SY0-601 CompTIA Security+ Exam Updated Questions

dumps2022-04-16T02:02:46+08:00

Many candidates think SY0-601 exam is much difficult to pass. In fact, it is. We just updated CompTIA certification SY0-601 exam questions, which are corresponding to the SY0-601 exam objectives. The updated SY0-601 exam questions can help you a lot. Free updated CompTIA Security+ SY0-601 exam questions are below.

Page 1 of 7

1. The Admin workstation should ONLY be able to access the servers on the secure network over the default TFTP port.

Instructions: The firewall will process the rules in a top-down manner in order as a first match The port number must be typed in and only one port number can be entered per rule Type ANY for all ports. The original firewall configuration can be reset at any time by pressing the reset button. Once you have met the simulation requirements, click save and then Done to submit.

Hot Area:

2. An organization relies on third-party video conferencing to conduct daily business. Recent security changes now require all remote workers to utilize a VPN to corporate resources .

Which of the following would BEST maintain high-quality video conferencing while minimizing latency when connected to the VPN?

Using geographic diversity to have VPN terminators closer to end users

Utilizing split tunneling so only traffic for corporate resources is encrypted

Purchasing higher-bandwidth connections to meet the increased demand

Configuring QoS properly on the VPN accelerators

3. The concept of connecting a user account across the systems of multiple enterprises is

BEST known as:

federation.

a remote access policy.

multifactor authentication.

single sign-on.

4. While investigating a data leakage incident, a security analyst reviews access control to cloud-hosted data.

The following information was presented in a security posture report.

Based on the report, which of the following was the MOST likely attack vector used against the company?

Spyware

Logic bomb

Potentially unwanted programs

Supply chain

5. A systems administrator is looking for a solution that will help prevent OAuth applications from being leveraged by hackers to trick users into authorizing the use of their corporate credentials .

Which of the following BEST describes this solution?

CASB

UEM

WAF

VPC

6. A systems administrator is considering different backup solutions for the IT infrastructure. The company is looking for a solution that offers the fastest recovery time while also saving the most amount of storage used to maintain the backups .

Which of the following recovery solutions would be the BEST option to meet these requirements?

Snapshot

Differential

Full

Tape

7. An engineer needs to deploy a security measure to identify and prevent data tampering within the enterprise .

Which of the following will accomplish this goal?

Antivirus

IPS

FTP

FIM

8. A company recently experienced an attack during which its main website was directed to the attacker’s web server, allowing the attacker to harvest credentials from unsuspecting customers .

Which of the following should the company implement to prevent this type of attack occurring in the future?

IPSec

SSL/TLS

DNSSEC

S/MIME

9. A security engineer is installing a WAF to protect the company’s website from malicious web requests over SSL .

Which of the following is needed to meet the objective?

A reverse proxy

A decryption certificate

A split-tunnel VPN

Load-balanced servers

10. To further secure a company’s email system, an administrator is adding public keys to DNS records in the company’s domain.

Which of the following is being used?

PFS

SPF

DMARC

DNSSEC

Page 2 of 7

11. Which of the following should be monitored by threat intelligence researchers who search for leaked credentials?

Common Weakness Enumeration

OSINT

Dark web

Vulnerability databases

12. As part of a company's ongoing SOC maturation process, the company wants to implement a method to share cyberthreat intelligence data with outside security partners .

Which of the following will the company MOST likely implement?

TAXII

TLP

TTP

STIX

13. A local coffee shop runs a small WiFi hot-spot for its customers that utilizes WPA2-PSK. The coffee shop would like to stay current with security trends and wants to implement WPA3 to make its WiFi even more secure .

Which of the following technologies will the coffee shop MOST likely use in place of PSK?

WEP

MSCHAP

WPS

SAE

14. The Chief Technology Officer of a local college would like visitors to utilize the school's WiFi but must be able to associate potential malicious activity to a specific person .

Which of the following would BEST allow this objective to be met?

Requiring all new, on-site visitors to configure their devices to use WPS

Implementing a new SSID for every event hosted by the college that has visitors

Creating a unique PSK for every visitor when they arrive at the reception area

Deploying a captive portal to capture visitors' MAC addresses and names

15. Per company security policy, IT staff members are required to have separate credentials to perform administrative functions using just-in-time permissions .

Which of the following solutions is the company Implementing?

