Attested SY0-501 Dumps PDF Resource [2021]
Latest SY0-501 Actual Free Exam Questions Updated 715 Questions
NEW QUESTION 315
A company has migrated to two-factor authentication for accessing the corporate network, VPN, and SSO. Several legacy applications cannot support multifactor authentication and must continue to use usernames and passwords. Which of the following should be implemented to ensure the legacy applications are as secure as possible while ensuring functionality? (Choose two.)
- A. Password reuse restrictions
- B. Password recovery
- C. Account disablement
- D. Priveleged accounts
- E. Password complexity requirements
Answer: C,E
NEW QUESTION 316
A security administrator is given the security and availability profiles for servers that are being deployed.
Match each RAID type with the correct configuration and MINIMUM number of drives.
Review the server profiles and match them with the appropriate RAID type based on integrity, availability, I/O, storage requirements. Instructions:
All drive definitions can be dragged as many times as necessary
Not all placeholders may be filled in the RAID configuration boxes
If parity is required, please select the appropriate number of parity checkboxes Server profiles may be dragged only once If at any time you would like to bring back the initial state of the simulation, please select the Reset button. When you have completed the simulation, please select the Done button to submit. Once the simulation is submitted, please select the Next button to continue.
Answer:
Explanation:
Explanation:
RAID-0 is known as striping. It is not a fault tolerant solution but does improve disk performance for read/write operations. Striping requires a minimum of two disks and does not use parity.
RAID-0 can be used where performance is required over fault tolerance, such as a media streaming server.
RAID-1 is known as mirroring because the same data is written to two disks so that the two disks have identical data. This is a fault tolerant solution that halves the storage space. A minimum of two disks are used in mirroring and does not use parity. RAID-1 can be used where fault tolerance is required over performance, such as on an authentication server. RAID-5 is a fault tolerant solution that uses parity and striping. A minimum of three disks are required for RAID-5 with one disk's worth of space being used for parity information. However, the parity information is distributed across all the disks. RAID-5 can recover from a sing disk failure.
RAID-6 is a fault tolerant solution that uses dual parity and striping. A minimum of four disks are required for RAID-6. Dual parity allows RAID-6 to recover from the simultaneous failure of up to two disks. Critical data should be stored on a RAID-6 system.
http://www.adaptec.com/en-us/solutions/raid_levels.html
NEW QUESTION 317
A web application is configured to target browsers and allow access to bank accounts to siphon money to a foreign account. This is an example of which of the following attacks?
- A. Header manipulation
- B. SQL injection
- C. Flash cookie exploitation
- D. Cross-site scripting
Answer: D
NEW QUESTION 318
An audit takes place after company-wide restricting, in which several employees changed roles. The following deficiencies are found during the audit regarding access to confidential data:
Which of the following would be the BEST method to prevent similar audit findings in the future?
- A. Implement regular permission auditing and reviews.
- B. Implement separation of duties for the payroll department.
- C. Implement a DLP solution on the payroll and human resources servers.
- D. Implement rule-based access controls on the human resources server.
Answer: B
NEW QUESTION 319
A company recently installed fingerprint scanners at all entrances to increase the facility's security. The scanners were installed on Monday morning, and by the end of the week it was determined that 1.5% of valid users were denied entry. Which of the following measurements do these users fall under?
- A. FRR
- B. FAR
- C. SLA
- D. CER
Answer: A
NEW QUESTION 320
A security analyst has received several reports of an issue on an internal web application. Users state they are having to provide their credentials twice to log in. The analyst checks with the application team and notes this is not an expected behavior. After looking at several logs, the analyst decides to run some commands on the gateway and obtains the following output:
Which of the following BEST describes the attack the company is experiencing?
- A. MAC flooding
- B. ARP poisoning
- C. DNS hijacking
- D. URL redirection
Answer: B
Explanation:
Explanation
ARP Poisoning (also known as ARP Spoofing) is a type of cyber attack carried out over a Local Area Network (LAN) that involves sending malicious packets to a default gateway on a LAN in order to change the pairings in its IP to MAC address table. Protocol translates IP addresses into MAC addresses.
NEW QUESTION 321
A company offers SaaS, maintaining all customers' credentials and authenticating locally. Many large customers have requested the company offer some form of federation with their existing authentication infrastructures.
Which of the following would allow customers to manage authentication and authorizations from within their existing organizations?
- A. Implement SAML so the company's services may accept assertions from the customers' authentication servers.
- B. Use SOAP calls to support authentication between the company's product and the customers' authentication servers.
- C. Provide customers with a constrained interface to manage only their users' accounts in the company's active directory server.
- D. Provide a system for customers to replicate their users' passwords from their authentication service to the company's.
