should administrator implement to protect the environment from this malware?

42. A Chief Security Office's (CSO's) key priorities are to improve preparation, response, and recovery practices to minimize system downtime and enhance organizational resilience to ransomware attacks.

Which of the following would BEST meet the CSO's objectives?

43. A network administrator has been asked to design a solution to improve a company's security posture.

The administrator is given the following, requirements?

• The solution must be inline in the network

• The solution must be able to block known malicious traffic

• The solution must be able to stop network-based attacks

Which of the following should the network administrator implement to BEST meet these requirements?

44. A cybersecurity manager has scheduled biannual meetings with the IT team and department leaders to discuss how they would respond to hypothetical cyberattacks. During these meetings, the manager presents a scenario and injects additional information throughout the session to replicate what might occur in a dynamic cybersecurity event involving the company, its facilities, its data, and its staff.

Which of the following describes what the manager is doing?

45. An organization blocks user access to command-line interpreters but hackers still managed to invoke the interpreters using native administrative tools.

Which of the following should the security team do to prevent this from Happening in the future?

46. A security analyst is logged into a Windows file server and needs to see who is accessing files and from which computers

Which of the following tools should the analyst use?

47. A security analyst needs to determine how an attacker was able to use User3 to gain a foothold within a company's network. The company's lockout policy requires that an account be locked out for a minimum of 15 minutes after three unsuccessful attempts.

While reviewing the log files, the analyst discovers the following:

Which of the following attacks MOST likely occurred?

48. Which of the following relets to applications and systems that are used within an organization without consent or approval?

49. A Chief Executive Officer's (CEO) personal information was stolen in a social engineering attack.

Which of the following sources would reveal if the CEO's personal information is for sale?

50. A security administrator currently spends a large amount of time on common security tasks, such aa report generation, phishing investigations, and user provisioning and deprovisioning This prevents the administrator from spending time on other security projects. The business does not have the budget to add more staff members.

Which of the following should the administrator implement?

51. A user recently entered a username and password into a recruiting application website that had been forged to look like the legitimate site.

Upon investigation, a security analyst the identifies the following:

• The legitimate websites IP address is 10.1.1.20 and eRecruit local resolves to the IP

• The forged website's IP address appears to be 10.2.12.99. based on NetFtow records

• AH three at the organization's DNS servers show the website correctly resolves to the legitimate IP

• DNS query logs show one of the three DNS servers returned a result of 10.2.12.99 (cached) at the approximate time of the suspected compromise.

Which of the following MOST likely occurred?

52. Which of the following scenarios BEST describes a risk reduction technique?

53. A company has determined that if its computer-based manufacturing is not functioning for 12 consecutive hours, it will lose more money that it costs to maintain the equipment.

Which of the following must be less than 12 hours to maintain a positive total cost of ownership?

54. An organization with a low tolerance for user inconvenience wants to protect laptop hard drives against loss or data theft.

Which of the following would be the MOST acceptable?

55. A vulnerability assessment report will include the CVSS score of the discovered vulnerabilities because the score allows the organization to better.

56. The Chief Executive Officer (CEO) of an organization would like staff members to have the flexibility to work from home anytime during business hours, incident during a pandemic or crisis, However, the CEO is concerned that some staff members may take advantage of the of the flexibility and work from high-risk countries while on holidays work to a third-party organization in another country. The Chief information Officer (CIO) believes the company can implement some basic to mitigate the majority of the risk.

Which of the following would be BEST to mitigate CEO’s concern? (Select TWO).

57. A security analyst reviews the datacenter access logs for a fingerprint scanner and notices an abundance of errors that correlate with users' reports of issues accessing the facility.

Which of the following MOST likely the cause of the cause of the access issues?

58. A startup company is using multiple SaaS and IaaS platforms to stand up a corporate infrastructure and build out a customer-facing web application.

Which of the following solutions would be BEST to provide security, manageability, and visibility into the platforms?

59. A manufacturer creates designs for very high security products that are required to be protected and controlled by the government regulations. These designs are not accessible by corporate networks or the Internet.

Which of the following is the BEST solution to protect these designs?

60. The website http://companywebsite.com requires users to provide personal Information, Including security question responses, for registration.

