CompTIA Security+ (2020 series) practice questions

1. Question 1 of 25

   Two organizations plan to collaborate on the evaluation of new SIEM solutions for their respective companies. A combined effort from both organizations' SOC teams would speed up the effort. Which of the following can be written to document this agreement?

   • AMOU
   • BISA
   • CSLA
   • DNDA

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   MOU - Memorandum of Understanding MOA - Memorandum of Agreement A MOU is the initialization phase for two companies who plan to work together. It establishes what each company is looking to achieve/get out of the arrangement. It's not a signed contract. A MOA is a step above the MOU. It's a signed contract that indicates both parties understand and agree with the terms placed forward by both parties.

   Adapted from community discussion by Gravoc · 2022-09-18 · 32 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • nist.gov documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. G

      Gravoc

      2022-09-18

      32 upvotes

      MOU - Memorandum of Understanding MOA - Memorandum of Agreement A MOU is the initialization phase for two companies who plan to work together. It establishes what each company is looking to achieve/get out of the arrangement. It's not a signed contract. A MOA is a step above the MOU. It's a signed contract that indicates both parties understand and agree with the terms placed forward by both parties.

   2. C

      ccnaexam28

      2023-07-27

      25 upvotes

      this was on my exam. i chose A. Took the exam 27/7/2023, I scored 840 and got 82 questions in total(with 3 PBQs). (not quite sure what questions I got right or wrong, there were tons that have 50/50 percentage in this site) 90%+ is from this site and I have no contributor access though I think it's also just luck on what set you'll get from their questions' pool. good luck!

   3. S

      stoneface

      2022-09-01

      Selected A19 upvotes

      A document that regulates security-relevant aspects of an intended connection between an agency and an external system. It regulates the security interface between any two systems operating under two different distinct authorities. It includes a variety of descriptive, technical, procedural, and planning information. It is usually preceded by a formal MOA/MOU that defines high- level roles and responsibilities in management of a cross-domain connection.

   4. P

      Protract8593

      2023-07-24

      Selected A4 upvotes

      A Memorandum of Understanding (MOU) is a written agreement between two or more parties outlining their intention to work together on a specific project or endeavor. It is a non-binding document that establishes the framework and terms of cooperation between the parties involved. In this scenario, the MOU can be used to document the agreement between the two organizations to collaborate on the evaluation of new SIEM (Security Information and Event Management) solutions. It outlines their joint effort and commitment to work together towards a common goal without creating a formal legal contract.

2. Question 2 of 25

   A company is considering transitioning to the cloud. The company employs individuals from various locations around the world. The company does not want to increase its on premises infrastructure blueprint and only wants to pay for additional compute power required. Which of the following solutions would BEST meet the needs of the company?

   • APrivate cloud
   • BHybrid environment
   • CManaged security service provider
   • DHot backup site

   Show answer

   Correct answer: B

   How others answered

   • B88%

   Explanation

   The important thing to notice is that B is "hybrid ENVIRONMENT" not "hybrid CLOUD". A hybrid environment is a mix of private network and cloud, while a hybrid cloud is a mix of private cloud and public cloud. This company wants to provide services in the cloud, but maintain their existing on prem environment... that's a hybrid environment.

   Adapted from community discussion by Confuzed · 2023-04-13 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. C

      Confuzed

      2023-04-13

      Selected B23 upvotes

      The important thing to notice is that B is "hybrid ENVIRONMENT" not "hybrid CLOUD". A hybrid environment is a mix of private network and cloud, while a hybrid cloud is a mix of private cloud and public cloud. This company wants to provide services in the cloud, but maintain their existing on prem environment... that's a hybrid environment.

   2. R

      RonWonkers

      2022-09-19

      Selected B12 upvotes

      The company does not want to increase its on premises infrastructure blueprint, it's B.

   3. B

      Boubou480

      2023-01-06

      3 upvotes

      B. Hybrid environment A hybrid environment is a cloud computing model that combines on-premises infrastructure with a cloud infrastructure. This type of solution would allow the company to retain control over some of its infrastructure while also taking advantage of the flexibility and scalability of the cloud. This would allow the company to pay for additional compute power as needed and avoid the need to increase its on-premises infrastructure. A private cloud is a cloud infrastructure that is operated solely for a single organization. It is not suitable for a company with employees located around the world because it does not provide the flexibility and scalability of a public cloud. A managed security service provider is a third-party that provides security services to an organization. It is not directly related to the company's need to transition to the cloud. A hot backup site is a backup site that is always active and ready to take over in the event of a disaster. It is not related to the company's need to transition to the cloud.

