Top Tips Of Up To Date SY0-601 Questions

NEW QUESTION 1
Which of the following algorithms has the SMALLEST key size?

• A. DES
• B. Twofish
• C. RSA
• D. AES

Answer: B

NEW QUESTION 2
Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation.
INSTRUCTIONS
Not all attacks and remediation actions will be used.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:

NEW QUESTION 3
A security analyst is reviewing a new website that will soon be made publicly available. The analyst sees the following in the URL:
http://dev-site.comptia.org/home/show.php?sessionID=77276554&loc=us
The analyst then sends an internal user a link to the new website for testing purposes, and when the user clicks the link, the analyst is able to browse the website with the following URL:
http://dev-site.comptia.org/home/show.php?sessionID=98988475&loc=us Which of the following application attacks is being tested?

• A. Pass-the-hash
• B. Session replay
• C. Object deference
• D. Cross-site request forgery

Answer: B

NEW QUESTION 4
Which of the following control sets should a well-written BCP include? (Select THREE)

• A. Preventive
• B. Detective
• C. Deterrent
• D. Corrective
• E. Compensating
• F. Physical
• G. Recovery

Answer: ADG

NEW QUESTION 5
A company wants to deploy PKI on its Internet-facing website. The applications that are currently deployed are:
www.company.com (main website)
contactus.company.com (for locating a nearby location)
quotes.company.com (for requesting a price quote)
The company wants to purchase one SSL certificate that will work for all the existing applications and any future applications that follow the same naming conventions, such as store.company.com. Which of the following certificate types would BEST meet the requirements?

• A. SAN
• B. Wildcard
• C. Extended validation
• D. Self-signed

Answer: B

NEW QUESTION 6
A security analyst is looking for a solution to help communicate to the leadership team the seventy levels of the organization’s vulnerabilities. Which of the following would BEST meet this need?

• A. CVE
• B. SIEM
• C. SOAR
• D. CVSS

Answer: D

NEW QUESTION 7
Which of the following will MOST likely adversely impact the operations of unpatched traditional programmable-logic controllers, running a back-end LAMP server and OT systems with human-management interfaces that are accessible over the Internet via a web interface? (Choose two.)

• A. Cross-site scripting
• B. Data exfiltration
• C. Poor system logging
• D. Weak encryption
• E. SQL injection
• F. Server-side request forgery

Answer: DF

NEW QUESTION 8
A company provides mobile devices to its users to permit access to email and enterprise applications. The company recently started allowing users to select from several different vendors and device models. When configuring the MDM, which of the following is a key security implication of this heterogeneous device approach?

• A. The most common set of MDM configurations will become the effective set of enterprise mobile security controls.
• B. All devices will need to support SCEP-based enrollment; therefore, the heterogeneity of the chosen architecture may unnecessarily expose private keys to adversaries.
• C. Certain devices are inherently less secure than others, so compensatory controls will be needed to address the delta between device vendors.
• D. MDMs typically will not support heterogeneous deployment environments, so multiple MDMs will need to be installed and configured.

Answer: C

NEW QUESTION 9
Which of the following would BEST identify and remediate a data-loss event in an enterprise using third-party, web-based services and file-sharing platforms?

• A. SIEM
• B. CASB
• C. UTM
• D. DLP

Answer: D

NEW QUESTION 10
Which of the following policies would help an organization identify and mitigate potential single points of failure in the company’s IT/security operations?

• A. Least privilege
• B. Awareness training
• C. Separation of duties
• D. Mandatory vacation

Answer: C

NEW QUESTION 11
An organization with a low tolerance for user inconvenience wants to protect laptop hard drives against loss or data theft. Which of the following would be the MOST acceptable?

• A. SED
• B. HSM
• C. DLP
• D. TPM

Answer: A

NEW QUESTION 12
Which of the following are requirements that must be configured for PCI DSS compliance? (Select TWO).

• A. Testing security systems and processes regularly
• B. Installing and maintaining a web proxy to protect cardholder data
• C. Assigning a unique ID to each person with computer access
• D. Encrypting transmission of cardholder data across private networks
• E. Benchmarking security awareness training for contractors
• F. Using vendor-supplied default passwords for system passwords

Answer: BD

NEW QUESTION 13
Which of the following technical controls is BEST suited for the detection and prevention of buffer overflows on hosts?

• A. DLP
• B. HIDS
• C. EDR
• D. NIPS

Answer: C

NEW QUESTION 14
A company's Chief Information Office (CIO) is meeting with the Chief Information Security Officer (CISO) to plan some activities to enhance the skill levels of the company's developers. Which of the following would be MOST suitable for training the developers'?

• A. A capture-the-flag competition
• B. A phishing simulation
• C. Physical security training
• D. Baste awareness training

Answer: B

NEW QUESTION 15
A manufacturer creates designs for very high security products that are required to be protected and controlled by the government regulations. These designs are not accessible by corporate networks or the Internet. Which of the following is the BEST solution to protect these designs?

• A. An air gap
• B. A Faraday cage
• C. A shielded cable
• D. A demilitarized zone

Answer: A

NEW QUESTION 16
The Chief Financial Officer (CFO) of an insurance company received an email from Ann, the company’s Chief Executive Officer (CEO), requesting a transfer of $10,000 to an account. The email states Ann is on vacation and has lost her purse, containing cash and credit cards. Which of the following social-engineering techniques is the attacker using?

• A. Phishing
• B. Whaling
• C. Typo squatting
• D. Pharming

Answer: B

NEW QUESTION 17
In which of the following situations would it be BEST to use a detective control type for mitigation?

• A. A company implemented a network load balancer to ensure 99.999% availability of its web application.
• B. A company designed a backup solution to increase the chances of restoring services in case of a natural disaster.
• C. A company purchased an application-level firewall to isolate traffic between the accounting department and the information technology department.
• D. A company purchased an IPS system, but after reviewing the requirements, the appliance was supposed to monitor, not block, any traffic.
• E. A company purchased liability insurance for flood protection on all capital assets.

Answer: D

NEW QUESTION 18
A network administrator would like to configure a site-to-site VPN utilizing iPSec. The administrator wants the tunnel to be established with data integrity encryption, authentication and anti- replay functions Which of the following should the administrator use when configuring the VPN?

• A. AH
• B. EDR
• C. ESP
• D. DNSSEC

Answer: C

NEW QUESTION 19
Which of the following incident response steps involves actions to protect critical systems while maintaining business operations?

• A. Investigation
• B. Containment
• C. Recovery
• D. Lessons learned

Answer: B

NEW QUESTION 20
A user is concerned that a web application will not be able to handle unexpected or random input without crashing. Which of the following BEST describes the type of testing the user should perform?

• A. Code signing
• B. Fuzzing
• C. Manual code review
• D. Dynamic code analysis

Answer: D

NEW QUESTION 21
......