SY0-601

Question 151

A SOC operator is analyzing a log file that contains the following entries: Which of the following explains these log entries?

1. SQL injection and improper input-handling attempts
2. Cross-site scripting and resource exhaustion attempts
3. Command injection and directory traversal attempts
4. Error handling and privilege escalation attempts

Question 152

A security incident has been resolved. Which of the following BEST describes the importance of the final phase of the incident response plan?

1. It examines and documents how well the team responded, discovers what caused the incident, and determines how the incident can be avoided in the future.
2. It returns the affected systems back into production once systems have been fully patched, data restored, and vulnerabilities addressed.
3. It identifies the incident and the scope of the breach, how it affects the production environment, and the ingress point.
4. It contains the affected systems and disconnects them from the network, preventing further spread of the attack or breach.

Question 153

Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation. INSTRUCTIONS - Not all attacks and remediation actions will be used. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button. Hot Area:

Question 154

During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user's intranet account? (Choose two.)

1. Federation
2. Identity proofing
3. Password complexity
4. Default password changes
5. Password manager
6. Open authentication

Question 155

SIMULATION - An attack has occurred against a company. INSTRUCTIONS - You have been tasked to do the following: ✑ Identify the type of attack that is occurring on the network by clicking on the attacker's tablet and reviewing the output. ✑ Identify which compensating controls a developer should implement on the assets, in order to reduce the effectiveness of future attacks by dragging them to the correct server. All objects will be used, but not all placeholders may be filled. Objects may only be used once. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.