   4. A

      ApplebeesWaiter1122

      2023-07-28

      Selected B2 upvotes

      A hybrid environment combines the use of on-premises infrastructure with cloud-based services. In this scenario, the company can maintain its existing on-premises infrastructure blueprint and utilize additional compute power in the cloud as needed. This approach allows the company to scale resources dynamically, paying for the compute power required, without the need to invest in additional on-premises infrastructure.

3. Question 3 of 25

   A tax organization is working on a solution to validate the online submission of documents. The solution should be carried on a portable USB device that should be inserted on any computer that is transmitting a transaction securely. Which of the following is the BEST certificate for these requirements?

   • AUser certificate
   • BSelf-signed certificate
   • CComputer certificate
   • DRoot certificate

   Show answer

   Correct answer: A

   How others answered

   • A64%
   • C28%

   Only 64% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I'm going to give details of what is the use of each one, because I'm tired that are not giving the right answer: User Certificate: User certificates specify which resources a given user can have access to. They are sometimes used on devices that several users share. When different users log in, their profile and certificate are automatically loaded, granting them access to their required information. Self-signed certificate: A self-signed certificate is one that is not signed by a CA at all – neither private nor public. In this case, the certificate is signed with its own private key, instead of requesting it from a public or a private CA (Certificate Authority). Root Certificate: Root certificates are the cornerstone of authentication and security in software and on the Internet. They're issued by a certified authority (CA) and, essentially, verify that the software/website owner is who they say they are. So for this verification I'm completely 100% sure is A: User certificate

   Adapted from community discussion by EubertT · 2022-12-10 · 24 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. E

      EubertT

      2022-12-10

      24 upvotes

      I'm going to give details of what is the use of each one, because I'm tired that are not giving the right answer: User Certificate: User certificates specify which resources a given user can have access to. They are sometimes used on devices that several users share. When different users log in, their profile and certificate are automatically loaded, granting them access to their required information. Self-signed certificate: A self-signed certificate is one that is not signed by a CA at all – neither private nor public. In this case, the certificate is signed with its own private key, instead of requesting it from a public or a private CA (Certificate Authority). Root Certificate: Root certificates are the cornerstone of authentication and security in software and on the Internet. They're issued by a certified authority (CA) and, essentially, verify that the software/website owner is who they say they are. So for this verification I'm completely 100% sure is A: User certificate

   2. P

      Protract8593

      2023-07-25

      Selected A7 upvotes

      Given the context of the tax organization trying to validate online submissions, the BEST certificate for their requirements would indeed be an A. User certificate. A user certificate is issued to an individual user and is used to authenticate and verify the identity of the user during online transactions. It is typically associated with an individual and allows them to securely sign and encrypt data, which aligns with the tax organization's goal of validating online submission of documents by users. The other options (B. Self-signed certificate, C. Computer certificate, and D. Root certificate) are not as suitable for this scenario. Self-signed certificates may not provide the necessary level of trust in a public environment, computer certificates are issued to devices rather than individual users, and root certificates are used to establish trust in a certificate chain but are not directly associated with user authentication. Therefore, the correct answer is A. User certificate, as it aligns with the tax organization's goal of validating online submissions by users.

   3. A

      ApplebeesWaiter1122

      2023-07-29

      Selected A5 upvotes

      A user certificate, also known as a client certificate, is the best certificate type for the given requirements. User certificates are used to identify and authenticate individual users or clients, and they can be stored on a portable USB device. When a user wants to perform a secure transaction, they can insert the USB device into any computer, and the certificate stored on the device will be used to establish a secure connection and validate the user's identity. This allows for secure online submission of documents while maintaining portability and ease of use for the users.

   4. J

      Juraj22

      2022-11-29

      Selected A4 upvotes

      For me nothing is better than ROOT and USER certificate, We have situation, where you can plug USB and validate something via something....and what is it "something"? You need to validate via ROOT, therefore maybe ROOT. 100% cant be self signed. Never trust self-signed. Bad answer as every second answer here. Read the discussion. Also cant be computer. because computer can chcange. User or Root, Root has more secure, User is more common.

4. Question 4 of 25

   A security analyst is reviewing web-application logs and finds the following log:

   

   Which of the following attacks is being observed?

