SYO-601 Practice Questions 42-82

An organization is tuning SIEM rules based off of threat intelligence

reports. Which of the following phases of the incident response process

does this scenario represent?

• Eradication

• Preparation

• Lessons Learned

• Recovery

A network manager is concerned that business may be negatively

impacted if the firewall in its datacenter goes offline. The manager would

like to implement a high availability pair to:

• decrease the mean time between failures

• cut dawn the mean time to repair.

• remove the single point of failure.

• reduce the recovery time objective.

A host was infected with malware. During the incident response, Joe, a

user, reported that he did not receive any emails with links, but he had

been browsing the Internet all day. Which of the following would MOST likely show where the malware originated?

• The DNS logs

• The SIP traffic logs

• The web server logs

• The SNMP logs

Which of the following would MOST likely be identified by a Points

credentialed scan but would be missed by an uncredentialed scan?

• Vulnerabilities with a CVSS score greater than 6.9.

• CVEs related to nan-Microsoft systems such as printers and switches.

• Critical infrastructure vulnerabilities on non-lP protocols.

• Missing patches for third-party software on Windows workstations and

  servers.

A recent phishing campaign resulted in several compromised user

accounts. The security incident response team has been tasked with

reducing the manual labor ot filtering through all the phishing emails as

they arrive and blocking the sender's email address, along with other

time-consuming mitigation actions. Which of the following can be configured to streamline those tasks?

• SOAR playbook

• Firewall rules

• MOM policy

• URLfilter

• SIEM data collection

Which of the following is a reason to publish files' hashes?

• To validate the integrity af the files

• To use the hash as a software activation ke

• To verify if the software was digitally signed

• To use the hash as a decryption passphrase

A security analyst is tasked with classifying data to be stored on company

servers. Which of the following should be classified as proprietary?

• Customers dates af birth

• Marketing strategies

• Customers email addresses

• Employee salaries

Which of the following are requirements that must be configured for PCI

OSS compliance? (Choose two.)

• Testing security systems and processes regularly

• Assigning a unique 10 to each person with computer access

• Installing and maintaining a web proxy to protect cardholder data

• Encrypting transmission of cardholder data across private networks

• Benchmarking security awareness training far contractors

Which of the following can be used by a monitoring tool to compare

values and detect password leaks without providing the actual

credentials?

• hashing

• masking

• tokenization

• Encryption

An organization would like to give remote workers the ability to use

applications hosted inside the corporate network. Users will be allowed to

use their personal computers, or they will be provided organization

assets. Either way, no data or applications will be installed locally on any

user systems. Which of the following mobile solutions would accomplish these

goals?

• VDI

• COPE

• MDM

• UTM