SY0-601 Free Practice Test

- (Exam Topic 5)
Which of the following should a technician consider when selecting an encryption method for data that needs to remain confidential for a specific length of time?

1. A. The key length of the encryption algorithm
2. B. The encryption algorithm's longevity
3. C. A method of introducing entropy into key calculations
4. D. The computational overhead of calculating the encryption key

Correct Answer: B

- (Exam Topic 3)
An organization needs to implement more stringent controls over administrator/root credentials and service
accounts. Requirements for the project include: Check-in/checkout of credentials
The ability to use but not know the password Automated password changes
Logging of access to credentials
Which of the following solutions would meet the requirements?

1. A. OAuth 2.0
2. B. Secure Enclave
3. C. A privileged access management system
4. D. An OpenID Connect authentication system

Correct Answer: D

- (Exam Topic 3)
The process of passively gathering information poor to launching a cyberattack is called:

1. A. tailgating
2. B. reconnaissance
3. C. pharming
4. D. prepending

Correct Answer: B

- (Exam Topic 3)
A security analyst is investigating an incident to determine what an attacker was able to do on a compromised laptop. The analyst reviews the following SIEM log:

Which of the following describes the method that was used to compromise the laptop?

1. A. An attacker was able to move laterally from PC1 to PC2 using a pass-the-hash attack
2. B. An attacker was able to bypass application whitelisting by emailing a spreadsheet attachment with an embedded PowerShell in the file
3. C. An attacker was able to install malware to the CAasdf234 folder and use it to gam administrator nights and launch Outlook
4. D. An attacker was able to phish user credentials successfully from an Outlook user profile

Correct Answer: A

- (Exam Topic 6)
A company owns a public-facing e-commerce website. The company outsources credit card transactions to a payment company. Which of the following BEST describes the role of the payment company?

1. A. Data controller
2. B. Data custodian
3. C. Data owners
4. D. Data processor

Correct Answer: D
A data processor is an organization that processes personal data on behalf of a data controller. In this scenario, the company that owns the e-commerce website is the data controller, as it determines the purposes and means of processing personal data (e.g. credit card information). The payment company is a data processor, as it processes personal data on behalf of the e-commerce company (i.e. it processes credit card transactions).
Reference: CompTIA Security+ Study Guide (SY0-601) 7th Edition by Emmett Dulaney, Chuck Easttom