   • ADirectory traversal
   • BXSS
   • CCSRF
   • DOn-path attack

   Show answer

   Correct answer: A

   How others answered

   • A98%

   Explanation

   https://www.w3schools.com/tags/ref_urlencode.ASP / is %2F = is %3D ? is %3F .. The double dot is an indicator that you can move back from this location. That is, you're in a folder inside of another folder. Once you start moving around within your computer, you can use that information for reference. https://www.redhat.com/sysadmin/navigating-filesystem-linux-terminal#:~:text=The%20single%20dot%20is%20a,use%20that%20information%20for%20reference.

   Adapted from community discussion by RevolutionaryAct · 2023-08-13 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • redhat.com documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. R

      RevolutionaryAct

      2023-08-13

      Selected A11 upvotes

      https://www.w3schools.com/tags/ref_urlencode.ASP / is %2F = is %3D ? is %3F .. The double dot is an indicator that you can move back from this location. That is, you're in a folder inside of another folder. Once you start moving around within your computer, you can use that information for reference. https://www.redhat.com/sysadmin/navigating-filesystem-linux-terminal#:~:text=The%20single%20dot%20is%20a,use%20that%20information%20for%20reference.

   2. B

      banditring

      2022-09-04

      6 upvotes

      "A common symptom of this attack is the presence of a variation of the change to parent directory instruction (i.e., ../) in a URL, such as ..%c0%af or ..%5c." and it is showing this in this picture

   3. Z

      zharis

      2022-10-27

      1 upvote

      .....but directory traversal which involves threat actor submitting a request for a file outside the web servers root directory by submitting a path to navigate to the parent directory looks more convincing given the URL included in the question.

   4. Y

      ylatif

      2022-10-12

      1 upvote

      Cross-Site Request Forgery (CSRF) attacks execute unauthorized actions on web applications, via an authenticated end-user’s connection.

5. Question 5 of 25

   Select 2

   A systems engineer wants to leverage a cloud-based architecture with low latency between network-connected devices that also reduces the bandwidth that is required by performing analytics directly on the endpoints. Which of the following would BEST meet the requirements? (Choose two.)

   • APrivate cloud
   • BSaaS
   • CHybrid cloud
   • DIaaS
   • EDRaaS
   • FFog computing

   Show answer

   Correct answer: C, F

   How others answered

   • CF66%
   • AF28%

   Only 66% agreed on this answer — treat it as contested rather than settled.

   Explanation

   CF - I had to look it up, so for those that didn't know; "Many people use the terms fog computing and edge computing interchangeably because both involve bringing intelligence and processing closer to where the data is created" - https://www.techtarget.com/iotagenda/definition/fog-computing-fogging

   Adapted from community discussion by ScottT · 2022-09-15 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • azure.microsoft.com documentation
   • azure.microsoft.com documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. S

      ScottT

      2022-09-15

      23 upvotes

      CF - I had to look it up, so for those that didn't know; "Many people use the terms fog computing and edge computing interchangeably because both involve bringing intelligence and processing closer to where the data is created" - https://www.techtarget.com/iotagenda/definition/fog-computing-fogging

   2. A

      ApplebeesWaiter1122

      2023-07-28

      Selected C, F11 upvotes

      Fog computing: Fog computing, also known as edge computing, is a decentralized computing infrastructure that extends computing resources to the edge of the network, closer to the devices and sensors generating data. This approach reduces latency since data processing and analytics can be performed locally on the endpoints, avoiding the need to send all data to centralized cloud servers. It also helps reduce bandwidth usage by filtering and processing data at the edge before sending relevant information to the cloud for further analysis or storage. Hybrid cloud: A hybrid cloud architecture combines a private cloud (on-premises infrastructure) and a public cloud (external cloud services). With a hybrid cloud, organizations can keep critical or sensitive data on-premises in the private cloud while leveraging the public cloud's scalability and resources for less sensitive or non-sensitive tasks. By using a combination of private and public clouds, organizations can optimize data storage and processing, achieving low latency and reduced bandwidth usage when necessary.

   3. F

      FMMIR

      2022-12-13

      Selected C, F7 upvotes

      Fog computing and hybrid cloud would BEST meet the requirements. Fog computing is a distributed computing architecture that performs analytics and other processing on the edge of a network, which reduces the amount of data that needs to be transmitted and the associated bandwidth requirements. A hybrid cloud architecture combines the benefits of both public and private clouds, and allows for low-latency communication between network-connected devices.

