4134f Flashcards
Phishing and spear-phishing attacks have been occurring more frequently against a company’s staff. Which of the following would MOST likely help mitigate this issue?
A. DNSSEC and DMARC
B. DNS query logging
C. Exact mail exchanger records in the DNS
D. The addition of DNS conditional forwarders
C
https://www.examtopics.com/discussions/comptia/view/44141-exam-sy0-601-topic-1-question-10-discussion/
A Mail Exchanger record (MX record) is a type of resource record in the Domain Name System that specifies a mail server responsible for accepting email messages on behalf of a recipient’s domain, and provides a preference value which is used to prioritise mail delivery if multiple mail servers are available.
MX records can provide early warning signs that your company may be under attack from spear phishing. You can take immediate steps to block any emails coming in from any possibly malicious domains.
https: //fraudwatchinternational.com/phishing/email-security-mx-records/
https: //www.infosecurity-magazine.com/opinions/mx-records-matter-fight-bec-spear/
An organization needs to implement more stringent controls over administrator/root credentials and service accounts. Requirements for the project include:
✑ Check-in/checkout of credentials
✑ The ability to use but not know the password
✑ Automated password changes
✑ Logging of access to credentials
Which of the following solutions would meet the requirements?
A. OAuth 2.0
B. Secure Enclave
C. A privileged access management system
D. An OpenID Connect authentication system
C or D
https://www.examtopics.com/discussions/comptia/view/41862-exam-sy0-601-topic-1-question-21-discussion/
A development team employs a practice of bringing all the code changes from multiple team members into the same development project through automation. A tool is utilized to validate the code and track source code through version control. Which of the following BEST describes this process? A. Continuous delivery B. Continuous integration C. Continuous validation D. Continuous monitoring
B
continuous validation that performs software testing as soon as developers update code,
continuous integration that maintains linkages between different code elements,
continuous delivery that automatically moves code into the proper environments,
continuous deployment that automatically releases code for production use,
continuous monitoring tools that ensure that code is working properly, and trigger automated remediation if issues arise.
An organization's help desk is flooded with phone calls from users stating they can no longer access certain websites. The help desk escalates the issue to the security team, as these websites were accessible the previous day. The security analysts run the following command: ipconfig /flushdns, but the issue persists. Finally, an analyst changes the DNS server for an impacted machine, and the issue goes away. Which of the following attacks MOST likely occurred on the original DNS server? A. DNS cache poisoning B. Domain hijacking C. Distributed denial-of-service D. DNS tunneling
B or A(應該是A
https://www.examtopics.com/discussions/comptia/view/41318-exam-sy0-601-topic-1-question-35-discussion/
應該是A
https://blog.miniasp.com/post/2008/10/22/Be-careful-DNS-cache-poisoning-attack
A security analyst is reviewing a new website that will soon be made publicly available. The analyst sees the following in the URL: http://dev-site.comptia.org/home/show.php?sessionID=77276554&loc=us
The analyst then sends an internal user a link to the new website for testing purposes, and when the user clicks the link, the analyst is able to browse the website with the following URL: http://dev-site.comptia.org/home/show.php?sessionID=98988475&loc=us
Which of the following application attacks is being tested?
A. Pass-the-hash
B. Session replay
C. Object deference
D. Cross-site request forgery
B
https: //www.examtopics.com/discussions/comptia/view/42264-exam-sy0-601-topic-1-question-38-discussion/
https: //campus.barracuda.com/product/webapplicationfirewall/doc/49058327/session-replay-attack/
A cybersecurity analyst needs to implement secure authentication to third-party websites without users' passwords. Which of the following would be the BEST way to achieve this objective? A. OAuth B. SSO C. SAML D. PAP
A or C
https: //www.examtopics.com/discussions/comptia/view/40736-exam-sy0-501-topic-2-question-432-discussion/
https: //www.examtopics.com/discussions/comptia/view/42808-exam-sy0-601-topic-1-question-51-discussion/
An analyst needs to identify the applications a user was running and the files that were open before the user's computer was shut off by holding down the power button. Which of the following would MOST likely contain that information? A. NGFW B. Pagefile C. NetFlow D. RAM
B
https://www.examtopics.com/ajax/discussion/exam-question/644050/
Which of the following would MOST likely support the integrity of a voting machine? A. Asymmetric encryption B. Blockchain C. Transport Layer Security D. Perfect forward secrecy
B or D
in book i think B
A Chief Information Security Officer (CISO) needs to create a policy set that meets international standards for data privacy and sharing. Which of the following should the CISO read and understand before writing the policies? A. PCI DSS B. GDPR C. NIST D. ISO 31000
B
https://www.examtopics.com/ajax/discussion/exam-question/644059/
A user contacts the help desk to report the following:
✑ Two days ago, a pop-up browser window prompted the user for a name and password after connecting to the corporate wireless SSID. This had never happened before, but the user entered the information as requested.
