あなたを合格させるCompTIA Security+ SY0-601試験問題集で2024年01月13日には603問あります
SY0-601無料試験学習ガイド！（更新された603問あります)
CompTIA SY0-601、またはCompTIA Security+認定試験は、エントリーレベルのサイバーセキュリティプロフェッショナルに必要なスキルと知識を認定する、世界的に認知された資格です。認定試験には、ネットワークセキュリティ、コンプライアンスおよびオペレーショナルセキュリティ、脅威および脆弱性、アプリケーション、データおよびホストセキュリティ、アクセス制御およびアイデンティティ管理、暗号化など、広範囲にわたるセキュリティトピックが含まれます。
質問 # 95
A Chief Security Officer (CSO) has asked a technician to devise a solution that can detect unauthorized execution privileges from the OS in both executable and data files, and can work in conjunction with proxies or UTM.
Which of the following would BEST meet the CSO's requirements?
- A. Code review
- B. Fuzzing
- C. Static code analysis
- D. Sandboxing
正解：B
質問 # 96
A database administrator wants to grant access to an application that will be reading and writing data to a database. The database is shared by other applications also used by the finance department Which of the following account types Is MOST appropriate for this purpose?
- A. Admin
- B. Shared
- C. Generic
- D. Service
正解：C
質問 # 97
A security analyst is reviewing web-application logs and finds the following log:
Which of the following attacks is being observed?
- A. CSRF
- B. Directory traversal
- C. On-path attack
- D. XSS
正解：B
質問 # 98
A security analyst is currently addressing an active cyber incident. The analyst has been able to identify affected devices that are running a malicious application with a unique hash. Which of the following is the next step according to the incident response process?
- A. Containment
- B. Recovery
- C. Lessons learned
- D. Preparation
正解：A
解説：
Containment is the next step according to the incident response process after identifying affected devices that are running a malicious application with a unique hash. Containment involves isolating the compromised devices or systems from the rest of the network to prevent the spread of the attack and limit its impact. Containment can be done by disconnecting the devices from the network, blocking network traffic to or from them, or applying firewall rules or access control lists. Containment is a critical step in incident response because it helps to preserve evidence for further analysis and remediation, and reduces the risk of data loss or exfiltration
https://www.fortinet.com/resources/cyberglossary/incident-response
https://www.ibm.com/topics/incident-response
質問 # 99
An organization is concerned that ils hosted web servers are not running the most updated version of the software. Which of the following would work best to help identify potential vulnerabilities?
- A. nc -1 -v comptia.crg -p 80
- B. nmap comptia.org -p 80 -sv
- C. nslookup -port-80 comptia.org
- D. hping3 -S compcia.org -p 80
正解：B
解説：
Explanation
nmap is a network scanning tool that can perform various tasks such as port scanning, service detection, version detection, OS detection, vulnerability scanning, etc... nmap comptia.org -p 80 -sv is a command that scans port 80 (the default port for HTTP) on comptia.org domain name and tries to identify the service name and version running on that port. This can help identify potential vulnerabilities in the web server software by comparing the version with known exploits or patches.
質問 # 100
During an incident a company CIRT determine it is necessary to observe the continued network-based transaction between a callback domain and the malware running on an enterprise PC. Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?
- A. Emulate the malware in a heavily monitored DM Z segment.
- B. Create and apply micro segmentation rules.
- C. Physical move the PC to a separate internet pint of presence
- D. Apply network blacklisting rules for the adversary domain
正解：A
解説：
To observe the continued network-based transaction between a callback domain and the malware running on an enterprise PC while reducing the risk of lateral spread and the risk that the adversary would notice any changes, the best technique to use is to emulate the malware in a heavily monitored DMZ segment. This is a secure environment that is isolated from the rest of the network and can be heavily monitored to detect any suspicious activity. By emulating the malware in this environment, the activity can be observed without the risk of lateral spread or detection by the adversary. Reference: https://www.sans.org/blog/incident-response-fundamentals-why-is-the-dmz-so-important/
質問 # 101
A security analyst is reviewing the output of a web server log and notices a particular account is attempting to transfer large amounts of money:
GET http://yourbank.com/transfer.do?acctnum=087646959&amount=500000 HTTP/1.1
GET http://yourbank.com/transfer.do?acctnum=087646958&amount=5000000 HTTP/1.1
GET http://yourbank.com/transfer.do?acctnum=-087646958&amount=1000000 HTTP/1.1
GET http://yourbank.com/transfer.do?acctnum=087646953&amount=500 HTTP/1.1
Which of the following types of attacks is most likely being conducted?
