Use Real SYO-501 - 100% Cover Real Exam Questions [Oct-2021]
Dumps Brief Outline Of The SYO-501 Exam - Lead1Pass
What's CompTIA SY0-501 Exam Outline?
The CompTIA SY0-501 exam content covers the following topics:
- Access Management and Identity (16%);
- Tools as well as Technologies (22%);
- Cryptography together with PKI (12%);
- Risk Management (14%);
- Architecture & Design (15%);
- Vulnerabilities, Threats, and Attacks (21%).
The CompTIA SY0-501 test consists of up to 90 questions and the students will have exactly 90 minutes to clear all of them. However, doing so may be a challenge even for an expert as the questions will be in multiple-choice and performance-based formats. The minimum passing score is 750 points (100-900). This exam can be taken in Simplified Chinese, Portuguese, Japanese, or English and costs $349 for US residents. Also, note that there is a newer version of this test available for taking, which has the same exam format and features but covers the advanced and updated content. It is coded, SY0-601, and starting November 12, 2020, will be launched to qualify students for the already mentioned CompTIA Security+ certification. For more information about this new exam and the entire Security+ learning path, you can visit the CompTIA website.
What Should You Know about SY0-501 Test Objectives?
The test details for every objective are highlighted below:
Cryptography and PKI
This topic will confirm if you can compare and contrast the most basic concepts of cryptography. Besides, it also covers the algorithms of cryptography and their features, the installation and configuration of wireless security settings, and the implementation of public key infrastructure. In particular, you will learn to deal with Hashing, Salt, IV, symmetric algorithms, cipher modes, wireless security settings, and Objects Identifiers (OID).
NEW QUESTION 94
A security analyst is testing both Windows and Linux systems for unauthorized DNS zone transfers within a LAN on comptia.org from example.org. Which of the following commands should the security analyst use? (Select two.) A:
B:
C: dig -axfr [email protected]
D: ipconfig/flushDNS
E:
F: [email protected] comptia.org
- A. Option A
- B. Option E
- C. Option F
- D. Option B
- E. Option C
- F. Option D
Answer: A,E
NEW QUESTION 95
A security administrator wants to better prepare the incident response team for possible security events. The IRP has been updated and distributed to incident response team members. Which of the following is the BEST option to fulfill the administrator's objective?
- A. identify the members' roles and responsibilities.
- B. Determine the order of restoration.
- C. Select a backup/failover location.
- D. Conduct a tabletop test.
Answer: D
NEW QUESTION 96
A new intern in the purchasing department requires read access to shared documents.
Permissions are normally controlled through a group called "Purchasing", however, the purchasing group permissions allow write access.
Which of the following would be the BEST course of action?
- A. Modify all the shared files with read only permissions for the intern.
- B. Create a new group that has only read permissions for the files.
- C. Remove all permissions for the shared files.
- D. Add the intern to the "Purchasing" group.
Answer: B
NEW QUESTION 97
Which of the following is the MOST significant difference between intrusive and non-intrusive vulnerability scanning?
- A. One uses credentials, but the other does not.
- B. One allows systems to activate firewall countermeasures.
- C. One returns service banners, including running versions.
- D. One has a higher potential for disrupting system operations.
Answer: D
NEW QUESTION 98
Security administrators attempted corrective action after a phishing attack. Users are still experiencing trouble logging in, as well as an increase in account lockouts. Users' email contacts are complaining of an increase in spam and social networking requests. Due to the large number of affected accounts, remediation must be accomplished quickly.
Which of the following actions should be taken FIRST? (Select TWO)
- A. Update WAF rules to block social networks
- B. Disable the open relay on the email server
- C. Disable the compromised accounts
- D. Remove the compromised accounts with all AD groups
- E. Change the compromised accounts' passwords
- F. Enable sender policy framework
Answer: B,F
Explanation:
Sender Policy Framework (SPF) is a simple email-validation system designed to detect email spoofing by providing a mechanism to allow receiving mail exchangers to check that incoming mail from a domain comes from a host authorized by that domain's administrators.
n a Small Business Server environment, you may have to prevent your Microsoft Exchange Server-based server from being used as an open relay SMTP server for unsolicited commercial e-mail messages, or spam.
You may also have to clean up the Exchange server's SMTP queues to delete the unsolicited commercial e- mail messages.
If your Exchange server is being used as an open SMTP relay, you may experience one or more of the following symptoms:
The Exchange server cannot deliver outbound SMTP mail to a growing list of e-mail domains.
Internet browsing is slow from the server and from local area network (LAN) clients.
