2022 Updated Verified Pass SY0-501 Study Guides & Best Courses
Ultimate Guide to the SY0-501 - Latest Edition Available Now
NEW QUESTION 400
Which of the following implements two-factor authentication?
- A. An ATM requiring a credit card and PIN
- B. A computer requiring username and password
- C. A phone system requiring a PIN to make a call
- D. A datacenter mantrap requiring fingerprint and iris scan
Answer: D
NEW QUESTION 401
A security analyst is mitigating a pass-the-hash vulnerability on a Windows infrastructure. Given the requirement, which of the following should the security analyst do to MINIMIZE the risk?
- A. Enable Kerebos
- B. Enable CHAP
- C. Disable PAP
- D. Disable NTLM
Answer: D
NEW QUESTION 402
An incident response manager has started to gather all the facts related to a SIEM alert showing multiple systems may have been compromised. The manager has gathered these facts:
The breach is currently indicated on six user PCs
One service account is potentially compromised
Executive management has been notified
In which of the following phases of the IRP is the manager currently working?
- A. Containment
- B. Eradication
- C. Recovery
- D. Identification
Answer: D
NEW QUESTION 403
During a forensics investigation, which of the following must be addressed FIRST according to the order of volatility?
- A. Network-attached storage
- B. RAM
- C. Hard drive
- D. USB flash drive
Answer: B
NEW QUESTION 404
A security administrator plans to conduct a vulnerability scan on the network to determine if system applications are up to date. The administrator wants to limit disruptions to operations but not consume too many resources. Which of the following types of vulnerability scans should be conducted?
- A. Port
- B. Credentialed
- C. Non-Intrusive
- D. SYN
Answer: C
NEW QUESTION 405
A security administrator wants to implement strong security on the company smart phones and terminal servers located in the data center.
Drag and drop the applicable controls to each asset types?
Instructions: Controls can be used multiple times and not all placeholders need to be filled. When you have completed the simulation, please select the Done button to submit.
Answer:
Explanation:
NEW QUESTION 406
A researcher has been analyzing large data sets for the last ten months. The researcher works with colleagues from other institutions and typically connects via SSH to retrieve additional data. Historically, this setup has worked without issue, but the researcher recently started getting the following message:
Which of the following network attacks Is the researcher MOST likely experiencing?
- A. Man-in-the-middle
- B. Evil twin
- C. MAC cloning
- D. ARP poisoning
Answer: A
Explanation:
Explanation
This is alarming because it could actually mean that you're connecting to a different server without knowing it.
If this new server is malicious then it would be able to view all data sent to and from your connection, which could be used by whoever set up the server. This is called a man-in-the-middle attack. This scenario is exactly what the "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" message is trying to warn you about.
NEW QUESTION 407
Ann, a security administrator, has been instructed to perform fuzz-based testing on the company's applications. Which of the following best describes what she will do?
- A. Test the applications for the existence of built-in- back doors left by the developers
- B. Enter random or invalid data into the application in an attempt to cause it to fault
- C. Work with the developers to eliminate horizontal privilege escalation opportunities
- D. Hash the application to verify it won't cause a false positive on the HIPS
Answer: B
NEW QUESTION 408
An application team is performing a load-balancing test for a critical application during off- hours and has requested access to the load balancer to review. Which servers are up without having the administrator on call. The security analyst is hesitant to give the application team full access due to other critical applications running on the road balancer.
Which of the following is the BEST solution for the security analyst to process the request?
- A. Disable other critical applications before granting the team access.
- B. Give the application team administrator access during off hours
- C. Share the account with the application team
- D. Give the application team read-only access
Answer: B
NEW QUESTION 409
A researcher has been analyzing large data sets for the last ten months. The researcher works with colleagues from other institutions and typically connects via SSH to retrieve additional data. Historically, this setup has worked without issue, but the researcher recently started getting the following message:
Which of the following network attacks Is the researcher MOST likely experiencing?
- A. Man-in-the-middle
- B. Evil twin
- C. MAC cloning
- D. ARP poisoning
Answer: A
Explanation:
Explanation
This is alarming because it could actually mean that you're connecting to a different server without knowing it.
If this new server is malicious then it would be able to view all data sent to and from your connection, which could be used by whoever set up the server. This is called a man-in-the-middle attack. This scenario is exactly what the "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" message is trying to warn you about.