   4. G

      G4ct756

      2022-10-25

      8 upvotes

      my interpretation. Since the engineer "wanted to leverage a cloud-base architecture" meaning currently network is on-prem and planning to offload some system to cloud. Also with fog-computing, the company need to support IOT network on-prem.

6. Question 6 of 25

   A company acquired several other small companies. The company that acquired the others is transitioning network services to the cloud. The company wants to make sure that performance and security remain intact. Which of the following BEST meets both requirements?

   • AHigh availability
   • BApplication security
   • CSegmentation
   • DIntegration and auditing

   Show answer

   Correct answer: D

   How others answered

   • D45%
   • C43%

   Only 45% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I think the answer is C. I copied what is written below out of an article/blog on CompTIA’s website (https://www.comptia.org/blog/security-awareness-training-network-segmentation#) “Following are a few benefits of network segmentation: - Limiting access privileges to those who truly need it - Protecting the network from widespread cyberattacks - Boosting network performance by reducing the number of users in specific zones”

   Adapted from community discussion by GS1011 · 2023-03-26 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • comptia.org documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. V

      varun0

      2022-09-05

      Selected D30 upvotes

      Integrate the components in cloud and then audit them to ensure performance and security are working to expectations

   2. G

      GS1011

      2023-03-26

      19 upvotes

      I think the answer is C. I copied what is written below out of an article/blog on CompTIA’s website (https://www.comptia.org/blog/security-awareness-training-network-segmentation#) “Following are a few benefits of network segmentation: - Limiting access privileges to those who truly need it - Protecting the network from widespread cyberattacks - Boosting network performance by reducing the number of users in specific zones”

   3. K

      Kurt43

      2023-09-23

      7 upvotes

      wrong answer. network services was the only thing being transitioned to the cloud, not the entire infra.

   4. T

      Tomtom11

      2022-10-25

      Selected D3 upvotes

      The integration of the appropriate level and quantity of security controls is a subject that is always being audited. Are the controls appropriate? Are they placed and used correctly? Most importantly, are they effective? These are standard IT audit elements in the enterprise. The moving of computing resources to the cloud does not change the need or intent of audit functions.

7. Question 7 of 25

   A user reports falling for a phishing email to an analyst. Which of the following system logs would the analyst check FIRST?

   • ADNS
   • BMessage gateway
   • CNetwork
   • DAuthentication

   Show answer

   Correct answer: B

   How others answered

   • B42%
   • A34%
   • D23%

   Only 42% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Per ChatGPT The analyst would check the Message Gateway logs first in this scenario. Phishing emails are often sent through email, so the Message Gateway logs, which track incoming and outgoing email messages, would provide the earliest record of the phishing email and any related activity. These logs can show the sender and recipient addresses, the time the email was sent, and potentially the contents of the email itself. Checking other logs such as DNS, Network, or Authentication logs may also be useful in the investigation, but the Message Gateway logs would be the first place to start.

   Adapted from community discussion by Calvin616 · 2023-02-06 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. C

      Calvin616

      2023-02-06

      Selected B9 upvotes

      Per ChatGPT The analyst would check the Message Gateway logs first in this scenario. Phishing emails are often sent through email, so the Message Gateway logs, which track incoming and outgoing email messages, would provide the earliest record of the phishing email and any related activity. These logs can show the sender and recipient addresses, the time the email was sent, and potentially the contents of the email itself. Checking other logs such as DNS, Network, or Authentication logs may also be useful in the investigation, but the Message Gateway logs would be the first place to start.

   2. H

      hamchook

      2023-08-03

      9 upvotes

      you don't have to click a link to fall for a phishing email, you can reply to it with sensitive info not having clicked anything. i go with message gateway; i also did this kind of work and that's the first thing i would check (see the sender, check header info, check to see if that sender sent emails to anyone else to get ahead of it before anybody else falls for it)

   3. P

      predsednik

      2023-08-11

      Selected B3 upvotes

      B. Message gateway When a user reports falling for a phishing email, the first system logs that an analyst would typically check are those related to the message gateway. The message gateway logs can provide valuable information about the email's origin, sender details, links, attachments, and any actions taken by the gateway in response to the email. Checking the message gateway logs is crucial because it can help the analyst gather information about the phishing attempt, including the sender's details, the email's route, any malicious URLs or attachments, and whether the gateway detected and took action against the phishing email. This information is essential for understanding the scope of the attack, identifying potential risks, and taking appropriate measures to mitigate further harm. While other system logs like DNS, network, and authentication logs may also provide relevant information in the investigation, checking the message gateway logs is the most immediate and pertinent step when dealing with a reported phishing incident.

