SY0-601

SY0-601 practice questions, page 13 of 35, with answer review and explanations.

Question 61

Data exfiltration analysis indicates that an attacker managed to download system configuration notes from a web server. The web-server logs have been deleted, but analysts have determined that the system configuration notes were stored in the database administrator's folder on the web server. Which of the following attacks explains what occurred? (Choose two.)

  1. Pass-the-hash
  2. Directory traversal
  3. SQL injection
  4. Privilege escalation
  5. Cross-site scripting
  6. Request forgery

Question 62

A junior security analyst is conducting an analysis after passwords were changed on multiple accounts without users' interaction. The SIEM have multiple login entries with the following text: suspicious event - user: scheduledtasks successfully authenticate on AD on abnormal time suspicious event - user: scheduledtasks failed to execute c:\weekly_checkups\amazing-3rdparty-domain-assessment.py suspicious event - user: scheduledtasks failed to execute c:\weekly_checkups\secureyourAD-3rdparty-compliance.sh suspicious event - user: scheduledtasks successfully executed c:\weekly_checkups\amazing-3rdparty-domain-assessment.py Which of the following is the MOST likely attack conducted on the environment?

  1. Malicious script
  2. Privilege escalation
  3. Domain hijacking
  4. DNS poisoning

Question 63

A customer service representative reported an unusual text message that was sent to the help desk. The message contained an unrecognized invoice number with a large balance due and a link to click for more details. Which of the following BEST describes this technique?

  1. Vishing
  2. Whaling
  3. Phishing
  4. Smishing

Question 64

Which of the following actions would be recommended to improve an incident response process?

  1. Train the team to identify the difference between events and incidents.
  2. Modify access so the IT team has full access to the compromised assets.
  3. Contact the authorities if a cybercrime is suspected.
  4. Restrict communication surrounding the response to the IT team.

Question 65

A cybersecurity administrator needs to implement a Layer 7 security control on a network and block potential attacks. Which of the following can block an attack at Layer 7? (Choose two.)

  1. HIDS
  2. NIPS
  3. HSM
  4. WAF
  5. NAC
  6. NIDS