Privileged access management

SSO

RADIUS

Attribute-based access control

16. A recent security assessment revealed that an actor exploited a vulnerable workstation within an organization and has persisted on the network for several months. The organization realizes the need to reassess Its security. Strategy for mitigating risks within the perimeter.

Which of the following solutions would BEST support the organization's strategy?

FIM

DLP

EDR

UTM

17. An information security policy states that separation of duties is required for all highly sensitive database changes that involve customers' financial data .

Which of the following will this be BEST to prevent?

Least privilege

An insider threat

A data breach

A change control violation

18. An analyst is generating a security report for the management team. Security guidelines recommend disabling all listening unencrypted services.

Given this output from Nmap.

Which of the following should the analyst recommend to disable?

21/tcp

22/tcp

23/tcp

443/tcp

19. Which of the following components can be used to consolidate and forward inbound Interne! traffic to multiple cloud environments though a single firewall?

Transit gateway

Cloud hot site

Edge computing

DNS sinkhole

20. The Chief Information Security Officer wants to pilot a new adaptive, user-based authentication method. The concept Includes granting logical access based on physical location and proximity .

Which of the following Is the BEST solution for the pilot?

Geofencing

Self-sovereign identification

PKl certificates

SSO

Page 3 of 7

21. A security analyst wants to verify that a client-server (non-web) application is sending encrypted traffic .

Which of the following should the analyst use?

openssl

hping

netcat

tcpdump

22. Ann, a forensic analyst, needs to prove that the data she originally acquired has remained unchanged while in her custody .

Which of the following should Ann use?

Chain of custody

Checksums

Non-repudiation

Legal hold

23. Several employees have noticed other bystanders can clearly observe a terminal where passcodes are being entered .

Which of the following can be eliminated with the use of a privacy screen?

Shoulder surfing

Spear phishing

Impersonation attack

Card cloning

24. After a phishing scam for a user's credentials, the red team was able to craft a payload to deploy on a server. The attack allowed the installation of malicious software that initiates a new remote session .

Which of the following types of attacks has occurred?

Privilege escalation

Session replay

Application programming interface

Directory traversalw

25. A security analyst reports a company policy violation in a case in which a large amount of sensitive data is being downloaded after hours from various mobile devices to an external site. Upon further investigation, the analyst notices that successful login attempts are being conducted with impossible travel times during the same time periods when the unauthorized downloads are occurring. The analyst also discovers a couple of WAPs are using the same SSID, but they have non-standard DHCP configurations and an overlapping channel .

Which of the following attacks is being conducted?

Evil twin

Jamming

DNS poisoning

Bluesnarfing

DDoS

26. An information security officer at a credit card transaction company is conducting a framework-mapping exercise with the internal controls. The company recently established a new office in Europe.

To which of the following frameworks should the security officer map the existing controls? (Select TWO).

ISO

PCI DSS

SOC

GDPR

CSA

NIST

27. Two organizations plan to collaborate on the evaluation of new SIEM solutions for their respective companies. A combined effort from both organizations' SOC teams would speed up the effort .

Which of the following can be written to document this agreement?

MOU

ISA

SLA

NDA

28. An organization has various applications that contain sensitive data hosted in the cloud. The company’s leaders are concerned about lateral movement across applications of different trust levels .

Which of the following solutions should the organization implement to address the concern?

ISFW

UTM

SWG

CASB

29. An organization has implemented a two-step verification process to protect user access to data that 6 stored in the could Each employee now uses an email address of mobile number a code to access the data .

Which of the following authentication methods did the organization implement?

Token key

Static code

Push notification

HOTP

30. A security analyst generated a file named host1.pcap and shared it with a team member who is going to use it for further incident analysis .

Which of the following tools will the other team member MOST likely use to open this file?

Autopsy

Memdump

FTK imager

Wireshark

Page 4 of 7

31. Which of the following environments would MOST likely be used to assess the execution of component parts of a system at both the hardware and software levels and to measure performance characteristics?

Test

Staging

Development

Production

32. A company is providing security awareness training regarding the importance of not forwarding social media messages from unverified sources .

Which of the following risks would this training help to prevent?

Hoaxes

SPIMs

Identity fraud

Credential harvesting

33. The SIEM at an organization has detected suspicious traffic coming a workstation in its internal network. An analyst in the SOC the workstation and discovers malware that is associated with a botnet is installed on the device A review of the logs on the workstation reveals that the privileges of the local account were escalated to a local administrator.