   4. G

      ganymede

      2023-11-26

      Selected B4 upvotes

      B. Message Gateway. At first I thought it was DNS, but upon further reflection I have decided that Message Gateway is the best answer. The first thing the security team will do is attempt to determine if this if a True Positive or False Positive. Many reports and alerts are False Positives. They are NOT going to just assume straight away that it is a True Positive. They are going to check and validate that. As part of that work they would likely check the mail logs to see if the mail logs can help them determine whether it is a True Positive or False Positive. Once they have confirmed it is a True Positive then they will want to confirm if and when the link was actually clicked. That is when they will look at DNS.

8. Question 8 of 25

   Which of the following supplies non-repudiation during a forensics investigation?

   • ADumping volatile memory contents first
   • BDuplicating a drive with dd
   • CUsing a SHA-2 signature of a drive image
   • DLogging everyone in contact with evidence
   • EEncrypting sensitive data

   Show answer

   Correct answer: C

   How others answered

   • C62%
   • D38%

   Only 62% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Yeah, it’s C. Nonrepudiation is specifically talking about the proof that someone has done something on the system. Taking a hash of the original disk is proof that it represents the state of the data when the investigation began. It’s not a signature in the sense of an encryption cert or something like that, but it is definitely a method of ensuring that the data on the drive represents the user’s changes, vice those of the investigator or someone else after the fact. Chain of custody doesn’t apply because nonrepudiation is talking about the data itself.

   Adapted from community discussion by atrax · 2022-10-19 · 25 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • nist.gov documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. A

      atrax

      2022-10-19

      Selected C25 upvotes

      Yeah, it’s C. Nonrepudiation is specifically talking about the proof that someone has done something on the system. Taking a hash of the original disk is proof that it represents the state of the data when the investigation began. It’s not a signature in the sense of an encryption cert or something like that, but it is definitely a method of ensuring that the data on the drive represents the user’s changes, vice those of the investigator or someone else after the fact. Chain of custody doesn’t apply because nonrepudiation is talking about the data itself.

   2. A

      ApplebeesWaiter1122

      2023-07-23

      Selected C10 upvotes

      Using a SHA-2 signature of a drive image provides non-repudiation during a forensics investigation. Non-repudiation is the ability to prove that a specific action or transaction was performed by a particular party and cannot be denied or repudiated later. In a forensics investigation, it is crucial to maintain the integrity and authenticity of the evidence collected, ensuring that it cannot be tampered with or altered. When a SHA-2 (Secure Hash Algorithm 2) signature is generated for a drive image, it produces a unique and fixed-size alphanumeric hash value that represents the content of the entire drive image. Even a small change in the image's content will result in a completely different hash value. By comparing the original SHA-2 signature with the one generated during the investigation, investigators can verify that the drive image has not been modified or tampered with since it was initially collected. This process helps establish non-repudiation, as any attempt to alter the image would result in a different SHA-2 signature.

   3. K

      Kurt43

      2023-09-24

      11 upvotes

      looks like you're talking about integrity, not non-repudiation

   4. [

      [Removed]

      2022-10-12

      9 upvotes

      Integrity is what the question is asking for. Non-repudiation

9. Question 9 of 25

   Which of the following documents provides guidance regarding the recommended deployment of network security systems from the manufacturer?

   • ACloud control matrix
   • BReference architecture
   • CNIST RMF
   • DCIS Top 20

   Show answer

   Correct answer: B

   How others answered

   • B84%
   • D16%

   Explanation

   Correct answer is B, becouse the vendorrs are responsble for their products and solutions and they are providing reference arhitectures. CIS Top 20 - is a security controls framework..

   Adapted from community discussion by dansecu · 2022-10-08 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

   1. D

      dansecu

      2022-10-08

      Selected B18 upvotes

      Correct answer is B, becouse the vendorrs are responsble for their products and solutions and they are providing reference arhitectures. CIS Top 20 - is a security controls framework..

   2. [

      [Removed]

      2022-10-09

      Selected B8 upvotes

      A reference architecture is a document or set of documents that provides recommended structures and integrations of IT products and services to form a solution.

   3. A

      ApplebeesWaiter1122

      2023-07-23

      Selected B4 upvotes

      A reference architecture is a document that provides guidance and best practices on how to deploy and configure specific technology solutions or systems. It typically comes from the manufacturer or vendor of the product and offers a recommended design and deployment approach to achieve security, performance, and other desired outcomes. It serves as a blueprint for organizations to follow when implementing the technology in their environment.