Answer: A
NEW QUESTION 322
A security analyst is diagnosing an incident in which a system was compromised from an external IP address. The socket identified on the firewall was traced to 207.46.130.0:6666.
Which of the following should the security analyst do to determine if the compromised system still has an active connection?
- A. nslookup
- B. tracert
- C. ping
- D. netstat
Answer: D
NEW QUESTION 323
Which of the following is the proper way to quantify the total monetary damage resulting from an exploited
vulnerability?
- A. Calculate the TCO
- B. Calculate the ARO
- C. Calculate the ALE
- D. Calculate the MTBF
Answer: C
NEW QUESTION 324
A member of a digital forensics team, Joe arrives at a crime scene and is preparing to collect system dat a. Before powering the system off, Joe knows that he must collect the most volatile date first.
Which of the following is the correct order in which Joe should collect the data?
- A. RAM, CPU cache. Remote logging data, paging/swap files
- B. CPU cache, paging/swap files, RAM, remote logging data
- C. Paging/swap files, CPU cache, RAM, remote logging data
- D. CPU cache, RAM, paging/swap files, remote logging data
Answer: D
NEW QUESTION 325
A forensics analyst is investigating a hard drive for evidence of suspected illegal activity. Which of the following should the analyst do FIRST?
- A. Back up the pictures directory for further inspection.
- B. Save a copy of the case number and date as a text file in the root directory.
- C. Create a hash of the hard drive.
- D. Export the Internet history.
Answer: C
Explanation:
Explanation
NEW QUESTION 326
A security analyst observes the following events in the logs of an employee workstation:
Given the information provided, which of the following MOST likely occurred on the workstation?
- A. The SIEM log agent was not tuned properly and reported a false positive.
- B. Antivirus software found and quarantined three malware files.
- C. Automatic updates were initiated but failed because they had not been approved.
- D. Application whitelisting controls blocked an exploit payload from executing.
Answer: D
NEW QUESTION 327
A security administrator is implementing a new WAF solution and has placed some of the web servers behind the WAF, with the WAF set to audit mode. When reviewing the audit logs of external requests and posts to the web servers, the administrator finds the following entry:
Based on this data, which of the following actions should the administrator take?
- A. Create an alert to generate emails for abnormally high activity.
- B. Create a blocking policy based on the parameter values
- C. Change the parameter name 'Account_Name' identified in the log.
- D. Alert the web server administrators to a misconfiguration
Answer: A
NEW QUESTION 328
Joe is exchanging encrypted email with another party. Joe encrypts the initial email with a key. When Joe receives a response, he is unable to decrypt the response with the same key he used initially.
Which of the following would explain the situation?
- A. Asymmetric encryption is being used
- B. Out-of-band key exchange has taken place
- C. An ephemeral key was used for one of the messages
- D. A stream cipher was used for the initial email; a block cipher was used for the reply
Answer: A
Explanation:
Explanation
Asymmetric algorithms use two keys to encrypt and decrypt data. These asymmetric keys are referred to as the public key and the private key. The sender uses the public key to encrypt a message, and the receiver uses the private key to decrypt the message; what one key does, the other one undoes.
NEW QUESTION 329
A company hires a consulting firm to crawl its Active Directory network with a non-domain account looking
for unpatched systems. Actively taking control of systems is out of scope, as is the creation of new
administrator accounts. For which of the following is the company hiring the consulting firm?
- A. Application fuzzing
- B. User permission auditing
- C. Vulnerability scanning
- D. Penetration testing
Answer: C
NEW QUESTION 330
Which of the following is the primary reason for implementing layered security measures in a cyber security architecture?
- A. It allows for bandwidth upgrades to be made without user disruption.
- B. it increases the number of controls required to subvert a system.
- C. It alleviates problems associated with EOL equipment replacement.
- D. It decreases the tone a CERT has to respond to a security Incident.
Answer: D
NEW QUESTION 331
A new Chief Information Officer (CIO) has been reviewing the badging procedures and decides to write a policy that all employees must have their badges rekeyed at least annually. Which of the following controls BEST describes this policy?
- A. Administrative
- B. Corrective
- C. Physical
- D. Technical
Answer: A
NEW QUESTION 332
......
Risk Management
Risk management involves a wide range of issues related to plans, procedures, and policies of organizational security. It also addresses the concepts of business analysis, risk management, incident response procedures, control types, disaster recovery, and data privacy and security issues. Within this domain, you will get to know more about agreement types, SLA, ISA, NDA, mission-essential functions, and threat assessment.
SY0-501 Certification Overview Latest SY0-501 PDF Dumps: https://www.vcetorrent.com/SY0-501-valid-vce-torrent.html