✑ The user was able to access the Internet but had trouble accessing the department share until the next day.
✑ The user is now getting notifications from the bank about unauthorized transactions.
Which of the following attack vectors was MOST likely used in this scenario?
A. Rogue access point
B. Evil twin
C. DNS poisoning
D. ARP poisoning
A or B
https://www.examtopics.com/discussions/comptia/view/41123-exam-sy0-601-topic-1-question-74-discussion/
Which of the following policies would help an organization identify and mitigate potential single points of failure in the company's IT/security operations? A. Least privilege B. Awareness training C. Separation of duties D. Mandatory vacation
C
https://www.examtopics.com/discussions/comptia/view/36948-exam-sy0-501-topic-2-question-386-discussion/
A website developer is working on a new e-commerce website and has asked an information security expert for the most appropriate way to store credit card numbers to create an easy reordering process. Which of the following methods would BEST accomplish this goal?
A. Salting the magnetic strip information
B. Encrypting the credit card information in transit
C. Hashing the credit card numbers upon entry
D. Tokenizing the credit cards in the database
C or D
查了一下hash是可以的
https://www.examtopics.com/discussions/comptia/view/44632-exam-sy0-601-topic-1-question-85-discussion/
A company recently experienced a data breach and the source was determined to be an executive who was charging a phone in a public area. Which of the following would MOST likely have prevented this breach? A. A firewall B. A device pin C. A USB data blocker D. Biometrics
C or D
https://www.examtopics.com/discussions/comptia/view/44076-exam-sy0-601-topic-1-question-86-discussion/
The Chief Security Officer (CSO) at a major hospital wants to implement SSO to help improve security in the environment and protect patient data, particularly at shared terminals. The Chief Risk Officer (CRO) is concerned that training and guidance have not been provided to frontline staff, and a risk analysis has not been performed. Which of the following is the MOST likely cause of the CRO’s concerns?
A. SSO would simplify username and password management, making it easier for hackers to guess accounts.
B. SSO would reduce password fatigue, but staff would still need to remember more complex passwords.
C. SSO would reduce the password complexity for frontline staff.
D. SSO would reduce the resilience and availability of systems if the identity provider goes offline.
A or D
https: //www.examtopics.com/ajax/discussion/exam-question/644089/
https: //www.examtopics.com/discussions/comptia/view/38876-exam-sy0-501-topic-2-question-412-discussion/
After entering a username and password, an administrator must draw a gesture on a touch screen. Which of the following demonstrates what the administrator is providing? A. Multifactor authentication B. Something you can do C. Biometrics D. Two-factor authentication
B or D
https://www.examtopics.com/ajax/discussion/exam-question/644096/
A company has limited storage space available and an online presence that cannot be down for more than four hours. Which of the following backup methodologies should the company implement to allow for the FASTEST database restore time in the event of a failure, while being mindful of the limited available storage space?
A. Implement full tape backups every Sunday at 8:00 p.m. and perform nightly tape rotations.
B. Implement differential backups every Sunday at 8:00 p.m. and nightly incremental backups at 8:00 p.m.
C. Implement nightly full backups every Sunday at 8:00 p.m.
D. Implement full backups every Sunday at 8:00 p.m. and nightly differential backups at 8:00 p.m.
B or D?
https://www.examtopics.com/discussions/comptia/view/44133-exam-sy0-601-topic-1-question-105-discussion/
A malicious actor recently penetrated a company's network and moved laterally to the datacenter. Upon investigation, a forensics firm wants to know what was in the memory on the compromised server. Which of the following files should be given to the forensics firm? A. Security B. Application C. Dump D. Syslog
C
https: //www.examtopics.com/ajax/discussion/exam-question/644105/
https: //www.examtopics.com/discussions/comptia/view/29451-exam-sy0-501-topic-2-question-321-discussion/
A public relations team will be taking a group of guests on a tour through the facility of a large e-commerce company. The day before the tour, the company sends out an email to employees to ensure all whiteboards are cleaned and all desks are cleared. The company is MOST likely trying to protect against: A. loss of proprietary information. B. damage to the company's reputation. C. social engineering. D. credential exposure.