Free disk space on the Exchange server in the location of the Exchange information store databases or the Exchange information store transaction logs is reduced more rapidly than you expect.
The Microsoft Exchange information store databases spontaneously dismount. You may be able to manually mount the stores by using Exchange System Manager, but the stores may dismount on their own after they run for a short time. For more information, click the following article number to view the article in the Microsoft Knowledge Base.
NEW QUESTION 99
A systems administrator is deploying a new mission essential server into a virtual environment. Which of the following is BEST mitigated by the environment's rapid elasticity characteristic?
- A. Denial of service
- B. Data confidentiality breaches
- C. VM escape attacks
- D. Lack of redundancy
Answer: A
NEW QUESTION 100
Which of the following specifically describes the exploitation of an interactive process to access otherwise restricted areas of the OS?
- A. Buffer overflow
- B. Privilege escalation
- C. Pivoting
- D. Process affinity
Answer: B
NEW QUESTION 101
A new Chief Information Officer (CIO) has been reviewing the badging and decides to write a policy that all employees must have their badges rekeyed at least annually. Which of the following controls BEST describes this policy?
- A. Administrative
- B. Corrective
- C. Physical
- D. Technical
Answer: A
NEW QUESTION 102
SIMULATION
A security administrator discovers that an attack has been completed against a node on the corporate network. All available logs were collected and stored.
You must review all network logs to discover the scope of the attack, check the box of the node(s) that have been compromised and drag and drop the appropriate actions to complete the incident response on the network. The environment is a critical production environment; perform the LEAST disruptive actions on the network, while still performing the appropriate incid3nt responses.
Instructions: The web server, database server, IDS, and User PC are clickable. Check the box of the node(s) that have been compromised and drag and drop the appropriate actions to complete the incident response on the network. Not all actions may be used, and order is not important. If at any time you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
- A. Database server was attacked, actions should be to capture network traffic and Chain of Custody.
IDS Server Log:
Web Server Log:
Database Server Log:
Users PC Log:
- B. Database server was attacked, actions should be to capture network traffic and Chain of Custody.
IDS Server Log:
Web Server Log:
Database Server Log:
Users PC Log:
Answer: B
NEW QUESTION 103
Which of the following types of vulnerability scans typically returns more detailed and thorough insights into actual system vulnerabilities?
- A. Intrusive
- B. Non-credentialed
- C. Credentialed
- D. Non-intrusive
Answer: C
NEW QUESTION 104
An organization plans to transition the intrusion detection and prevention techniques on a critical subnet to an anomaly-based system. Which of the following does the organization need to determine for this to be successful?
- A. The adversary behavior profiles
- B. The endpoint configurations
- C. The IPS signatures
- D. The baseline
Answer: C
NEW QUESTION 105
Which of the following attack types BEST describes a client-side attack that is used to mandate an HTML iframe with JavaScript code via web browser?
- A. SQLi
- B. MITM
- C. xss
Answer: A
NEW QUESTION 106
A security administrator determined that users within the company are installing unapproved software.
Company policy dictates that only certain applications may be installed or ran on the user's computers without exception.
Which of the following should the administrator do to prevent all unapproved software from running on the user's computer?
- A. Create an application whitelist and use OS controls to enforce it
- B. Configure the firewall to prevent the downloading of executable files
- C. Deploy antivirus software and configure it to detect and remove pirated software
- D. Prevent users from running as administrator so they cannot install software.
Answer: A
NEW QUESTION 107
Drag and drop the correct protocol to its default port.
Answer:
Explanation:
Explanation:
FTP uses TCP port 21. Telnet uses port 23.
SSH uses TCP port 22.
All protocols encrypted by SSH, including SFTP, SHTTP, SCP, SExec, and slogin, also use TCP port 22. Secure Copy Protocol (SCP) is a secure file-transfer facility based on SSH and Remote Copy Protocol (RCP).
Secure FTP (SFTP) is a secured alternative to standard File Transfer Protocol (FTP). SMTP uses TCP port 25.
Port 69 is used by TFTP.
SNMP makes use of UDP ports 161 and 162. http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
NEW QUESTION 108
During a routine audit, it is discovered that someone has been using a stale administrator account to log into a seldom used server. The person has been using the server to view inappropriate websites that are prohibited to end users.
Which of the following could best prevent this from occurring again?
