Jan-2022 CompTIA SYO-501 Actual Questions and Braindumps
SYO-501 Dumps To Pass CompTIA Exam in 24 Hours - TopExamCollection
Which Skills Will You Obtain from CompTIA Security+ Certification?
You will earn 5 core skills from the Security+ certification including the following:
- Operations and incident response;
- Governance, risk, and compliance.
- Architecture and design;
- Implementation;
- Attacks, threats, and vulnerabilities;
NEW QUESTION 308
A company recently updated its website to increase sales. The new website uses PHP forms for leads and provides a directory with sales staff and their phone numbers. A systems administrator is concerned about the new website and provides the following log to support the concern:
Which of the following is the systems administrator MOST likely to suggest to the Chief Information Security Officer (CISO) based on the above?
- A. Implementing account lockouts
- B. Increasing the minimum password length from eight to ten characters
- C. Changing the account standard naming convention
- D. Discontinuing the use of privileged accounts
Answer: C
NEW QUESTION 309
A group of developers is collaborating to write software for a company. The developers need to work in subgroups and control who has access to their modules. Which of the following access control methods is considered user-centric?
- A. Rule-based
- B. Mandatory
- C. Time-based
- D. Discretionary
Answer: D
NEW QUESTION 310
Which of the following is the BEST choice for a security control that represents a preventive and corrective logical control at the same time?
- A. Intrusion detection system
- B. Security awareness training
- C. Antivirus
- D. Firewalls
Answer: C
NEW QUESTION 311
Lab Sim - Configure the Firewall
Task: Configure the firewall (fill out the table) to allow these four rules:
- Only allow the Accounting computer to have HTTPS access to the
Administrative server.
- Only allow the HR computer to be able to communicate with the Server
2 System over SCP.
- Allow the IT computer to have access to both the Administrative
Server 1 and Administrative Server 2
Answer:
Explanation:
Use the following answer for this simulation task.
Below table has all the answers required for this question.
Explanation:
Firewall rules act like ACLs, and they are used to dictate what traffic can pass between the firewall and the internal network. Three possible actions can be taken based on the rule's criteria:
Block the connection
Allow the connection
Allow the connection only if it is secured
TCP is responsible for providing a reliable, one-to-one, connection-oriented session.
TCP establishes a connection and ensures that the other end receives any packets sent.
Two hosts communicate packet results with each other. TCP also ensures that packets are decoded and sequenced properly. This connection is persistent during the session.
When the session ends, the connection is torn down.
UDP provides an unreliable connectionless communication method between hosts.
UDP is considered a best-effort protocol, but it's considerably faster than TCP.
The sessions don't establish a synchronized session like the kind used in TCP, and UDP doesn't guarantee error-free communications.
The primary purpose of UDP is to send small packets of information.
The application is responsible for acknowledging the correct reception of the data.
Port 22 is used by both SSH and SCP with UDP.
Port 443 is used for secure web connections ?HTTPS and is a TCP port.
Thus to make sure only the Accounting computer has HTTPS access to the Administrative server you should use TCP port 443 and set the rule to allow communication between 10.4.255.10/24 (Accounting) and 10.4.255.101 (Administrative server1) Thus to make sure that only the HR computer has access to Server2 over SCP you need use of TCP port 22 and set the rule to allow communication between 10.4.255.10/23 (HR) and 10.4.255.2 (server2) Thus to make sure that the IT computer can access both the Administrative servers you need to use a port and accompanying port number and set the rule to allow communication between:
10.4.255.10.25 (IT computer) and 10.4.255.101 (Administrative server1)
10.4.255.10.25 (IT computer) and 10.4.255.102 (Administrative server2)
NEW QUESTION 312
An organization's policy requires users to create passwords with an uppercase letter, lowercase letter, number, and symbol. This policy is enforced with technical controls, which also prevents users from using any of their previous 12 passwords. The quantization does not use single sign-on, nor does it centralize storage of passwords.
The incident response team recently discovered that passwords for one system were compromised. Passwords for a completely separate system have NOT been compromised, but unusual login activity has been detected for that separate system. Account login has been detected for users who are on vacation.