- A. CSRF
- B. Spear phishing
- C. SQLi
- D. API
正解：A
解説：
Explanation
CSRF stands for Cross-Site Request Forgery, which is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated1. In this case, the attacker may have tricked the user into clicking a malicious link or visiting a malicious website that sends forged requests to the web server of the bank, using the user's session cookie or other credentials. The web server then performs the money transfer requests as if they were initiated by the user, without verifying the origin or validity of the requests.
A). SQLi. This is not the correct answer, because SQLi stands for SQL Injection, which is an attack that exploits a vulnerability in a web application's database layer, where malicious SQL statements are inserted into an entry field for execution2. The output of the web server log does not show any SQL statements or commands.
B). CSRF. This is the correct answer, because CSRF is an attack that exploits the trust a web server has in a user's browser, where malicious requests are sent to the web server using the user's credentials1. The output of the web server log shows multiple GET requests with different account numbers and amounts, which may indicate a CSRF attack.
C). Spear phishing. This is not the correct answer, because spear phishing is an attack that targets a specific individual or organization with a personalized email or message that contains a malicious link or attachment3.
The output of the web server log does not show any email or message content or headers.
D). API. This is not the correct answer, because API stands for Application Programming Interface, which is a set of rules and specifications that allow software components to communicate and exchange data. API is not an attack method, but rather a way of designing and developing software applications.
質問 # 102
A company is looking to migrate some servers to the cloud to minimize its technology footprint The company has a customer relationship management system on premises Which of the following solutions will require the least infrastructure and application support from the company?
- A. PaaS
- B. SaaS
- C. IaaS
- D. SDN
正解：B
解説：
Explanation
SaaS stands for Software as a Service and is a cloud computing model that delivers software solutions from a third party over the internet. SaaS requires the least infrastructure and application support from the company because it eliminates the need to install, manage, update, or maintain any software or hardware on-premises.
The company can simply access the customer relationship management system as a SaaS application through a web browser or an API, without worrying about the underlying infrastructure, platform, or network. The SaaS provider is responsible for managing all aspects of the software delivery and performance
質問 # 103
A junior security analyst is reviewing web server logs and identifies the following pattern in the log file:
Which ol the following types of attacks is being attempted and how can it be mitigated?
- A. CSRF. implement an IPS
- B. XSS. mplement a SIEM
- C. SQL infection, mplement an IDS
- D. Directory traversal implement a WAF
正解：D
解説：
Explanation
Detailed Explanation: The attack being attempted is directory traversal, which is a web application attack that allows an attacker to access files and directories outside of the web root directory. A WAF can help mitigate this attack by detecting and blocking attempts to access files outside of the web root directory.
References: CompTIA Security+ Study Guide: Exam SY0-601, Chapter 4: Securing Application Development and Deployment, p. 191
質問 # 104
During an investigation, a security manager receives notification from local authorities mat company proprietary data was found on a former employees home computer, The former employee's corporate workstation has since been repurposed, and the data on the hard drive has been overwritten Which of the following would BEST provide the security manager with enough details to determine when the data was removed from the company network?
- A. Properly congured endpoint security tool with darting
- B. Properly congured SIEM with retention policies
- C. Properly congured hosts with security logging
- D. Properly congured USB blocker with encryption
正解：C
質問 # 105
A security researcher has aferted an organuzation that its sensifive user data was found for sale on a website.
Which af the followang should the organzabon use to inform the affected partes?