- A. Credential management
- B. Group policy management
- C. Acceptable use policy
- D. Account expiration policy
Answer: D
NEW QUESTION 109
An organization uses application whitelisting to help prevent zero-day attacks. Malware was recently identified on one client, which was able to run despite the organization's application whitelisting approach. The forensics team has identified the malicious file, conducted a post-incident analysis, and compared this with the original system baseline. The team sees the following output:
filename hash (SHA-1)
original: winSCP.exe 2d da b1 4a 98 fc f1 98 06 b1 e5 26 b2 df e5 f5 3e cb 83 el latest: winSCP.exe a3 4a c2 4b 85 fa f2 dd 0b ba f4 16 b2 df f2 4b 3f ac 4a e1 Which of the following identifies the flaw in the team's application whitelisting approach?
- A. SHA-1 has known collision vulnerabilities and should not be used.
- B. Their approach uses executable names and not hashes for the whitelist.
- C. The original baseline never captured the latest file signature
- D. Zero-day attacks require the latest file signatures
Answer: B
NEW QUESTION 110
A company just implemented a new telework policy that allows employees to use personal devices for official email and file sharing while working from home. Some of the requirements are:
* Employees must provide an alternate work location (i.e., a home address).
* Employees must install software on the device that will prevent the loss of proprietary data but will not restrict any other software from being installed.
Which of the following BEST describes the MDM options the company is using?
- A. Remote wipe, geolocation, screen locks, storage segmentation, and full-device encryption
- B. Geofencing, content management, remote wipe, containerization, and storage segmentation
- C. Content management, remote wipe, geolocation, context-aware authentication, and containerization
- D. Application management, remote wipe, geofencing, context-aware authentication, and containerization
Answer: D
Explanation:
Explanation
NEW QUESTION 111
DRAG DROP
Drag the items on the left to show the different types of security for the shown devices. Not all fields need to be filled. Not all items need to be used.
Answer:
Explanation:
Explanation:
Mobile Device Security
GPS tracking
Remote wipe
Device Encryption
Strong password
Server in Data Center Security
FM-200
Biometrics
Proximity Badges
Mantrap
For mobile devices, at bare minimum you should have the following security measures in place: Screen lock, Strong password, Device encryption, Remote wipe/Sanitation, voice encryption, GPS tracking, Application control, Storage segmentation, Asset tracking as well as Device Access control.
For servers in a data center your security should include: Fire extinguishers such as FM200 as part of fire suppression; Biometric, proximity badges, mantraps, HVAC, cable locks; these can all be physical security measures to control access to the server.
References:
Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex,
Indianapolis, 2014, p. 418
NEW QUESTION 112
A global gaming console manufacturer is launching a new gaming platform to its customers.
Which of the following controls reduces the risk created by malicious gaming customers attempting to circumvent control by way of modifying consoles?
- A. Firmware version control
- B. Automatic updates
- C. Manual software upgrades
- D. Network segmentation
- E. Application firewalls
- F. Vulnerability scanning
Answer: A,B
NEW QUESTION 113
While reviewing the wireless router, the systems administrator of a small business determines someone is spoofing the MAC address of an authorized device. Given the table below:
Which of the following should be the administrator's NEXT step to detect if there is a rogue system without impacting availability?
- A. Apply MAC filtering.
- B. Physically check each system.
- C. Deny Internet access to the "UNKNOWN" hostname.
- D. Conduct a ping sweep.
Answer: D
NEW QUESTION 114
A systems administrator is reviewing the following information from a compromised server:
Given the above information, which of the following processes was MOST likely exploited via a remote buffer overflow attack?
- A. Apache
- B. LSASS
- C. MySQL
- D. TFTP
Answer: A
NEW QUESTION 115
A user typically works remotely over the holidays using a web-based VPN to access corporate resources. The user reports getting untrusted host errors and being unable to connect. Which of the following is MOST likely the case?
- A. The certificate has expired
- B. The browser does not support SSL
- C. The VPN software has reached the seat license maximum
- D. The user's account is locked out
Answer: A
NEW QUESTION 116
An information security specialist is reviewing the following output from a Linux server.
Based on the above information, which of the following types of malware was installed on the server?
- A. Rootkit
- B. Ransomware
- C. Trojan
- D. Logic bomb
- E. Backdoor
Answer: E
NEW QUESTION 117
......
Our SY0-501 practice test will include those topics:
- Identity and Access Management 16%
- Threats, Attacks and Vulnerabilities 21%
- Cryptography and PKI 12%
- Architecture and Design 15%
- Technologies and Tools 22%
- Risk Management 14%
For more info visit: CompTIA Security
Certification Training for SYO-501 Exam Dumps Test Engine: https://www.lead1pass.com/CompTIA/SYO-501-practice-exam-dumps.html
SYO-501 Training & Certification Get Latest Security+ : https://drive.google.com/open?id=1p1PMtQmkV68d_1ITgVofEh7SHtjeUFAv