To which of the following groups should the analyst report this real-world event?

The NOC team

The vulnerability management team

The CIRT

The read team

34. Which of the following is the MOST secure but LEAST expensive data destruction method for data that is stored on hard drives?

Pulverizing

Shredding

Incinerating

Degaussing

35. A company Is planning to install a guest wireless network so visitors will be able to access the Internet. The stakeholders want the network to be easy to connect to so time is not wasted during meetings. The WAPs are configured so that power levels and antennas cover only the conference rooms where visitors will attend meetings .

Which of the following would BEST protect the company's Internal wireless network against visitors accessing company resources?

Configure the guest wireless network to be on a separate VLAN from the company's internal wireless network

Change the password for the guest wireless network every month.

Decrease the power levels of the access points for the guest wireless network.

Enable WPA2 using 802.1X for logging on to the guest wireless network.

36. Which of the following is the BEST reason to maintain a functional and effective asset management policy that aids in ensuring the security of an organization?

To provide data to quantity risk based on the organization's systems.

To keep all software and hardware fully patched for known vulnerabilities

To only allow approved, organization-owned devices onto the business network

To standardize by selecting one laptop model for all users in the organization

37. A company uses specially configured workstations tor any work that requires administrator privileges to its Tier 0 and Tier 1 systems. The company follows a strict process to harden systems immediately upon delivery. Even with these strict security measures in place, an incident occurred from one of the workstations. The root cause appears to be that the SoC was tampered with or replaced .

Which of the following MOST likely occurred?

Fileless malware

A downgrade attack

A supply-chain attack

A logic bomb

Misconfigured BIOS

38. Which of the following is an example of risk avoidance?

Installing security updates directly in production to expedite vulnerability fixes

Buying insurance to prepare for financial loss associated with exploits

Not installing new software to prevent compatibility errors

Not taking preventive measures to stop the theft of equipment

39. Which of the following should a data owner require all personnel to sign to legally protect intellectual property?

An NDA

An AUP

An ISA

An MOU

40. The Chief Information Security Officer (CISO) has decided to reorganize security staff to concentrate on incident response and to outsource outbound Internet URL categorization and filtering to an outside company. Additionally, the CISO would like this solution to provide the same protections even when a company laptop or mobile device is away from a home office .

Which of the following should the CISO choose?

CASB

Next-generation SWG

NGFW

Web-application firewall

Page 5 of 7

41. Which of the following function as preventive, detective, and deterrent controls to reduce the risk of physical theft? (Select TWO).

Mantraps

Security guards

Video surveillance

Fences

Bollards

Antivirus

42. Which of the following types of attacks is specific to the individual it targets?

Whaling

Pharming

Smishing

Credential harvesting

43. A cybersecurity administrator needs to allow mobile BYOD devices to access network resources. As the devices are not enrolled to the domain and do not have policies applied to them, which of the following are best practices for authentication and infrastructure security? (Select TWO).

Create a new network for the mobile devices and block the communication to the internal network and servers

Use a captive portal for user authentication.

Authenticate users using OAuth for more resiliency

Implement SSO and allow communication to the internal network

Use the existing network and allow communication to the internal network and servers.

Use a new and updated RADIUS server to maintain the best solution

44. The cost of '©movable media and the security risks of transporting data have become too great for a laboratory. The laboratory has decided to interconnect with partner laboratones to make data transfers easier and more secure. The Chief Security Officer <CSO) has several concerns about proprietary data being exposed once the interconnections are established .

Which of the following security features should the network administrator implement lo prevent unwanted data exposure to users in partner laboratories?

VLAN zoning with a file-transfer server in an external-facing zone

DLP running on hosts to prevent file transfers between networks

NAC that permits only data-transfer agents to move data between networks

VPN with full tunneling and NAS authenticating through the Active Directory

45. Joe. a security analyst, recently performed a network discovery to fully understand his organization's electronic footprint from a "public" perspective.

Joe ran a set of commands and received the following output:

Which of the following can be determined about the organization's public presence and security posture? (Select TWO).

Joe used Who is to produce this output.

Joe used cURL to produce this output.

Joe used Wireshark to produce this output

The organization has adequate information available in public registration.

The organization has too much information available in public registration.

The organization has too little information available in public registration

46. Which of the following corporate policies is used to help prevent employee fraud and to detect system log modifications or other malicious activity based on tenure?