   4. A

      AspiringNerd

      2024-04-27

      Selected B2 upvotes

      The document that provides guidance regarding the recommended deployment of network security systems from the manufacturer is: B. Reference architecture. A reference architecture is a document or model provided by a manufacturer or vendor that outlines best practices, design principles, and recommended configurations for deploying their network security systems. It typically includes diagrams, specifications, and guidelines for implementing the manufacturer's products in a secure and efficient manner. Reference architectures help organizations understand how to deploy and integrate network security systems effectively to meet their security requirements and objectives. It specifically asks from the manufacturer.

10. Question 10 of 25

    Select 2

    A systems analyst is responsible for generating a new digital forensics chain-of-custody form. Which of the following should the analyst include in this documentation? (Choose two.)

    • AThe order of volatility
    • BA CRC32 checksum
    • CThe provenance of the artifacts
    • DThe vendor’s name
    • EThe date and time
    • FA warning banner

    Show answer

    Correct answer: C, E

    How others answered

    • CE86%

    Explanation

    A systems analyst should include the following information in the new digital forensics chain-of-custody form: E. The date and time C. The provenance of the artifacts Explanation: A digital forensics chain-of-custody form is a document that provides a clear and complete record of the sequence of events that occurs from the time a digital artifact is collected until it is analyzed and used as evidence. The form should include the date and time when the artifact was collected, so that the exact time it was obtained can be determined. Additionally, the form should include information about the provenance of the artifact, such as its origin and any steps that have been taken to maintain its integrity. The order of volatility, a CRC32 checksum, the vendor’s name, and a warning banner are not essential components of a digital forensics chain-of-custody form.

    Adapted from community discussion by ronniehaang · 2023-01-31 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. R

       ronniehaang

       2023-01-31

       Selected C, E20 upvotes

       A systems analyst should include the following information in the new digital forensics chain-of-custody form: E. The date and time C. The provenance of the artifacts Explanation: A digital forensics chain-of-custody form is a document that provides a clear and complete record of the sequence of events that occurs from the time a digital artifact is collected until it is analyzed and used as evidence. The form should include the date and time when the artifact was collected, so that the exact time it was obtained can be determined. Additionally, the form should include information about the provenance of the artifact, such as its origin and any steps that have been taken to maintain its integrity. The order of volatility, a CRC32 checksum, the vendor’s name, and a warning banner are not essential components of a digital forensics chain-of-custody form.

    2. K

       kstevens11

       2022-11-08

       Selected C, E7 upvotes

       I would go with E for sure, as date and time is crucial. Then, option C for provenance of the data -- NIST defines provenance as "The chronology of the origin, development, ownership, location, and changes to a system or system component and associated data". Source -- https://csrc.nist.gov/glossary/term/provenance#:~:text=Definition(s)%3A,%2C%20component%2C%20or%20associated%20data.

    3. A

       ApplebeesWaiter1122

       2023-07-01

       Selected C, E4 upvotes

       C. The provenance of the artifacts: This refers to the origin or source of the artifacts being collected. It includes information such as where the artifacts were found, who collected them, and any relevant details about their acquisition. Provenance helps establish the authenticity and reliability of the evidence. E. The date and time: It is crucial to document the date and time when the artifacts were collected or transferred. This information is essential for establishing the chronological order of events and maintaining an accurate timeline during the forensic investigation.

    4. C

       carpathia

       2022-11-14

       Selected C, E4 upvotes

       I would go with CE. Who collected the evidence (if that what is meant by provenance) and time has to be recorded. Digest/Hash has to be recorded, but CRC is not a hash as it is reversible. God help us...

11. Question 11 of 25

    An engineer recently deployed a group of 100 web servers in a cloud environment. Per the security policy, all web-server ports except 443 should be disabled. Which of the following can be used to accomplish this task?

    • AApplication allow list
    • BSWG
    • CHost-based firewall
    • DVPN

    Show answer

    Correct answer: C

    How others answered

    • C73%
    • B26%

    Only 73% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Not A or D. Was not sure whether it should be B or C until I read the definition of SWGs in the official guide from CompTIA. "An on-premises SWG is a proxy-based firewall, content filter, and intrusion detection/prevention system that mediates user access to Internet sites and services"

    Adapted from community discussion by YusufMadkour · 2022-08-30 · 34 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • comptia.org documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. Y

       YusufMadkour

       2022-08-30

       Selected C34 upvotes

       Not A or D. Was not sure whether it should be B or C until I read the definition of SWGs in the official guide from CompTIA. "An on-premises SWG is a proxy-based firewall, content filter, and intrusion detection/prevention system that mediates user access to Internet sites and services"

    2. M

       Mondicles

       2022-09-19

       Selected C31 upvotes

       This one asks which one is used for port blocking in WEB SERVERS. SWG is primarily used to protect USERS from accessing or being infected by web threats. I'll go with firewalls to explicitly allow 443.