Which of the following would MOST likely cause a data breach?

61. A cybersecurity administrator has a reduced team and needs to operate an on-premises network and security infrastructure efficiently. To help with the situation, the administrator decides to hire a service provider.

Which of the following should the administrator use?

62. A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM.

The analyst first looks at the domain controller and finds the following events:

To better understand what is going on, the analyst runs a command and receives the following output:

Based on the analyst’s findings, which of the following attacks is being executed?

63. A security engineer is reviewing log files after a third discovered usernames and passwords for the organization’s accounts. The engineer sees there was a change in the IP address for a vendor website one earlier. This change lasted eight hours.

Which of the following attacks was MOST likely used?

64. A technician needs to prevent data loss in a laboratory. The laboratory is not connected to any external networks.

Which of the following methods would BEST prevent the exfiltration of data? (Select TWO).

65. A security administrator suspects an employee has been emailing proprietary information to a competitor. Company policy requires the administrator to capture an exact copy of the employee’s hard disk.

Which of the following should the administrator use?

66. A user is concerned that a web application will not be able to handle unexpected or random input without crashing.

Which of the following BEST describes the type of testing the user should perform?

67. A company processes highly sensitive data and senior management wants to protect the sensitive data by utilizing classification labels.

Which of the following access control schemes would be BEST for the company to implement?

68. A security administrator needs to create a RAIS configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drivers will fail simultaneously.

Which of the following RAID configurations should the administration use?

69. A company provides mobile devices to its users to permit access to email and enterprise applications. The company recently started allowing users to select from several different vendors and device models.

When configuring the MDM, which of the following is a key security implication of this heterogeneous device approach?

70. An organization just experienced a major cyberattack modem. The attack was well coordinated sophisticated and highly skilled.

Which of the following targeted the organization?

71. The CSIRT is reviewing the lessons learned from a recent incident. A worm was able to spread unhindered throughout the network and infect a large number of computers and servers.

Which of the following recommendations would be BEST to mitigate the impacts of a similar incident in the future?

72. An organization has been experiencing outages during holiday sales and needs to ensure availability of its point-of-sale systems The IT administrator has been asked to improve both server-data fault tolerance and site availability under high consumer load.

Which of the following are the BEST options to accomplish this objective'? (Select TWO)

73. A security analyst receives the configuration of a current VPN profile and notices the authentication is only applied to the IP datagram portion of the packet.

Which of the following should the analyst implement to authenticate the entire packet?

74. Users at organization have been installing programs from the internet on their workstations without first proper authorization. The organization maintains a portal from which users can install standardized programs. However, some users have administrative access on their workstations to enable legacy programs to function property.

Which of the following should the security administrator consider implementing to address this issue?

75. An organization has a growing workforce that is mostly driven by additions to the sales

department. Each newly hired salesperson relies on a mobile device to conduct business. The Chief Information Officer (CIO) is wondering it the organization may need to scale down just as quickly as it scaled up. The ClO is also concerned about the organization's security and customer privacy.

Which of the following would be BEST to address the ClO’s concerns?

76. A user enters a password to log in to a workstation and is then prompted to enter an authentication code.

Which of the following MFA factors or attributes are being utilized in the authentication process? (Select TWO).

77. Which of the following is MOST likely to contain ranked and ordered information on the likelihood and potential impact of catastrophic events that may affect business processes and systems, while also highlighting the residual risks that need to be managed after mitigating controls have been implemented?

78. DRAG DROP

A security engineer is setting up passwordless authentication for the first time.

INSTRUCTIONS

Use the minimum set of commands to set this up and verify that it works. Commands cannot be reused.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

79. Joe, an employee, receives an email stating he won the lottery. The email includes a link that requests a name, mobile phone number, address, and date of birth be provided to confirm Joe’s identity before sending him the prize.

Which of the following BEST describes this type of email?

80. A security analyst is performing a forensic investigation compromised account credentials. Using the Event Viewer, the analyst able to detect the following message, ‘’Special privileges assigned to new login.’’ Several of these messages did not have a valid logon associated with the user before these privileges were assigned.

Which of the following attacks is MOST likely being detected?