CompTIA Security+ SY0-601 Practice 2021/2022 Questions and Answers
608 views 0 purchase
Course
CompTIA Security+ SY0-601
Institution
CompTIA Security+ SY0-601
The user installed Trojan horse malware. Correct answer- A user used an administrator
account to download and install a software application. After the user launched the .exe
extension installer file, the user experienced frequent crashes, slow computer
performance, and strange services running ...
comptia security sy0 601 practice questions and answers
the user installed trojan horse malware
pup potentially unwanted program
Written for
CompTIA Security+ SY0-601
All documents for this subject (129)
Seller
Follow
EvaTee
Reviews received
Content preview
CompTIA Security+ SY0-601 Practice
Questions and Answers
The user installed Trojan horse malware. Correct answer- A user used an administrator
account to download and install a software application. After the user launched the .exe
extension installer file, the user experienced frequent crashes, slow computer
performance, and strange services running when turning on the computer. What most
likely happened to cause these issues?
A worm Correct answer- A security operations center (SOC) analyst investigates the
propagation of a memory-resident virus across the network and notices a rapid
consumption of network bandwidth, causing a Denial of Service (DoS). What type of
virus is this?
PUP (potentially unwanted program) Correct answer- A user purchased a laptop from a
local computer shop. After powering on the laptop for the first time, the user noticed a
few programs like Norton Antivirus asking for permission to install. How would an IT
security specialist classify these programs?
-Uses lightweight shellcode
-Uses low observable characteristic attacks Correct answer- A fileless malicious
software can replicate between processes in memory on a local host or over network
shares. What other behaviors and techniques would classify malware as fileless rather
than a normal virus? (Select all that apply.)
-Computer Bots,
-Command & Control Correct answer- An attacker is planning to set up a backdoor that
will infect a set of specific computers at an organization, to inflict a set of other intrusion
attacks remotely. Which of the following will support the attackers' plan? (Select all that
apply.)
-Launch a Distributed Denial of Service (DDoS) attack
-Establish a connection with a Command and Control server
-Launch a mass-mail spam attack Correct answer- If a user's computer becomes
infected with a botnet, which of the following can this compromise allow the attacker to
do? (Select all that apply.)
Have up-to-date backups. Correct answer- If a user's device becomes infected with
crypto-malware, which of the following is the best way to mitigate this compromise?
,A logic bomb Correct answer- A security specialist discovers a malicious script on a
computer. The script is set to execute if the administrator's account becomes disabled.
What type of malware did the specialist discover?
Spyware infected the computers. Correct answer- End-users at an organization contact
the cybersecurity department. After downloading a file, they are being redirected to
shopping websites they did not intend to navigate to, and built-in webcams turn on. The
security team confirms the issue as malicious, and notes modified DNS (Domain Name
System) queries that go to nefarious websites hosting malware. What most likely
happened to the users' computers?
A Remote Access Trojan (RAT) Correct answer- An attacker installs Trojan malware
that can execute remote backdoor commands, such as the ability to upload files and
install software to a victim PC. What type of Trojan malware is this?
Password spraying attack Correct answer- A hacker is trying to gain remote access to a
company computer by trying brute force password attacks using a few common
passwords in conjunction with multiple usernames. What specific type of password
attack is the hacker most likely performing?
-A rainbow table
-A dictionary word Correct answer- An attacker can exploit a weakness in a password
protocol to calculate the hash of a password. Which of the following can the attacker
match the hash to, as a means to obtain the password? (Select all that apply.)
A rainbow table attack Correct answer- Which of the following attacks do security
professionals expose themselves to, if they do not salt passwords with a random value?
Clone it. Correct answer- How can an attacker make unauthorized use of acquired user
and account details from a user's smart card?
Skimming Correct answer- What type of attack is occurring when a counterfeit card
reader is in use?
Cross-site scripting (XSS) Correct answer- An attacker discovered an input validation
vulnerability on a website, crafted a URL with additional HTML code, and emailed the
link to a victim. The victim unknowingly defaced (vandalized) the web site after clicking
on the malicious URL. No other malicious operations occurred outside of the web
application's root directory. This scenario is describing which type of attack?
DLL injection Correct answer- An attacker escalated privileges to a local administrator
and used code refactoring to evade antivirus detection. The attacker then allowed one
process to attach to another and forced the operating system to load a malicious binary
package. What did the attacker successfully perform?
, LDAP injection Correct answer- Using an open connection to a small company's
network, an attacker submitted arbitrary queries on port 389 to the domain controllers.
The attacker initiated the query from a client computer. What type of injection attack did
the attacker perform?
A malicious process can alter the execution environment to create a null pointer, and
crash the program. Correct answer- How can the lack of logic statement tests on
memory location variables be detrimental to software in development?
A buffer overflow Correct answer- An attacker gained remote access to a user's
computer by exploiting a vulnerability in a piece of software on the device. The attacker
sent data that was able to manipulate the memory size that the application reserved to
store expected data. Which vulnerability exploit resulted from the attacker's actions?
Race condition Correct answer- Developers found a "time of check to time of use"
(TOCTTOU) vulnerability in their application. The vulnerability made it possible to
change temporary data created within the app before the app uses the data later. This
vulnerability is taking advantage of what process in the application?
Revealing database server configuration Correct answer- A web application's code
prevents the output of any type of information when an error occurs during a request.
The development team cited security reasons as to why they developed the application
in this way. What sort of security issues did the team have concerns about in this case?
Replay attack Correct answer- An intruder monitors an admin's unsecure connection to
a server and finds some required data, like a cookie file, that legitimately establishes a
session with a web server. Knowing the admin's logon credentials, what type of attack
can the intruder perform with the cookie file?
Server-side request forgery Correct answer- An attacker submitted a modified uniform
resource locator (URL) link to a website that eventually established connections to
back-end databases and exposed internal service configurations. The attacker did not
hijack a user to perform this attack. This describes which of the following types of
attacks?
Cross-site Request Forgery (XSRF) Correct answer- An attacker modified the HTML
code of a legitimate password-change web form, then hosted the .html file on the
attacker's web server. The attacker then emailed a URL link of the hosted file to a real
user of the web page. Once the user clicked the link, it changed the user's password to
a value the attacker set. Based on this information, what type of attack is the website
vulnerable to?
-Key discovery
-Improper error handling Correct answer- The latest web application, using default
settings, is currently accepting application programming interface (API) calls over
HyperText Transfer Protocol (HTTP). The environment has a moderate key
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller EvaTee. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $9.49. You're not tied to anything after your purchase.