Background checks

Mandatory vacation

Social media analysis

Separation of duties

47. A security analyst is Investigating a malware incident at a company. The malware Is accessing a command-and-control website at www.comptia.com. All outbound Internet traffic is logged to a syslog server and stored in /logfiles/messages.

Which of the following commands would be BEST for the analyst to use on the syslog server to search for recent traffic to the command-and-control website?

Option A

Option B

Option C

Option D

48. An attacker was eavesdropping on a user who was shopping online. The attacker was able to spoof the IP address associated with the shopping site. Later, the user received an email regarding the credit card statement with unusual purchases .

Which of the following attacks took place?

On-path attack

Protocol poisoning

Domain hijacking

Bluejacking

49. An organization plans to transition the intrusion detection and prevention techniques on a critical subnet to an anomaly-based system .

Which of the following does the organization need to determine for this to be successful?

The baseline

The endpoint configurations

The adversary behavior profiles

The IPS signatures

50. The spread of misinformation surrounding the outbreak of a novel virus on election day ted to eligible voters choosing not to take the risk of going to the polls.

This is an example of:

prepending.

an influence campaign

a watering-hole attack

intimidation

information elicitation

Page 6 of 7

51. A security analyst is reviewing the following command-line output:

Which of the following Is the analyst observing?

IGMP spoofing

URL redirection

MAC address cloning

DNS poisoning

52. Which of the following is a detective and deterrent control against physical intrusions?

A lock

An alarm

A fence

A sign

53. A bad actor tries to persuade someone to provide financial information over the phone in order to gain access to funds .

Which of the following types of attacks does this scenario describe?

Vishing

Phishing

Spear phishing

Whaling

54. Which of the following environments utilizes dummy data and is MOST likely to be installed locally on a system that allows code to be assessed directly and modified easily with each build?

Production

Test

Staging

Development

55. A developer is building a new portal to deliver single-pane-of-glass management capabilities to customers with multiple firewalls. To Improve the user experience, the developer wants to implement an authentication and authorization standard that uses security tokens that contain assertions to pass user Information between nodes .

Which of the following roles should the developer configure to meet these requirements? (Select TWO).

Identity processor

Service requestor

Identity provider

Service provider

Tokenized resource

Notarized referral

56. Which of the following environments typically hosts the current version configurations and code, compares user-story responses and workflow, and uses a modified version of actual data for testing?

Development

Staging

Production

Test

57. Which of the following BEST helps to demonstrate integrity during a forensic investigation?

Event logs

Encryption

Hashing

Snapshots

58. A security researcher is attempting to gather data on the widespread use of a Zero-day exploit .

Which of the following will the researcher MOST likely use to capture this data?

A DNS sinkhole

A honeypot

A vulnerability scan

CVSS

59. A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment. The security architect is looking for a solution with reduced latency to allow the incorporation of the organization's existing keys and to maintain consistent, centralized control and management regardless of the data location.

Which of the following would BEST meet the architect's objectives?

Trusted Platform Module

laaS

HSMaaS

PaaS

Key Management Service

60. An attacker was easily able to log in to a company's security camera by performing a basic online search for a setup guide for that particular camera brand and model.

Which of the following BEST describes the configurations the attacker exploited?

Weak encryption

Unsecure protocols

Default settings

Open permissions

Page 7 of 7

61. Which of the following describes a maintenance metric that measures the average time required to troubleshoot and restore failed equipment?

RTO

MTBF

MTTR

RPO

62. The following are the logs of a successful attack.

Which of the following controls would be BEST to use to prevent such a breach in the future?

Password history

Account expiration

Password complexity

Account lockout

63. To mitigate the impact of a single VM being compromised by another VM on the same hypervisor, an administrator would like to utilize a technical control to further segregate the traffic .

Which of the following solutions would BEST accomplish this objective?

Install a hypervisor firewall to filter east-west traffic.

Add more VLANs to the hypervisor network switches.

Move exposed or vulnerable VMs to the DM

Implement a zero-trust policy and physically segregate the hypervisor servers.

64. Which of the following control types would be BEST to use to identify violations and incidents?

Detective

Compensating

Deterrent

Corrective

Recovery

Preventive

SY0-601 CompTIA Security+ Exam Updated Questions

SY0-601 CompTIA Security+ Exam Updated Questions

Share this post

Leave a Reply Cancel reply

Related Posts