2022 COMPTIA SECURITY+ SY0-601 BEST EXAM STUDY GUIDE SOLUTION.
A - CORRECT ANSWER A security administrator suspects an employee has been emailing
proprietary information to a competitor. Company policy requires the administrator to capture
an exact copy of the employee's hard disk.
Which of the following should the administrator use?
A. dd
B. chmod
C. dnsenum
D. logger
THIS IS THE ORDER AS FOLLOWS:
ssh-keygen -t rsa
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server
chmod 644 ~/.ssh/id_rsa
ssh root@server - CORRECT ANSWER DRAG AND DROP SIMULATION (SEE IMAGE)
Firewall 1:DNS Rule "" ANY --> ANY --> DNS --> PERMIT
HTTPS Outbound "" 10.0.0.1/24 --> ANY --> HTTPS --> PERMIT
Management "" ANY --> ANY --> SSH --> PERMIT
HTTPS Inbound "" ANY --> ANY --> HTTPS --> PERMIT
HTTP Inbound "" ANY --> ANY --> HTTP --> DENY
Firewall 2: No changes should be made to this firewall
Firewall 3:DNS Rule "" ANY --> ANY --> DNS --> PERMIT
HTTPS Outbound "" 192.168.0.1/24 --> ANY --> HTTPS --> PERMIT
Management "" ANY --> ANY --> SSH --> PERMIT
HTTPS Inbound "" ANY --> ANY --> HTTPS --> PERMIT
HTTP Inbound "" ANY --> ANY --> HTTP --> DENY - CORRECT ANSWER DROP
DOWN SIMULATION (SEE IMAGE)
See IMAGE - CORRECT ANSWER DRAG AND DROP SIMULATION (SEE ANSWERS
IN IMAGE)
DF - CORRECT ANSWER Which of the following will MOST likely adversely impact the
operations of unpatched traditional programmable-logic controllers, running a back-end
LAMP server and OT systems with human-management interfaces that are accessible over the
Internet via a web interface? (Choose two.)
A. Cross-site scripting
B. Data exfiltration
C. Poor system logging
D. Weak encryption
E. SQL injection
F. Server-side request forgery
,A - CORRECT ANSWER A company recently transitioned to a strictly BYOD culture due to
the cost of replacing lost or damaged corporate-owned mobile devices.
Which of the following technologies would be BEST to balance the BYOD culture while also
protecting the company's data?
A. Containerization
B. Geofencing
C. Full-disk encryption
D. Remote wipe
D - CORRECT ANSWER A Chief Security Office's (CSO's) key priorities are to improve
preparation, response, and recovery practices to minimize system downtime and enhance
organizational resilience to ransomware attacks.
Which of the following would BEST meet the CSO's objectives?
A. Use email-filtering software and centralized account management, patch high-risk systems,
and restrict administration privileges on fileshares.
B. Purchase cyber insurance from a reputable provider to reduce expenses during an incident.
C. Invest in end-user awareness training to change the long-term culture and behavior of staff
and executives, reducing the organization's susceptibility to phishing attacks.
D. Implement application whitelisting and centralized event-log management, and perform
regular testing and validation of full backups.
AC - CORRECT ANSWER A network engineer has been asked to investigate why several
wireless barcode scanners and wireless computers in a warehouse have intermittent
connectivity to the shipping server. The barcode scanners and computers are all on forklift
trucks and move around the warehouse during their regular use.
Which of the following should the engineer do to determine the issue? (Choose two.)
A. Perform a site survey
B. Deploy an FTK Imager
C. Create a heat map
D. Scan for rogue access points
E. Upgrade the security protocols
F. Install a captive portal
C - CORRECT ANSWER Which of the following is MOST likely to outline the roles and
responsibilities of data controllers and data processors?
A. SSAE SOC 2
B. PCI DSS
,C. GDPR
D. ISO 31000
C - CORRECT ANSWER Phishing and spear-phishing attacks have been occurring more
frequently against a company's staff.
Which of the following would MOST likely help mitigate this issue?
A. DNSSEC and DMARC
B. DNS query logging
C. Exact mail exchanger records in the DNS
D. The addition of DNS conditional forwarders
EF - CORRECT ANSWER On which of the following is the live acquisition of data for
forensic analysis MOST dependent? (Choose two.)
