Authentic SY0-501 Dumps With 100% Passing Rate Practice Tests Dumps
CompTIA SY0-501 Real Exam Questions Guaranteed Updated Dump from DumpsTests
Exam SY0-501 earns you the CompTIA Security+ certificate, which is among the core certifications that validate foundational IT skills and technical knowledge. This certificate is the globally accepted benchmark for IT best practices, specifically on operational security and computer network.
NEW QUESTION 220
Which of the following characteristics differentiate a rainbow table attack from a brute force attack? (Select two.)
- A. Rainbow tables must include precomputed hashes.
- B. Rainbow table attacks must be performed on the network.
- C. Rainbow table attacks greatly reduce compute cycles at attack time.
- D. Rainbow table attacks do not require access to hashed passwords.
- E. Rainbow table attacks bypass maximum failed login restrictions.
Answer: A,E
NEW QUESTION 221
A company wants to host a publicly available server that performs the following functions:
Evaluates MX record lookup
Can perform authenticated requests for A and AAA records Uses RRSIG
Which of the following should the company use to fulfill the above
requirements?
Which of the following should the company use to fulfill the above requirements?
- A. SFTP
- B. DNSSEC
- C. nslookup
- D. dig
Answer: B
Explanation:
Explanation/Reference:
Explanation:
DNS Security Extensions (DNSSEC) provides, among other things, cryptographic authenticity of responses using Resource Record Signatures (RRSIG) and authenticated denial of existence using Next- Secure (NSEC) and Hashed-NSEC records (NSEC3).
NEW QUESTION 222
A security analyst is investigating a suspected security breach and discovers the following in the logs of the potentially compromised server:
Which of the following would be the BEST method for preventing this type of suspected attack in the future?
- A. Implement time-of-day restrictions on this server
- B. Implement password expirations
- C. Implement restrictions on shared credentials
- D. Implement account lockout settings
Answer: D
NEW QUESTION 223
A security administrator is given the security and availability profiles for servers that are being deployed.
* Match each RAID type with the correct configuration and MINIMUM number of drives.
* Review the server profiles and match them with the appropriate RAID type based on integrity,
* availability, I/O, storage requirements. Instructions:
* All drive definitions can be dragged as many times as necessary
* Not all placeholders may be filled in the RAID configuration boxes
* If parity is required, please select the appropriate number of parity checkboxes
* Server profiles may be dragged only once
If at any time you would like to bring back the initial state of the simulation, please select the Reset button.
When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
Answer:
Explanation:
Explanation
RAID-0 is known as striping. It is not a fault tolerant solution but does improve disk performance for read/write operations. Striping requires a minimum of two disks and does not use parity.
RAID-0 can be used where performance is required over fault tolerance, such as a media streaming server.
RAID-1 is known as mirroring because the same data is written to two disks so that the two disks have identical data. This is a fault tolerant solution that halves the storage space. A minimum of two disks are used in mirroring and does not use parity. RAID-1 can be used where fault tolerance is required over performance, such as on an authentication server. RAID-5 is a fault tolerant solution that uses parity and striping. A minimum of three disks are required for RAID-5 with one disk's worth of space being used for parity information. However, the parity information is distributed across all the disks. RAID-5 can recover from a sing disk failure.
RAID-6 is a fault tolerant solution that uses dual parity and striping. A minimum of four disks are required for RAID-6. Dual parity allows RAID-6 to recover from the simultaneous failure of up to two disks. Critical data should be stored on a RAID-6 system.
http://www.adaptec.com/en-us/solutions/raid_levels.html
NEW QUESTION 224
Task: Determine the types of attacks below by selecting an option from the dropdown list.
Answer:
Explanation:
Explanation:
A: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.
Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website, however, is bogus and set up only to steal the information the user enters on the page.
B: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top-level executives in business and government to stay vigilant about the possibility of cyber threats.
C: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he or she will profit.
D: SPIM is a term sometimes used to refer to spam over IM (Instant Messaging). It's also called just spam, instant spam, or IM marketing. No matter what the name, it consists of unwanted messages transmitted through some form of instant messaging service, which can include Short Message Service (SMS)
E: Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It is one of the greatest threats that organizations today encounter. A social engineer runs what used to be called a "con game." For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that compromises the network's security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires immediate network access. Appealing to vanity, appealing to authority, appealing to greed, and old-fashioned eavesdropping are other typical social engineering techniques.
http://www.webopedia.com/TERM/P/phishing.html
http://www.techopedia.com/definition/28643/whaling
http://www.webopedia.com/TERM/V/vishing.html
http://searchsecurity.techtarget.com/definition/social-engineering
NEW QUESTION 225
A systems administrator is configuring a system that uses data classification labels. Which of the following will the administrator need to implement to enforce access control?