Which of the following BEST describes what is happening?
- A. Some users are reusing passwords, and some of the compromised passwords are valid on multiple systems.
- B. The password history enforcement is insufficient, and old passwords are still valid across many different systems.
- C. The compromised password file has been brute-force hacked, and the complexity requirements are not adequate to mitigate this risk.
Section: (none)
Explanation - D. Some users are meeting password complexity requirements but not password length requirements.
Answer: C
NEW QUESTION 313
Despite having implemented password policies, users continue to set the same weak passwords and reuse old passwords.
Which of the following technical controls would help prevent these policy violations? (Select TWO).
- A. Password complexity
- B. Password length
- C. Password history
- D. Password expiration
- E. Password lockout
Answer: A,B
NEW QUESTION 314
A security analyst conducts a manual scan on a known hardened host that identifies many non-compliant items.
Which of the following BEST describe why this has occurred? (Choose two.)
- A. Privileged-user credentials were used to scan the host
- B. Non-applicable plugins were selected in the scan policy
- C. The output of the report contains false positives
- D. The target host has been compromised
- E. The incorrect audit file was used
Answer: B,C
NEW QUESTION 315
An administrator is beginning an authorized penetration test of a corporate network. Which of the following tools would BEST assist in identifying potential attacks?
- A. Honey pot
- B. Nmap
- C. Company directory
- D. Netstat
Answer: B
NEW QUESTION 316
Ann, a user, reports she is unable to access an application from her desktop. A security analyst verifies Ann's access and checks the SIEM for any errors. The security analyst reviews the log file from Ann's system and notices the following output:
Which of the following is MOST likely preventing Ann from accessing the application from the desktop?
- A. DLP
- B. Host-based firewall
- C. Network-based firewall
- D. UTM
- E. Web application firewall
Answer: B
NEW QUESTION 317
An auditor is performing an assessment of a security appliance with an embedded OS that was vulnerable during the last two assessments. Which of the following BEST explains the appliance's vulnerable state?
- A. The system was configured with weak default security settings.
- B. The device uses weak encryption ciphers.
- C. The vendor has not supplied a patch for the appliance.
- D. The appliance requires administrative credentials for the assessment.
Answer: A
NEW QUESTION 318
When used together, which of the following qualify as two-factor authentication?
- A. Password and PIN
- B. Fingerprint scanner and iris scanner
- C. Proximity card and smart card
- D. Smart card and PIN
Answer: D
NEW QUESTION 319
A security technician has been assigned data destruction duties. The hard drives that are being disposed of contain highly sensitive information. Which of the following data destruction techniques is MOST appropriate?
- A. Purging
- B. Shredding
- C. Degaussing
- D. Wiping
Answer: B
Explanation:
Hard drive degaussing is a highly advanced technology used to sanitize hard drives before disposal or reuse. Degaussers come in various types and sizes, with varying effectiveness as well. A professional data destruction service selects the most appropriate degausser for the job based on prevailing circumstances.
Degaussing is fast and effective, and it ensures that you're compliant with data regulations.
NEW QUESTION 320
A security analyst is reviewing the logs from a NGFWs automated correlation engine and sees the following:
Which of the following should the analyst perform FIRST?
- A. Set up an alert to receive an email notification for all events.
- B. Isolate the compromised host from the network.
- C. Refresh the URL filtering database to ensure accuracy.
- D. Clear the logs and see If the same events reoccur.
- E. Set up a packet capture to analyze the unknown TCP and UDP traffic.
Answer: B
NEW QUESTION 321
An analyst generates the following color-coded table shown in the exhibit to help explain the risk of potential incidents in the company. The vertical axis indicates the likelihood or an incident, while the horizontal axis indicates the impact.
Which of the following is this table an example of?
- A. Internal threat assessment
- B. Supply chain assessment
- C. Privacy impact assessment
- D. Qualitative risk assessment
Answer: D
NEW QUESTION 322
You have just received some room and WiFi access control recommendations from a security consulting company. Click on each building to bring up available security controls. Please implement the following requirements:
The Chief Executive Officer's (CEO) office had multiple redundant security measures installed on the door to the office. Remove unnecessary redundancies to deploy three-factor authentication, while retaining the expensive iris render.