A. Data accessibility
B. Legal hold
C. Cryptographic or hash algorithm
D. Data retention legislation
E. Value and volatility of data
F. Right-to-audit clauses
B - CORRECT ANSWER Which of the following incident response steps involves actions to
protect critical systems while maintaining business operations?
A. Investigation
B. Containment
C. Recovery
D. Lessons learned
B - CORRECT ANSWER A security auditor is reviewing vulnerability scan data provided by
an internal security team.
Which of the following BEST indicates that valid credentials were used?
A. The scan results show open ports, protocols, and services exposed on the target host
B. The scan enumerated software versions of installed programs
C. The scan produced a list of vulnerabilities on the target host
D. The scan identified expired SSL certificates
B - CORRECT ANSWER Which of the following BEST explains the difference between a data
owner and a data custodian?
A. The data owner is responsible for adhering to the rules for using the data, while the data
custodian is responsible for determining the corporate governance regarding the data
, B. The data owner is responsible for determining how the data may be used, while the data
custodian is responsible for implementing the protection to the data
C. The data owner is responsible for controlling the data, while the data custodian is
responsible for maintaining the chain of custody when handling the data
D. The data owner grants the technical permissions for data access, while the data custodian
maintains the database access controls to the data
D - CORRECT ANSWER A network engineer needs to build a solution that will allow guests
at the company's headquarters to access the Internet via WiFi. This solution should not allow
access to the internal corporate network, but it should require guests to sign off on the
acceptable use policy before accessing the Internet.
Which of the following should the engineer employ to meet these requirements?
A. Implement open PSK on the APs
B. Deploy a WAF
C. Configure WIPS on the APs
D. Install a captive portal
D - CORRECT ANSWER Based on the analyst's findings, which of the following attacks is
being executed?
A. Credential harvesting
B. Keylogger
C. Brute-force
D. Spraying
C - CORRECT ANSWER Which of the following cloud models provides clients with servers,
storage, and networks but nothing else?
A. SaaS
B. PaaS
C. IaaS
D. DaaS
AB - CORRECT ANSWER A network administrator needs to build out a new datacenter, with
a focus on resiliency and uptime.
Which of the following would BEST meet this objective?(Choose two.)
A. Dual power supply
B. Off-site backups
C. Automatic OS upgrades
D. NIC teaming
E. Scheduled penetration testing
F. Network-attached storage
A - CORRECT ANSWER A security administrator suspects an employee has been emailing
proprietary information to a competitor. Company policy requires the administrator to capture
an exact copy of the employee's hard disk.
Which of the following should the administrator use?
A. dd
B. chmod
C. dnsenum
D. logger
THIS IS THE ORDER AS FOLLOWS:
ssh-keygen -t rsa
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server
chmod 644 ~/.ssh/id_rsa
ssh root@server - CORRECT ANSWER DRAG AND DROP SIMULATION (SEE IMAGE)
Firewall 1:DNS Rule "" ANY --> ANY --> DNS --> PERMIT
HTTPS Outbound "" 10.0.0.1/24 --> ANY --> HTTPS --> PERMIT
Management "" ANY --> ANY --> SSH --> PERMIT
HTTPS Inbound "" ANY --> ANY --> HTTPS --> PERMIT
HTTP Inbound "" ANY --> ANY --> HTTP --> DENY
Firewall 2: No changes should be made to this firewall
Firewall 3:DNS Rule "" ANY --> ANY --> DNS --> PERMIT
HTTPS Outbound "" 192.168.0.1/24 --> ANY --> HTTPS --> PERMIT
Management "" ANY --> ANY --> SSH --> PERMIT
HTTPS Inbound "" ANY --> ANY --> HTTPS --> PERMIT
HTTP Inbound "" ANY --> ANY --> HTTP --> DENY - CORRECT ANSWER DROP
DOWN SIMULATION (SEE IMAGE)
See IMAGE - CORRECT ANSWER DRAG AND DROP SIMULATION (SEE ANSWERS
IN IMAGE)
DF - CORRECT ANSWER Which of the following will MOST likely adversely impact the
operations of unpatched traditional programmable-logic controllers, running a back-end
LAMP server and OT systems with human-management interfaces that are accessible over the
Internet via a web interface? (Choose two.)
A. Cross-site scripting
B. Data exfiltration
C. Poor system logging
D. Weak encryption
E. SQL injection
F. Server-side request forgery
,A - CORRECT ANSWER A company recently transitioned to a strictly BYOD culture due to
the cost of replacing lost or damaged corporate-owned mobile devices.