- A. A communications plan
- B. A business continuity plan
- C. A An incident response plan
- D. A disaster recovery plan
正解：C
質問 # 106
A malware attack has corrupted 30TB of company data across all file servers A systems administrator Identifies the malware and contains the Issue, but the data Is unrecoverable. The administrator Is not concerned about the data loss because the company has a system in place that will allow users to access the data that was backed up last night. Which of the following resiliency techniques did the administrator MOST likely use to prevent impacts to business operations after an attack?
- A. Replication
- B. Cloud storage
- C. RAID
- D. Tape backups
正解：C
質問 # 107
A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM. The analyst first looks at the domain controller and finds the following events:
To better understand what is going on, the analyst runs a command and receives the following output:
Based on the analyst's findings, which of the following attacks is being executed?
- A. Spraying
- B. Brute-force
- C. Credential harvesting
- D. Keylogger
正解：A
解説：
Explanation
Brute forcing focuses intensively on one account with every computable password attempt, whereas spraying simply attempts a few or several passwords on an account before moving on.
質問 # 108
A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL. Which of the following is needed to meet the objective?
- A. Load-balanced servers
- B. A decryption certificate
- C. A reverse proxy
- D. A split-tunnel VPN
正解：B
解説：
A Web Application Firewall (WAF) is a security solution that protects web applications from various types of attacks such as SQL injection, cross-site scripting (XSS), and others. It is typically deployed in front of web servers to inspect incoming traffic and filter out malicious requests.
To protect the company's website from malicious web requests over SSL, a decryption certificate is needed to decrypt the SSL traffic before it reaches the WAF. This allows the WAF to inspect the traffic and filter out malicious requests.
質問 # 109
Which of the following actions would be recommended to improve an incident response process?
- A. Contact the authorities if a cybercrime is suspected
- B. Modify access so the IT team has full access to the compromised assets
- C. Train the team to identify the difference between events and incidents
- D. Restrict communication surrounding the response to the IT team
正解：C
質問 # 110
While performing a threat-hunting exercise, a security analyst sees some unusual behavior occurring in an application when a user changes the display name. The security analyst decides to perform a static code analysis and receives the following pseudocode:
Which of the following attack types best describes the root cause of the unusual behavior?
- A. Buffer overflow
- B. Improper error handling
- C. Server-side request forgery
- D. SQL injection
正解：D
解説：
Explanation
SQL injection is one of the most common web hacking techniques. SQL injection is the placement of malicious code in SQL statements, via web page input12. A SQL injection attack consists of insertion or
"injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system3.
According to the pseudocode given in the question, the application takes a user input for display name and concatenates it with a SQL query to update the user's profile. This is a vulnerable practice that allows an attacker to inject malicious SQL code into the query and execute it on the database. For example, an attacker could enter something like this as their display name:
John'; DROP TABLE users; --
This would result in the following SQL query being executed:
UPDATE profile SET displayname = 'John'; DROP TABLE users; --' WHERE userid = 1; The semicolon (;) terminates the original update statement and starts a new one that drops the users table. The double dash (-) comments out the rest of the query. This would cause a catastrophic loss of data for the application.
質問 # 111
A security analyst has been asked to investigate a situation after the SOC started to receive alerts from the SIEM. The analyst first looks at the domain controller and finds the following events:
To better understand what is going on, the analyst runs a command and receives the following output:
Based on the analyst's findings, which of the following attacks is being executed?
- A. Spraying
- B. Brute-force
- C. Credential harvesting
- D. Keylogger
正解：A
質問 # 112
A company suspects that some corporate accounts were compromised. The number of suspicious logins from locations not recognized by the users is increasing Employees who travel need their accounts protected without the nsk of blocking legitimate login requests that may be made over new sign-in properties. Which of the following security controls can be implemented?
- A. Enforce MFA when an account request reaches a nsk threshold
- B. Implement geofencing to only allow access from headquarters
- C. Enforce time-based login requests that align with business hours
- D. Shift the access control scheme to a discretionary access control
正解：B
質問 # 113
An organization's corporate offices were destroyed due to a natural disaster, so the organization is now setting up offices in a temporary work space. Which of the following will the organization most likely consult?
