[Oct-2021] Updated Security+ SY0-501 Exam Questions BUNDLE PACK
Master The CompTIA Content SY0-501 EXAM DUMPS WITH GUARANTEED SUCCESS!
NEW QUESTION 260
Which of the following attackers generally possesses minimal technical knowledge to perform advanced attacks and uses widely available tools as well as publicly available information?
- A. Hacktivist
- B. Penetration tester
- C. Script kiddle
- D. White hat hacker
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION 261
A security administrator needs to implement a system that detects possible intrusions based upon a vendor provided list. Which of the following BEST describes this type of IDS?
- A. Heuristic
- B. Behavior-based
- C. Signature based
- D. Anomaly-based
Answer: C
NEW QUESTION 262
A network administrator wants to implement a method of securing internal routing. Which of the following should the administrator implement?
- A. VPN
- B. NAT
- C. PAT
- D. DMZ
Answer: D
NEW QUESTION 263
When considering a third-party cloud service provider, which of the following criteria would be the BEST to include in the security assessment process? (Select two.)
- A. Use of performance analytics
- B. Breadth of applications support
- C. Data retention policies
- D. Size of the corporation
- E. Adherence to regulatory compliance
Answer: C,E
NEW QUESTION 264
A technician suspects that a system has been compromised. The technician reviews the following log entry:
WARNING - hash mismatch: C:\Window\SysWOW64\user32.dll
WARNING - hash mismatch: C:\Window\SysWOW64\kernel32.dll
Based solely on the above information, which of the following types of malware is MOST likely installed on the system?
- A. Trojan
- B. Rootkit
- C. Backdoor
- D. Ransomware
Answer: B
NEW QUESTION 265
The chief security officer (CS0) has issued a new policy that requires that all internal websites be configured for HTTPS traffic only. The network administrator has been tasked to update all internal sites without incurring additional costs.
Which of the following is the best solution for the network administrator to secure each internal website?
- A. Use certificates signed by the company CA
- B. Use a signing certificate as a wild card certificate
- C. Use a self-signed certificate on each internal server
- D. Use certificates signed by a public ca
Answer: C
Explanation:
Explanation
This is a way to update all internal sites without incurring additional costs?
To be a CA (Certificate Authority), you need an infrastructure that consists of considerable operational elements, hardware, software, policy frameworks and practice statements, auditing, security infrastructure and personnel.
NEW QUESTION 266
Company policy requires the use if passphrases instead if passwords.
Which of the following technical controls MUST be in place in order to promote the use of passphrases?
- A. History
- B. Length
- C. Complexity
- D. Reuse
Answer: B
NEW QUESTION 267
A systems administrator wants to implement a wireless protocol that will allow the organization to authenticate mobile devices prior to providing the user with a captive portal login. Which of the following should the systems administrator configure?
- A. EAP-TTLS
- B. L2TP with MAC filtering
- C. WPA2-CCMP with PSK
- D. RADIUS federation
:
RADIUS generally includes 802.1X that pre-authenticates devices.
Answer: D
NEW QUESTION 268
A systems administrator is attempting to recover from a catastrophic failure in the datacenter. To recover the domain controller, the systems administrator needs to provide the domain administrator credentials.
Which of the following account types is the systems administrator using?
- A. Service account
- B. Local account
- C. User account
- D. Guest account
Answer: A
NEW QUESTION 269
An analyst generates the following color-coded table shown in the exhibit to help explain the risk of potential incidents in the company. The vertical axis indicates the likelihood or an incident, while the horizontal axis indicates the impact.
Which of the following is this table an example of?
- A. Supply chain assessment
- B. Privacy impact assessment
- C. Internal threat assessment
- D. Qualitative risk assessment
Answer: D
NEW QUESTION 270
A tester was able to leverage a pass-the-hash attack during a recent penetration test. The tester gained a foothold and moved laterally through the network. Which of the following would prevent this type of attack from reoccurring?
- A. Renaming all active service accounts and disabling all inactive service accounts
- B. Increasing the password complexity requirements and setting account expiration dates
- C. Creating separate accounts for privileged access that are not used to log on to local machines
- D. Enabling full-disk encryption on all workstations that are used by administrators and disabling RDP
Answer: C
NEW QUESTION 271
A security analyst is inspecting the results of a recent internal vulnerability scan that was performed
against intranet services.
The scan reports include the following critical-rated vulnerability: Title: Remote Command Execution
vulnerability in web server Rating: Critical (CVSS 10.0)
Threat actor: any remote user of the web server
Confidence: certain
Recommendation: apply vendor patches
Which of the following actions should the security analyst perform FIRST?
- A. Exploit the server to check whether it is a false positive.
- B. Escalate the issue to senior management.
- C. Apply organizational context to the risk rating.
- D. Organize for urgent out-of-cycle patching.
Answer: C
NEW QUESTION 272
The chief security officer (CS0) has issued a new policy that requires that all internal websites be configured for HTTPS traffic only. The network administrator has been tasked to update all internal sites without incurring additional costs. Which of the following is the best solution for the network administrator to secure each internal website?
- A. Use certificates signed by the company CA
- B. Use a signing certificate as a wild card certificate
- C. Use a self-signed certificate on each internal server
- D. Use certificates signed by a public ca
Answer: C
Explanation:
This is a way to update all internal sites without incurring additional costs?
To be a CA (Certificate Authority), you need an infrastructure that consists of considerable operational elements, hardware, software, policy frameworks and practice statements, auditing, security infrastructure and personnel.
NEW QUESTION 273
You have been tasked with designing a security plan for your company. Drag and drop the appropriate security controls on the floor plan.