The Public Cafe has wireless available to customers. You need to secure the WAP with WPA and place a passphrase on the customer receipts.
In the Data Center you need to include authentication from the "something you know" category and take advantage of the existing smartcard reader on the door.
In the Help Desk Office, you need to require single factor authentication through the use of physical tokens given to guests by the receptionist.
The PII Office has redundant security measures in place. You need to eliminate the redundancy while maintaining three-factor authentication and retaining the more expensive controls.
Instructions: The original security controls for each office can be reset at any time by selecting the Reset button. Once you have met the above requirements for each office, select the Save button. When you have completed the entire simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
Answer:
Explanation:
NEW QUESTION 323
For each of the given items, select the appropriate authentication category from the dropdown choices.
Instructions: When you have completed the simulation, please select the Done button to submit.
Answer:
Explanation:
Explanation:
Something you are includes fingerprints, retina scans, or voice recognition.
Something you have includes smart cards, token devices, or keys.
Something you know includes a password, codes, PINs, combinations, or secret phrases. Somewhere you are including a physical location s or logical addresses, such as domain name, an IP address, or a MAC address.
Something you do includes your typing rhythm, a secret handshake, or a private knock http://en.wikipedia.org/wiki/Password_authentication_protocol#Working_cycle http://en.wikipedia.org/wiki/Smart_card#Security
NEW QUESTION 324
The security administrator has installed a new firewall which implements an implicit DENY policy by default.
INSTRUCTIONS:
Click on the firewall and configure it to allow ONLY the following communication.
1. The Accounting workstation can ONLY access the web server on the public network over the default HTTPS port. The accounting workstation should not access other networks.
2. The HR workstation should be restricted to communicate with the Financial server ONLY, over the default SCP port
3. The Admin workstation should ONLY be able to access the servers on the secure network over the default TFTP port.
Instructions: The firewall will process the rules in a top-down manner in order as a first match The port number must be typed in and only one port number can be entered per rule Type ANY for all ports. The original firewall configuration can be reset at any time by pressing the reset button. Once you have met the simulation requirements, click save and then Done to submit.
Hot Area:
Answer:
Explanation:
Explanation
Section: Network Security
Implicit deny is the default security stance that says if you aren't specifically granted access or privileges for a resource, you're denied access by default.Rule #1 allows the Accounting workstation to ONLY access the web server on the public network over the default HTTPS port, which is TCP port 443.Rule #2 allows the HR workstation to ONLY communicate with the Financial server over the default SCP port, which is TCP Port
22Rule #3 & Rule #4 allow the Admin workstation to ONLY access the Financial and Purchasing servers located on the secure network over the default TFTP port, which is Port 69.
References:Stewart,
James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp. 26, 44
http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
NEW QUESTION 325
A security analyst is reviewing the following packet capture of an attack directed at a company's server located in the DMZ:
Which of the following ACLs provides the BEST protection against the above attack and any further attacks from the same IP, while minimizing service interruption?
- A. DENY TCO From ANY to 172.31.64.4
- B. Deny UDP from 192.168.1.0/24 to 172.31.67.0/24
- C. Deny TCP from 192.168.1.10 to 172.31.67.4
- D. Deny IP from 192.168.1.10/32 to 0.0.0.0/0
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 326
......
Tools and Technologies
‘Tools and technologies' is a comprehensive topic that establishes the knowledge of network components, both hardware and software solutions, software tools, and troubleshooting of security issues. It also proves your mastery of security technologies, secure mobile devices, and secure protocols. Thus, you must be knowledgeable about firewall, VPN concentrator, protocol analyzer, event anomalies, DLP, honeynets, SCADA/ICS, and lock types.
Download the Latest SYO-501 Dump - 2022 SYO-501 Exam Question Bank: https://www.topexamcollection.com/SYO-501-vce-collection.html
Buy Latest SYO-501 Exam Q&A PDF - One Year Free Update: https://drive.google.com/open?id=1mgyUswMXRX2Uh8wwG0ige7pcnI6SOSBW
