Test SYS-601

Question 1

Scalability (Scaling out)

Answer 1

-Scalability is the capacity to increase resources to meet demand within similar cost ratios. Scaling out adds more resources in parallel to a system. Adding an additional CPU is an example of scaling out.

-Scalability means that if service demand doubles, costs do not more than double. Adding more resources such as RAM is an example of scaling out.

Question 2

Scalability (Scaling Up)

Answer 2

-Giving important processes higher priority in a system is not scaling out, but more so scaling up. Scaling up is done by increasing existing resources.

-Freeing up CPU resources in a system by eliminating services is not scaling out, but more so scaling up. Scaling up is done by increasing existing resources.

Question 3

What is the file
%SystemRoot%\System32\Drivers\etc\hosts
responsible for?

Answer 3

the file responsible for mapping IP addresses to domain names in Windows. It does not store passwords. The HOSTS file existed long before Domain Name System (DNS), and while all name resolution now functions through DNS, the HOSTS file is still present, and most operating systems check it before using DNS.

Question 4

%SystemRoot%\System32\config\SAM

Answer 4

is where local users and passwords are stored as part of the Registry (Security Account Manager) on Windows machines.

Question 5

/etc/passwd

Answer 5

• is where user account details and encrypted passwords are stored on Linux (on older systems), but this file is universally accessible.

-Consequently, passwords are moved to /etc/shadow, which is only readable by the root user on Linux.

Question 6

What does the ARP cache show

Answer 6

The ARP cache shows the MAC address of the interface associated with each IP address the local host has communicated with recently.

Question 7

What does ipconfig show

Answer 7

-Windows ipconfig shows the configuration assigned to network interface(s), including the hardware or media access control (MAC) address, IPv4 and IPv6 addresses.
-ipconfig shows whether the IP address is static or assigned by DHCP. If the address is DHCP-assigned, the output also shows the address of the DHCP server that provided the lease.

Question 8

What is Ping used for

Answer 8

The admin can use the ping command to probe a host on a particular IP address or host name using the Internet Control Message Protocol (ICMP).

Question 9

What does asymmetric encryption proves

Answer 9

Asymmetric encryption is ideal for proving identity, but it requires significant computing overhead and is inefficient for bulk encryption.

Question 10

What are the drawback’s of asymmetric encryption

Answer 10

The drawback of asymmetric encryption is that it involves substantial computing overhead compared to symmetric encryption.

Question 11

Symmetric encryption

Answer 11

Symmetric encryption is very fast. It is used for bulk encryption of large amounts of data. The main problem is secure key distribution and storage.

Question 12

Stream cipher

Answer 12

In a stream cipher, each byte or bit of data in the plaintext is encrypted one at a time. This is suitable for encrypting communications where the total length of the message is not known.

Question 13

Endpoint detection and response (EDR)

Answer 13

the product is to provide real-time and historical visibility into the compromise, contain the malware within a single host, and facilitate remediation of the host to its original state.

aims to provide enhanced protection, visibility, and control over endpoints

Question 14

Next-generation endpoint

Answer 14

Next generation endpoint agents use cloud management, rather than reporting to an on-remises server;
Next-generation endpoint detection systems use artificial intelligence (AI) and machine learning to perform user and entity behavior analysis (UEBA)

Question 15

What does Ba seline deviation reporting mean?

Answer 15

it means testing the actual configuration of hosts to ensure that their configuration settings match the baseline template.

Question 16

The 6 steps of incident response in order

Answer 16

1. Preparation
   2.Identification
   3.Containment
   4.Eradication
   5.Recover
   6.Lessons Learned

Page 3. of Emmanuel notes

Question 17

What is the goal of the containment stage

Answer 17

The goal of the containment stage is to secure data while limiting the immediate impact on customers and business partners

Question 18

What is the purpose of identification (Incident response)

Answer 18

Based on an alert or report, identification determines whether an incident has taken place, how severe it might be (triage), and notifies stakeholders.

Question 19

What happens during Eradication? (Incident response)

Answer 19

Once the security admin contains the incident, eradication removes the cause and restores the affected system to a secure state.

Question 20

What does the recovery stage consist of? (Incident response)

Answer 20

This recovery phase may involve restoration of data from backup and security testing.

Question 21

How can a company install a virtual machine on a bare metal virtual platform?

Answer 21

A bare metal virtual platform means that a type 1 hypervisor is installed directly onto a host machine and manages access to the host hardware directly without going through a host Operating System (OS) like Windows Server.

Question 22

How is VirtualDesktop Infrastructure (VDI) achieved?

Answer 22

Virtual Desktop Infrastructure (VDI) is achieved by replacing desktop computers with low specification and low power thin client computers.

Question 23

A rouge access point (AP)

Answer 23

A malicious user can set up an unauthorized (rouge) access point with something as basic as a smartphone with tethering capabilities, and non-malicious users could do so by accident.

Question 24

An access point that requires a wireless controller to function is known as a what?

Answer 24

a thin WAP

Question 25

SPAN ports?

Answer 25

With a SPAN port, the sensor attaches to a specially configured port on the switch that receives copies of frames addressed to nominated access ports (or all the other ports).

Question 26

Spectrum analyzer

Answer 26

A spectrum analyzer is a device that can detect the source of jamming (interference) on a wireless network

Question 27

What illustrates effective use of industrial camouflage as a security control?

Answer 27

Entry control measures for a secure facility begin inside a main entry point, rather than outside the building

Question 28

Tokenization

Answer 28

Tokenization replaces all or part of data in a field with a randomly generated token, which is securely stored with the original value. An authorized query or app can retrieve the original value, so tokenization is a reversible technique.

Question 29

Data masking

Answer 29

Data masking redacts all or part of a field’s contents, substituting character strings with “x” for example. Data masking is an irreversible de-identification technique.

Question 30

Data minimization

Answer 30

is the principle of only processing and storing data if that is necessary to perform the purpose for which it is collected.

Question 31

Full anonymization

Answer 31

Individual subjects can no longer be identified in a fully anonymized data set, even when combined with other data sources. This de-identification method permanently removes identifying information

Question 32

If a large data facility experienced a disaster-level event, what is the process of reconstituting its systems?

Answer 32

• The first step in the process is enabling and testing power delivery systems (grid power, power distribution units (PDUs), UPS, secondary generators, and so on).
• Secondly, the team should enable and test switch infrastructure, then routing appliances and systems.
• The third step is to enable and test network security appliances (firewalls, IDS, proxies).
• The fourth step is enabling and testing critical network servers (DHCP, DNS, NTP, and directory services).

Question 33

If a large data facility experienced a disaster-level event, what is the process of reconstituting its systems?

Answer 33

• The first step in the process is enabling and testing power delivery systems (grid power, power distribution units (PDUs), UPS, secondary generators, and so on).
• Secondly, the team should enable and test switch infrastructure, then routing appliances and systems.
• The third step is to enable and test network security appliances (firewalls, IDS, proxies).
• The fourth step is enabling and testing critical network servers (DHCP, DNS, NTP, and directory services).