    3. M

       Mroljrtnrty

       2023-04-23

       16 upvotes

       Just Passed! 787! 4/23/23 - This question was on the test. Host based firewall

    4. D

       daddylonglegs

       2023-10-11

       Selected C4 upvotes

       It's host-based firewalls. Those saying you can't configure a host-based firewall on a virtual machine have probably never configured a virtual machine, because you absolutely can. A Secure Web Gateway protects users against malicious content on the Internet. It does nothing at all about traffic coming IN and reaching internal servers from the Internet. Those of you that choose B are focusing waaaaay too much about whether the definition of a secure web gateway could match the requirement for blocking traffic without thinking critically and actually considering the content of the question. Yes, you absolutely can configure a host-based firewall on a virtual machine. As for applying it to 100 machines, you can create an image that already has the firewall properly configured and then just boot the VMs with that image, or you can apply it through group policy or something similar. Even if you had to do all 100 by hand manually that's still more applicable to the question than a secure web gateway.

12. Question 12 of 25

    A Chief Security Officer is looking for a solution that can provide increased scalability and flexibility for back-end infrastructure, allowing it to be updated and modified without disruption to services. The security architect would like the solution selected to reduce the back-end server resources and has highlighted that session persistence is not important for the applications running on the back-end servers. Which of the following would BEST meet the requirements?

    • AReverse proxy
    • BAutomated patch management
    • CSnapshots
    • DNIC teaming

    Show answer

    Correct answer: A

    How others answered

    • A93%

    Explanation

    its the way to distribute load across different servers, at the same time you can remove from the cluster each server that you want to update.

    Adapted from community discussion by Ribeiro19 · 2024-09-19 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. R

       Ribeiro19

       2024-09-19

       Selected A21 upvotes

       its the way to distribute load across different servers, at the same time you can remove from the cluster each server that you want to update.

    2. D

       david124

       2024-09-22

       Selected A12 upvotes

       Based on the requirements provided, a Reverse Proxy would be the best choice to meet the objectives of both the Chief Security Officer and the security architect. Here's a breakdown of why each option may or may not suit your needs: A. Reverse Proxy: Increased Scalability: Reverse proxies can distribute incoming requests to various back-end servers, improving scalability and ensuring high availability. Flexibility for Updates: Since the reverse proxy handles client requests, backend servers can be taken down for maintenance or updates without causing service disruption. Reduced Server Resources: By caching content and offloading SSL termination, reverse proxies can reduce the load on back-end servers. Session Persistence Not Important: A reverse proxy can operate without needing to maintain session persistence, aligning with your requirement.

    3. P

       Protract8593

       2024-09-22

       Selected A8 upvotes

       A reverse proxy acts as an intermediary server between clients and back-end servers. It receives requests from clients, forwards those requests to the appropriate back-end servers, and then sends the responses back to the clients. Reverse proxies are often used for load balancing, security, and improving performance. 1. Increased scalability and flexibility: Reverse proxies can distribute client requests across multiple back-end servers, providing increased scalability. They also allow for easier modification and updating of the back-end infrastructure without disrupting services, as changes can be made to the back-end servers without affecting the clients directly. 2. Reduced back-end server resources: By distributing client requests across multiple back-end servers, a reverse proxy can balance the load, reducing the burden on individual back-end servers and optimizing resource utilization. 3. Session persistence not important: In some scenarios, session persistence is critical to maintain user state across requests. However, in this case, session persistence is explicitly stated as not important. This means the reverse proxy doesn't need to manage sticky sessions, further simplifying the setup.

    4. N

       nerdboy1992

       2024-09-22

       10 upvotes

       NIC Teaming combines the throughput of 2 or more network adapters to provide a higher speed than a single connection. This would help with increasing the speed, but the requirements between the CSO and architect were increase scalability, increase flexibility, allowed to make changes without service disruption, reduce back-end server resources, and session persistence being insignificant for the backend applications. Since increased speed is not a requirement, NIC Teaming would NOT be the correct answer.