- A. Role-based access control
- B. Rule-based access control
- C. Mandatory access control
- D. Discretionary access control
Answer: C
NEW QUESTION 226
A technician is investigating a report of unusual behavior and slow performance on a company-owned laptop.
The technician runs a command and reviews the following information:
Based on the above information, which of the following types of malware should the technician report?
- A. Spyware
- B. Rootkit
- C. Logic bomb
- D. RAT
Answer: D
NEW QUESTION 227
A security administrator has been tasked with implementing controls that meet management goals. Drag and drop the appropriate control used to accomplish the account management goal. Options may be used once or not at all.
Answer:
Explanation:
NEW QUESTION 228
Malicious traffic from an internal network has been detected on an unauthorized port on an application server. Which of the following network-based security controls should the engineer consider implementing?
- A. MAC filtering
- B. HIPS
- C. NAT
- D. ACLs
Answer: A
NEW QUESTION 229
A researcher has been analyzing large data sets for the last ten months. The researcher works with colleagues from other institutions and typically connects via SSH to retrieve additional data. Historically, this setup has worked without issue, but the researcher recently started getting the following message:
Which of the following network attacks Is the researcher MOST likely experiencing?
- A. MAC cloning
- B. ARP poisoning
- C. Evil twin
- D. Man-in-the-middle
Answer: D
Explanation:
Explanation
This is alarming because it could actually mean that you're connecting to a different server without knowing it.
If this new server is malicious then it would be able to view all data sent to and from your connection, which could be used by whoever set up the server. This is called a man-in-the-middle attack. This scenario is exactly what the "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" message is trying to warn you about.
NEW QUESTION 230
A company has had a BYOD policy in place for many years and now wants to roll out an MDM solution. The company has decided that end users who wish to utilize their personal devices for corporate use must opt in to the MDM solution. End users are voicing concerns about the company having access to their personal devices via the MDM solution. Which of the following should the company implement to ease these concerns?
- A. Full device encryption
- B. Containerization
- C. Application management
- D. Sideloading
Answer: C
NEW QUESTION 231
A company recently contracted a penetration testing firm to conduct an assessment. During the assessment, the penetration testers were able to capture unencrypted communication between directory servers. The penetration testers recommended encrypting this communication to fix the vulnerability. Which of the following protocols should the company implement to close this finding?
- A. SFTP
- B. DNSSEC
- C. Kerberos
- D. LDAPS
attacker captured LDAP communications. And secure version of LDAP is LDAPS(LDAP+TLS)
Answer: D
NEW QUESTION 232
A supervisor in your organization was demoted on Friday afternoon. The supervisor had the ability to modify the contents of a confidential database, as well as other managerial permissions.
On Monday morning, the database administrator reported that log files indicated that several records were missing from the database.
Which of the following risk mitigation strategies should have been implemented when the supervisor was demoted?
- A. Incident management
- B. Routine auditing
- C. Monthly user rights reviews
- D. IT governance
Answer: B
Explanation:
The right answer is Routine auditing because Routine auditing includes user rights review and/or disabling unused accounts.
https://www.youtube.com/watch?v=HvMJRFYn7Ik - Professor Messer about User Access Reviews and Monitoring.
NEW QUESTION 233
Drag and drop the correct protocol to its default port.
Answer:
Explanation:
Explanation
FTP uses TCP port 21. Telnet uses port 23.
SSH uses TCP port 22.
All protocols encrypted by SSH, including SFTP, SHTTP, SCP, SExec, and slogin, also use TCP port 22.
Secure Copy Protocol (SCP) is a secure file-transfer facility based on SSH and Remote Copy Protocol (RCP).
Secure FTP (SFTP) is a secured alternative to standard File Transfer Protocol (FTP). SMTP uses TCP port 25.
Port 69 is used by TFTP.
SNMP
makes use of UDP ports 161 and 162. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
NEW QUESTION 234
Which of the following types of malware, attempts to circumvent malware detection by trying to hide its true location on the infected system?
- A. Keylogger
- B. Trojan
- C. Armored virus
- D. Ransomware
Answer: B
NEW QUESTION 235
A security administrator has found a hash in the environment known to belong to malware. The administrator then finds this file to be in in the preupdate area of the OS, which indicates it was pushed from the central patch system.
File: winx86_adobe_flash_upgrade.exe
Hash: 99ac28bede43ab869b853ba62c4ea243
The administrator pulls a report from the patch management system with the following output:
Given the above outputs, which of the following MOST likely happened?
- A. The file was infected when the patch manager downloaded it.
- B. The file was not approved in the application whitelist system.
- C. The file was embedded with a logic bomb to evade detection.
- D. The file was corrupted after it left the patch system.