A
https://www.examtopics.com/ajax/discussion/exam-question/644107/
The manager who is responsible for a data set has asked a security engineer to apply encryption to the data on a hard disk. The security engineer is an example of a: A. data controller. B. data owner. C. data custodian. D. data processor.
C or D
https://www.examtopics.com/ajax/discussion/exam-question/644108/
A security administrator needs to create a RAID configuration that is focused on high read speeds and fault tolerance. It is unlikely that multiple drives will fail simultaneously. Which of the following RAID configurations should the administrator use? A. RAID 0 B. RAID 1 C. RAID 5 D. RAID 10
C or D(應該是C
diss
https://www.examtopics.com/ajax/discussion/exam-question/644110/
googlebook
https://books.google.com.tw/books?id=0uUSEAAAQBAJ&pg=PT360&lpg=PT360&dq=high+read+speeds+and+fault+tolerance+RAID+sy0-601&source=bl&ots=_wAHUy9y7G&sig=ACfU3U2v-08ysHHvCc-JCetUrWGowANGLg&hl=zh-TW&sa=X&ved=2ahUKEwjt98Lgwu3uAhWsGqYKHUsfDzsQ6AEwEXoECBsQAg#v=onepage&q=high%20read%20speeds%20and%20fault%20tolerance%20RAID%20sy0-601&f=false
raid explain
https://www.prepressure.com/library/technology/raid
A company's Chief Information Officer (CIO) is meeting with the Chief Information Security Officer (CISO) to plan some activities to enhance the skill levels of the company's developers. Which of the following would be MOST suitable for training the developers? A. A capture-the-flag competition B. A phishing simulation C. Physical security training D. Basic awareness training
D
https://www.examtopics.com/discussions/comptia/view/44134-exam-sy0-601-topic-1-question-112-discussion/
需要向各個級別的員工（包括最終用戶，技術人員和主管）進行適當的安全意識培訓。需要涵蓋的一些常規主題包括：
•組織的安全策略概述和違規處罰。
•事件識別和報告程序。
•現場安全程序，限制和建議，包括安全演習，陪同客人，使用安全區域和使用個人設備。
•數據處理，包括文檔機密性，PII，備份，加密等。
•密碼和帳戶管理以及PC和移動設備的安全功能。
•對社會工程和惡意軟件威脅的意識，包括網絡釣魚，網站利用，垃圾郵件以及新威脅的警報方法。
•安全使用瀏覽器和電子郵件客戶端之類的軟件，並適當使用包括社交網站在內的Internet訪問權限。
還應該有一個系統來識別執行對安全敏感的角色的員工，並對所需的培訓和教育水平進行分級（例如，介於初學者，中級和高級之間）。請注意，在定義此類培訓計劃時，您需要關注工作角色而不是職務，因為員工可能扮演不同的角色，並且每個角色都有不同的安全培訓，教育或意識要求。
Under GDPR, which of the following is MOST responsible for the protection of privacy and website user rights? A. The data protection officer B. The data processor C. The data owner D. The data controller
C
https://www.examtopics.com/ajax/discussion/exam-question/644113/
After a ransomware attack, a forensics company needs to review a cryptocurrency transaction between the victim and the attacker. Which of the following will the company MOST likely review to trace this transaction? A. The public ledger B. The NetFlow data C. A checksum D. The event log
A
A document that appears to be malicious has been discovered in an email that was sent to a company’s Chief Financial Officer (CFO). Which of the following would be BEST to allow a security analyst to gather information and confirm it is a malicious document without executing any code it may contain?
A. Open the document on an air-gapped network.
B. View the document’s metadata for origin clues.
C. Search for matching file hashes on malware websites.
D. Detonate the document in an analysis sandbox.
C
https://www.examtopics.com/discussions/comptia/view/44287-exam-sy0-601-topic-1-question-121-discussion/