- A. The incident response plan
- B. The risk management plan
- C. The communication plan
- D. The business continuity plan
正解：D
解説：
Explanation
A business continuity plan is a document or a process that outlines how an organization can continue its critical operations and functions in the event of a disruption or disaster. It can include strategies and procedures for recovering or relocating resources, personnel, data, etc., to ensure minimal downtime and impact. The organization will most likely consult the business continuity plan when setting up offices in a temporary work space after its corporate offices were destroyed due to a natural disaster.
質問 # 114
A cybersecurity analyst needs to implement secure authentication to third-party websites without users' passwords. Which of the following would be the BEST way to achieve this objective?
- A. SAML
- B. PAP
- C. OAuth
- D. SSO
正解：C
質問 # 115
A security analyst needs to implement an MDM solution for BYOD users that will allow the company to retain control over company emails residing on the devices and limit data exfiltration that might occur if the devices are lost or stolen.Which of the following would BEST meet these requirements? (Select TWO).
- A. Application whitelisting
- B. Full-device encryption
- C. Remote control
- D. Containerization
- E. Geofencing
- F. Network usage rules
正解：B、F
解説：
MDM solutions emerged to solve problems created by BYOD. With MDM, IT teams can remotely wipe devices clean if they are lost or stolen. MDM also makes the life of an IT administrator a lot easier as it allows them to enforce corporate policies, apply software updates, and even ensure that password protection is used on each device. Containerization and application whitelisting are two features of MDM that can help retain control over company emails residing on the devices and limit data exfiltration that might occur if the devices are lost or stolen.
Containerization is a technique that creates a separate and secure space on the device for work-related data and applications. This way, personal and corporate data are isolated from each other, and IT admins can manage only the work container without affecting the user's privacy. Containerization also allows IT admins to remotely wipe only the work container if needed, leaving the personal data intact.
Application whitelisting is a technique that allows only authorized applications to run on the device. This way, IT admins can prevent users from installing or using malicious or unapproved applications that might compromise the security of corporate data. Application whitelisting also allows IT admins to control which applications can access corporate resources, such as email servers or cloud storage.
質問 # 116
Which of the following controls is used to make an organization initially aware of a data compromise?
- A. Protective
- B. Detective
- C. Preventative
- D. Corrective
正解：C
解説：
https://purplesec.us/security-controls/
質問 # 117
A company is concerned about individuals dnvmg a car into the building to gam access Which of the following security controls would work BEST to prevent this from happening?
- A. Bollard
- B. Camera
- C. Signage
- D. Alarms
- E. Access control vestibule
正解：A
解説：
Explanation
A bollard would work best to prevent individuals from driving a car into the building. A bollard is a short, vertical post that can be used to block vehicles from entering a designated area. It is specifically designed to stop cars from crashing into buildings or other structures.
質問 # 118
A company completed a vulnerability scan. The scan found malware on several systems that were running older versions of Windows. Which of the following is MOST likely the cause of the malware infection?
- A. Improper or weak patch management
- B. Unsecure root accounts
- C. Default settings
- D. Open permissions
正解：A
解説：
The reason for this is that older versions of Windows may have known vulnerabilities that have been patched in more recent versions. If a company is not regularly patching their systems, they are leaving those vulnerabilities open to exploit, which can allow malware to infect the systems.
It is important to regularly update and patch systems to address known vulnerabilities and protect against potential malware infections. This is an important aspect of proper security management.
Here is a reference to the CompTIA Security+ certification guide which states that "Properly configuring and maintaining software, including patch management, is critical to protecting systems and data."
質問 # 119
......
SY0-601問題集はCompTIA Security+認証済み試験問題と解答：https://www.passtest.jp/CompTIA/SY0-601-shiken.html
実際に出ると確認されたSY0-601試験問題集と解答でSY0-601無料更新：https://drive.google.com/open?id=1nSr2SmFI3AJPDeKGpkWoHEY2YeTrhJj4