Answer: C
NEW QUESTION 236
As part of a new industry regulation, companies are required to utilize secure, standardized OS settings. A technical must ensure the OS settings are hardened. Which of the following is the BEST way to do this?
- A. Use a protocol analyzer.
- B. Use a passive, in-line scanner.
- C. Use a configuration compliance scanner.
- D. Use a vulnerability scanner.
Answer: D
NEW QUESTION 237
An employee on the Internet facing part of a company's website submits a 20-character phrase in a small textbox on a web form. The website returns a message back to the browser stating.
Of which of the following is this an example?
- A. Buffer overflow
- B. Improperly configured account
- C. Improper error handling
- D. Resources exhaustion
Answer: C
NEW QUESTION 238
Recently the desktop support group has been performing a hardware refresh and has replaced numerous computers. An auditor discovered that a number of the new computers did not have the company's antivirus software installed on them, Which of the following could be utilized to notify the network support group when computers without the antivirus software are added to the network?
- A. Network port protection
- B. NIDS
- C. NAC
- D. Mac Filtering
Answer: B
NEW QUESTION 239
Task: Determine the types of attacks below by selecting an option from the dropdown list.
Answer:
Explanation:
A: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.
Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website, however, is bogus and set up only to steal the information the user enters on the page.
B: Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive dat a. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top-level executives in business and government to stay vigilant about the possibility of cyber threats.
C: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he or she will profit.
D: SPIM is a term sometimes used to refer to spam over IM (Instant Messaging). It's also called just spam, instant spam, or IM marketing. No matter what the name, it consists of unwanted messages transmitted through some form of instant messaging service, which can include Short Message Service (SMS) E: Social engineering is a non-technical method of intrusion hackers use that relies heavily on human interaction and often involves tricking people into breaking normal security procedures. It is one of the greatest threats that organizations today encounter. A social engineer runs what used to be called a "con game." For example, a person using social engineering to break into a computer network might try to gain the confidence of an authorized user and get them to reveal information that compromises the network's security. Social engineers often rely on the natural helpfulness of people as well as on their weaknesses. They might, for example, call the authorized employee with some kind of urgent problem that requires immediate network access. Appealing to vanity, appealing to authority, appealing to greed, and old-fashioned eavesdropping are other typical social engineering techniques.
http://www.webopedia.com/TERM/P/phishing.html
http://www.techopedia.com/definition/28643/whaling
http://www.webopedia.com/TERM/V/vishing.html
http://searchsecurity.techtarget.com/definition/social-engineering
NEW QUESTION 240
A large financial services firm recently released information regarding a security breach within its corporate network that began several years before. During the time frame in which the breach occurred, indicators show an attacker gained administrative access to the network through a file download from a social media site and subsequently installed it without the user's knowledge. Since the compromise, the attacker was able to take command and control of the computer systems anonymously while obtaining sensitive corporate and personal employee information. Which of the following methods did the attacker MOST likely use to gain access?
- A. A logic bomb
- B. A RAT
- C. A fileless virus
- D. A bot
Answer: D
NEW QUESTION 241
A company has a data system with definitions for "Private" and "Public". The company's security policy outlines how data should be protected based on type. The company recently added the data type
"Proprietary". Which of the following is the MOST likely reason the company added this data type?
- A. More searchable data
- B. Reduced cost
- C. Better data classification
- D. Expanded authority of the privacy officer
Answer: D
NEW QUESTION 242
An attacker is attempting to harvest user credentials on a client's website. A security analyst notices multiple attempts of random usernames and passwords. When the analyst types in a random username and password, the logon screen displays the following message:
The username you entered does not exist.
Which of the following should the analyst recommend be enabled?
- A. Input validation
- B. Obfuscation
- C. Username lockout
- D. Error handling
Answer: C
NEW QUESTION 243
A network administrator wants to implement a method of securing internal routing. Which of the following should the administrator implement?
- A. VPN
- B. DMZ
- C. PAT
- D. NAT
Answer: A
NEW QUESTION 244
A security analyst is inspecting the results of a recent internal vulnerability scan that was performed against intranet services. The scan reports include the following critical-rated vulnerability:
Title: Remote Command Execution vulnerability in web server
Rating: Critical (CVSS 10.0)
Threat actor: any remote user of the web server
Confidence: certain
Recommendation: apply vendor patches
Which of the following actions should the security analyst perform FIRST?
- A. Escalate the issue to senior management.
- B. Apply organizational context to the risk rating.
- C. Exploit the server to check whether it is a false positive.
- D. Organize for urgent out-of-cycle patching.
Answer: B
NEW QUESTION 245
......
Verified Pass SY0-501 Exam in First Attempt Guaranteed: https://www.dumpstests.com/SY0-501-latest-test-dumps.html