NEW QUESTION 410
Users report the following message appears when browsing to the company's secure site: This website cannot be trusted.Which of the following actions should a security analyst take to resolve these messages? (Choose two.)
- A. Install the updated private key on the web server.
- B. Ensure the certificate has a .pfx extension on the server.
- C. Verify the certificate has not expired on the server.
- D. Update the root certificate into the client computer certificate store.
- E. Have users clear their browsing history and relaunch the session.
Answer: C,D
NEW QUESTION 411
HOTSPOT
For each of the given items, select the appropriate authentication category from the drop down choices.
Select the appropriate authentication type for the following items:
Hot Area:
Answer:
Explanation:
NEW QUESTION 412
A security administrator suspects an employee has been emailing proprietary information to a competitor. Company policy requires the administrator to capture an exact copy of the employee's hard disk. Which of the following should the administrator use?
- A. chmod
- B. dnaenum
- C. dd
- D. logger
Answer: C
NEW QUESTION 413
A systems administrator needs to install the same X.509 certificate on multiple servers. Which of the following should the administrator use?
D18912E1457D5D1DDCBD40AB3BF70D5D
- A. A self-signed certificate
- B. Certificate chaining
- C. Key escrow
- D. An extended validation certificate
Answer: D
NEW QUESTION 414
Which of the following BEST explains why a development environment should have the same database server secure baseline that exists in production even if there is no PII in the database?
- A. Databases are unique in their need to have secure configurations applied in all environments because they are attacked more often
- B. Attackers can extract sensitive, personal information from lower development environment databases just as easily as they can from production databases.
- C. Without the same configuration in both development and production, there are no assurances that changes made in development will have the same effect in production.
- D. Laws stipulate that databases with the ability to store personal information must be secured regardless of the environment or if they actually have PII
Answer: B
NEW QUESTION 415
Ann, an employee in the payroll department, has contacted the help desk citing multiple issues with her device, including:
* Slow performance
* Word documents, PDFs, and images no longer opening
* A pop-up
Ann states the issues began after she opened an invoice that a vendor emailed to her.
Upon opening the invoice, she had to click several security warnings to view it in her word processor. With which of the following is the device MOST likely infected?
- A. Crypto-malware
- B. Rootkit
- C. Spyware
- D. Backdoor
Answer: B
NEW QUESTION 416
An analyst wants to implement a more secure wireless authentication for office access points. Which of the following technologies allows for encrypted authentication of wireless clients over TLS?
- A. EAP
- B. PEAP
- C. RADIUS
- D. WPA2
Answer: B
Explanation:
EAP by itself is only an authentication framework.
PEAP (Protected Extensible Authentication Protocol) fully encapsulates EAP and is designed to work within a TLS (Transport Layer Security) tunnel that may be encrypted but is authenticated. The primary motivation behind the creation of PEAP was to help correct the deficiencies discovered within EAP since that protocol assumes that the communications channel are protected. As a result, when EAP messages are able to be discovered in the "clear" they do not provide the protection that was assumed when the protocol was originally authored.
PEAP, EAP-TTLS, and EAP-TLS "protect" inner EAP authentication within SSL/TLS sessions.
NEW QUESTION 417
......
Architecture as well as Design
This objective will determine if you understand the role of IT frameworks, secure configuration guides, and best practices. Besides, it will also emphasize the skills listed below:
- Security implications associated with embedded systems.
- The significance of secure concepts of staging deployment;
- Summary of the cloud and virtualization techniques;
- Significance of physical security controls;
- The implementation of reliable concepts of network architecture;
- The pros of using automation and resiliency methods;
- Utilizing reliable systems design;
Tools and Technologies
‘Tools and technologies' is a comprehensive topic that establishes the knowledge of network components, both hardware and software solutions, software tools, and troubleshooting of security issues. It also proves your mastery of security technologies, secure mobile devices, and secure protocols. Thus, you must be knowledgeable about firewall, VPN concentrator, protocol analyzer, event anomalies, DLP, honeynets, SCADA/ICS, and lock types.
Dumps MoneyBack Guarantee - SY0-501 Dumps Approved Dumps: https://www.validbraindumps.com/SY0-501-exam-prep.html