Exam Z syo-601 2023

An analyst identified the following Input in the username field on a Web Server admin or 1=1. What attack + Mitigation

A biometric system must prioritize customer satisfaction even if this allows unauthorized entry. What is BEST?

What BEST allows a CISO to categorize an ERP system, select the controls that apply to the system & test the controls?

A data controller must ensure a data protection officer is employed to mitigate the risks of EU customers stored PII.

A bank needs to store its customer data in a cloud but must ensure the data remains encrypted whilst in use. What is it?

A technician must block access to network servers & appliances that use un-secure protocols What port should be blocked?

We must find a solution that can detect unauthorized execution privileges from the OS in both binary & data files?

An engineer must create a network segment that can be used for servers that require connections from untrusted networks?

What type of attacks is being attempted <script>alert('test message')</script> & how can it be mitigated?

What would BEST protect a company's Internal wireless network against visitors accessing company resources?

What would be the BEST preventative control to stop the theft of computing equipment on a University Campus?

What BEST allows a security analyst to quickly alert the SOC if a previously identified security event is re-occurring?

A company currently uses passwords for authentication, they need a 2nd Factor, but do not allow smartphones deskside.

What can be used by software developers to ensure compiled code modules can be trusted by their customers?

A CISO needs a solution to centrally manage the infrastructure & reduce the need to constantly upgrade user computers?

A SIEM alert results in an IP address being blocked on the network. The IP actually belongs to the Vulnerability scanner

Which of the following would produce the closest experience of responding to an actual incident response scenario?

Many privileged accounts are suspected of being compromised by suspicious logins from unfamiliar geographic locations?

Attacker targets a user to take control of a computer system. They have obtained sensitive corporate IP & PII records?

What documents the Tactics, Techniques, and Protocols a threat actor has used in previous campaigns?

When we track an Adversary by noting its attack & techniques based on its Capabilities, Infrastructure & Victims?

What should be performed as a FIRST step before implementing a BCP?

Users who travel need their accounts protected without the risk of blocking genuine login requests , what is BEST?

A solution that ensures customers receive the best performance & helps maintain session persistence?

What BEST describes a biometric FAR?

Which of the following is a risk that is specifically associated with hosting applications in the public cloud?

What best prevents a stolen password database being cracked using an off-line rainbow table attack?

What allows a pen tester to discover systems on a network, before performing lateral movement through the network?

what is MOST effective to identify a rapidly growing attack that is affecting a large number of organizations?

A Security Operations Center is currently being outsourced. Which of the following is being used?

A policy to ensure a senior manager cannot award contracts to a favoured business associate?

What type of attacks is being attempted http://comptia.org/../../etc/passwd & how can it be mitigated?

What allows incident response actions to be automated, using decision points & actions based on predefined playbooks?

A user sees a warning message stating that a payment card number was found in a file, & the file upload was blocked?

Which of the following would offer the BEST guidance regarding common web-application vulnerabilities?

An attacker has determined the best way to impact operations is to infiltrate third-party software vendors. What attack?

Security logs show abnormal external connections for over 6 months from a SQL server. Anti-malware has not detected this

Which of the following data types should be classified as intellectual property?

A company stores many data types, including PII, PHI & IP. What allows different DLP rules to be assigned to the data?

What type of attacks is being attempted user=foo AND '1=1' & how can it be mitigated?

Why would a security manager run Nessus scans across the network after every maintenance window?

An agreement that ensures two companies are commited to achieve a common goal?

a company employee accessed customer records & adjusted the direct deposit information to their personal bank account?

An agreement that ensures a company will receive guarenteed levels of performance from a service provider