Which of the following technologies would be BEST to balance the BYOD culture while also
protecting the company's data?
A. Containerization
B. Geofencing
C. Full-disk encryption
D. Remote wipe
D - CORRECT ANSWER A Chief Security Office's (CSO's) key priorities are to improve
preparation, response, and recovery practices to minimize system downtime and enhance
organizational resilience to ransomware attacks.
Which of the following would BEST meet the CSO's objectives?
A. Use email-filtering software and centralized account management, patch high-risk systems,
and restrict administration privileges on fileshares.
B. Purchase cyber insurance from a reputable provider to reduce expenses during an incident.
C. Invest in end-user awareness training to change the long-term culture and behavior of staff
and executives, reducing the organization's susceptibility to phishing attacks.
D. Implement application whitelisting and centralized event-log management, and perform
regular testing and validation of full backups.
AC - CORRECT ANSWER A network engineer has been asked to investigate why several
wireless barcode scanners and wireless computers in a warehouse have intermittent
connectivity to the shipping server. The barcode scanners and computers are all on forklift
trucks and move around the warehouse during their regular use.
Which of the following should the engineer do to determine the issue? (Choose two.)
A. Perform a site survey
B. Deploy an FTK Imager
C. Create a heat map
D. Scan for rogue access points
E. Upgrade the security protocols
F. Install a captive portal
C - CORRECT ANSWER Which of the following is MOST likely to outline the roles and
responsibilities of data controllers and data processors?
A. SSAE SOC 2
B. PCI DSS
,C. GDPR
D. ISO 31000
C - CORRECT ANSWER Phishing and spear-phishing attacks have been occurring more
frequently against a company's staff.
Which of the following would MOST likely help mitigate this issue?
A. DNSSEC and DMARC
B. DNS query logging
C. Exact mail exchanger records in the DNS
D. The addition of DNS conditional forwarders
EF - CORRECT ANSWER On which of the following is the live acquisition of data for
forensic analysis MOST dependent? (Choose two.)
A. Data accessibility
B. Legal hold
C. Cryptographic or hash algorithm
D. Data retention legislation
E. Value and volatility of data
F. Right-to-audit clauses
B - CORRECT ANSWER Which of the following incident response steps involves actions to
protect critical systems while maintaining business operations?
A. Investigation
B. Containment
C. Recovery
D. Lessons learned
B - CORRECT ANSWER A security auditor is reviewing vulnerability scan data provided by
an internal security team.
Which of the following BEST indicates that valid credentials were used?
A. The scan results show open ports, protocols, and services exposed on the target host
B. The scan enumerated software versions of installed programs
C. The scan produced a list of vulnerabilities on the target host
D. The scan identified expired SSL certificates
B - CORRECT ANSWER Which of the following BEST explains the difference between a data
owner and a data custodian?
A. The data owner is responsible for adhering to the rules for using the data, while the data
custodian is responsible for determining the corporate governance regarding the data
, B. The data owner is responsible for determining how the data may be used, while the data
custodian is responsible for implementing the protection to the data
C. The data owner is responsible for controlling the data, while the data custodian is
responsible for maintaining the chain of custody when handling the data
D. The data owner grants the technical permissions for data access, while the data custodian
maintains the database access controls to the data
D - CORRECT ANSWER A network engineer needs to build a solution that will allow guests
at the company's headquarters to access the Internet via WiFi. This solution should not allow
access to the internal corporate network, but it should require guests to sign off on the
acceptable use policy before accessing the Internet.
Which of the following should the engineer employ to meet these requirements?
A. Implement open PSK on the APs
B. Deploy a WAF
C. Configure WIPS on the APs
D. Install a captive portal
D - CORRECT ANSWER Based on the analyst's findings, which of the following attacks is
being executed?
A. Credential harvesting
B. Keylogger
C. Brute-force
D. Spraying
C - CORRECT ANSWER Which of the following cloud models provides clients with servers,
storage, and networks but nothing else?
A. SaaS
B. PaaS
C. IaaS
D. DaaS
AB - CORRECT ANSWER A network administrator needs to build out a new datacenter, with
a focus on resiliency and uptime.
Which of the following would BEST meet this objective?(Choose two.)
A. Dual power supply
B. Off-site backups
C. Automatic OS upgrades
D. NIC teaming
E. Scheduled penetration testing
F. Network-attached storage