Instructions: All objects must be used and all place holders must be filled. Order does not matter. When you have completed the simulation, please select the Done button to submit.
Answer:
Explanation:
Cable locks - Adding a cable lock between a laptop and a desk prevents someone from picking it up and walking away Proximity badge + reader Safe is a hardware/physical security measure Mantrap can be used to control access to sensitive areas. CCTV can be used as video surveillance.
Biometric reader can be used to control and prevent unauthorized access. Locking cabinets can be used to protect backup media, documentation and other physical artifacts.
NEW QUESTION 274
Task: Determine the types of attacks below by selecting an option from the dropdown list.
Answer:
Explanation:
Explanation:
A: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.
Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website, however, is bogus and set up only to steal the information the user enters on the page.
B: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top-level executives in business and government to stay vigilant about the possibility of cyber threats.
C: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he or she will profit.
D: SPIM is a term sometimes used to refer to spam over IM (Instant Messaging). It's also called just spam, instant spam, or IM marketing. No matter what the name, it consists of unwanted messages transmitted through some form of instant messaging service, which can include Short Message Service (SMS)
E: Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It is one of the greatest threats that organizations today encounter. A social engineer runs what used to be called a "con game." For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that compromises the network's security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires immediate network access. Appealing to vanity, appealing to authority, appealing to greed, and old-fashioned eavesdropping are other typical social engineering techniques.
http://www.webopedia.com/TERM/P/phishing.html
http://www.techopedia.com/definition/28643/whaling
http://www.webopedia.com/TERM/V/vishing.html
http://searchsecurity.techtarget.com/definition/social-engineering
NEW QUESTION 275
An attacker has obtained the user ID and password of a datacenter's backup operator and has gained access to a production system. Which of the following would be the attacker's NEXT action?
- A. Perform a passive reconnaissance of the network.
- B. Initiate a confidential data exfiltration process.
- C. Look for known vulnerabilities to escalate privileges.
- D. Create an alternate user ID to maintain persistent access.
Answer: D
NEW QUESTION 276
A forensic analyst is asked to respond to an ongoing network attack on a server. Place the items in the list below in the correct order in which the forensic analyst should preserve them.
Answer:
Explanation:
Explanation
When dealing with multiple issues, address them in order of volatility (OOV); always deal with the most volatile first. Volatility can be thought of as the amount of time that you have to collect certain data before a window of opportunity is gone. Naturally, in an investigation you want to collect everything, but some data will exist longer than others, and you cannot possibly collect all of it once. As an example, the OOV in an investigation may be RAM, hard drive data, CDs/DVDs, and printouts.
Order of volatility: Capture system images as a snapshot of what exists, look at network traffic and logs, capture any relevant video/screenshots/hashes, record time offset on the systems, talk to witnesses, and track total man-hours and expenses associated with the investigation.
NEW QUESTION 277
The Chief Financial Officer (CFO) of an insurance company received an email from Ann, the company's Chief Executive Officer (CEO), requesting a transfer of $10,000 to an account. The email states Ann is on vacation and has lost her purse, containing cash and credit cards. Which of the following social-engineering techniques is the attacker using?
- A. Typo squatting
- B. Pharming
- C. Phishing
- D. Whaling
Answer: D
Explanation:
Explanation
Whaling attack
A whaling attack is a method used by cybercriminals to masquerade as a senior player at an organization and directly target senior or other important individuals at an organization, with the aim of stealing money or sensitive information or gaining access to their computer systems for criminal purposes.
A whaling attack is essentially a spear-phishing attack but the targets are bigger - hence whale phishing.
Where spear-phishing attacks may target any individual, whaling attacks are more specific in what type of person they target: focusing on one specific high level executive or influencer vs a broader group of potential victims.
Cybercriminals use whaling attacks to impersonate senior management in an organization, such as the CEO, CFO, or other executives, hoping to leverage their authority to gain access to sensitive data or money. They use the intelligence they find on the internet (and often social media) to trick employees - or another whale - into replying with financial or personal data.
NEW QUESTION 278
A security administrator has found a hash in the environment known to belong to malware.
The administrator then finds this file to be in in the preupdate area of the OS, which indicates it was pushed from the central patch system.
File: winx86_adobe_flash_upgrade.exe
Hash: 99ac28bede43ab869b853ba62c4ea243
The administrator pulls a report from the patch management system with the following output:
Given the above outputs, which of the following MOST likely happened?
- A. The file was infected when the patch manager downloaded it.
- B. The file was corrupted after it left the patch system.
- C. The file was not approved in the application whitelist system.
- D. The file was embedded with a logic bomb to evade detection.
Answer: D
NEW QUESTION 279
An employee workstation with an IP address of 204 211.38.211/24 reports it is unable to submit print jobs to a network printer at 204.211.38.52/24 after a firewall upgrade. The active firewall rules are as follows:
Assuming port numbers have not been changed from their defaults, which of the following should be modified to allow printing to the network printer?
- A. The permit statement for 204.211.38.52/24 should be changed to UDP port 443 instead of 631
- B. The permit statement for 204.211.38.52/24 should be changed to TCP port 631 instead of UDP.
- C. The permit statement for 204.211.38 211/24 should be changed to TCP port 631 only instead of ALL
- D. The deny statement for 204 211.38.52/24 should be changed to a permit statement
Answer: B
NEW QUESTION 280
......
Pass CompTIA SY0-501 Exam – Experts Are Here To Help You: https://www.prepawaypdf.com/CompTIA/SY0-501-practice-exam-dumps.html
Get Latest Security+ SY0-501 Practice Test For Quick Preparation: https://drive.google.com/open?id=1D3kJUJWZNusA11opdeVQTBp5Uh46usl4