SY0-601 practice questions, page 11 of 35, with answer review and explanations.
Question 51
Which of the following organizations sets frameworks and controls for optimal security configuration on systems?
ISO
GDPR
PCI DSS
NIST
Question 52
An organization discovered files with proprietary financial data have been deleted. The files have been recovered from backup, but every time the Chief Financial Officer logs in to the file server, the same files are deleted again. No other users are experiencing this issue. Which of the following types of malware is MOST likely causing this behavior?
Logic bomb
Cryptomalware
Spyware
Remote access Trojan
Question 53
A security analyst has identified malware spreading through the corporate network and has activated the CSIRT. Which of the following should the analyst do NEXT?
Review how the malware was introduced to the network.
Attempt to quarantine all infected hosts to limit further spread.
Create help desk tickets to get infected systems reimaged.
Update all endpoint antivirus solutions with the latest updates.
Question 54
During an incident response, an analyst applied rules to all inbound traffic on the border firewall and implemented ACLs on each critical server. Following an investigation, the company realizes it is still vulnerable because outbound traffic is not restricted, and the adversary is able to maintain a presence in the network. In which of the following stages of the Cyber Kill Chain is the adversary currently operating?
Reconnaissance
Command and control
Actions on objective
Exploitation
Question 55
A recent security breach exploited software vulnerabilities in the firewall and within the network management solution. Which of the following will MOST likely be used to identify when the breach occurred through each device?