13. Question 13 of 25

    A security analyst is concerned about critical vulnerabilities that have been detected on some applications running inside containers. Which of the following is the BEST remediation strategy?

    • AUpdate the base container Image and redeploy the environment.
    • BInclude the containers in the regular patching schedule for servers.
    • CPatch each running container individually and test the application.
    • DUpdate the host in which the containers are running.

    Show answer

    Correct answer: A

    How others answered

    • A77%

    Explanation

    Answer: Update the base container image and redeploy the environment (A) In the scenario, the vulnerabilities found were critical meaning that patches would need to be applied immediately. The options to patch the containers (B &C) could work, however, patching would likely take months, seeing how this vulnerability is critical, neither would address the concern's urgency. The option to update the host (D) also could work, however, the scenario specified that the vulnerabilities have been detected only on some applications and not on the host itself. While a container runs on a host machine, it does not mean they share the same vulnerabilities. So updating the host would likely not patch the vulnerabilities that were found in the containers. Out of the given options, the option to update on the base container image would 1.) addresses where the vulnerabilities were found and what needs to be updated and 2.) addresses the urgency to patch the critical vulnerability.

    Adapted from community discussion by rodwave · 2022-11-09 · 57 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. R

       rodwave

       2022-11-09

       Selected A57 upvotes

       Answer: Update the base container image and redeploy the environment (A) In the scenario, the vulnerabilities found were critical meaning that patches would need to be applied immediately. The options to patch the containers (B &C) could work, however, patching would likely take months, seeing how this vulnerability is critical, neither would address the concern's urgency. The option to update the host (D) also could work, however, the scenario specified that the vulnerabilities have been detected only on some applications and not on the host itself. While a container runs on a host machine, it does not mean they share the same vulnerabilities. So updating the host would likely not patch the vulnerabilities that were found in the containers. Out of the given options, the option to update on the base container image would 1.) addresses where the vulnerabilities were found and what needs to be updated and 2.) addresses the urgency to patch the critical vulnerability.

    2. G

       Gravoc

       2022-09-14

       38 upvotes

       A is incorrect. The answer is D. Really shows that the voters don't know much about containers here. A container is merely a text file that allocates resources and libraries to a virtual environment, which in turn allows an application to function in an isolated environment. That's it The containers share the same Kernel as the base host system. Only the system Kernel and a text file of allocated resources and libraries stands between a critical vulnerability, and gaining access to the standard host computing environment. Swiss Cheese model and Defense-in-Depth applies here. Since there's no update to be applied to the container, and the base host & containers all are reliant on the same Kernel. Keeping the host system up to date with all security patches and firmware patches is the best way to prevent a critical vulnerability from breaking out of a container. Look up the container hierarchy, "dirty-pipe-exploit', and Docker software. Hardware > OS > Virtual Machine > Docker > Container Updating the host machine is absolutely the answer.

    3. C

       CTE_Instructor

       2023-03-01

       13 upvotes

       Updating the host in which the containers are running may not patch vulnerabilities inside the containers. Updating the base container image will ensure any known vulnerabilities are patched before the container is redeployed. This is going to save time and ensure all containers are patched securely and effectively. I would remind everyone reading this to acknowledge not everyone has the correct answer here, and the ones claiming to have the correct answer may, in fact, also be wrong. Check your hubris at the door, we are all here to learn in a positive environment to succeed in the industry.

    4. M

       MikeM3

       2023-04-11

       13 upvotes

       well this comment didn't age well. option D is a good sec measurer but it doesn't address the vulnerabilities in the containerized applications themselves. the vulnerabilities may be specific to the containerized apps themselves and not the host itself so updating the host may not address the issue. Option A is the correct answer.

14. Question 14 of 25

    A Chief Information Security Officer (CISO) is evaluating the dangers involved in deploying a new ERP system for the company. The CISO categorizes the system, selects the controls that apply to the system, implements the controls, and then assesses the success of the controls before authorizing the system. Which of the following is the CISO using to evaluate the environment for this new ERP system?

    • AThe Diamond Model of Intrusion Analysis
    • BCIS Critical Security Controls
    • CNIST Risk Management Framework
    • DISO 27002

    Show answer

    Correct answer: C

    How others answered

    • C93%

    Explanation

    C. NIST Risk Management Framework is the framework the CISO is using to evaluate the environment for this new ERP system. The NIST Risk Management Framework (RMF) is a structured approach to managing information security risk that is used by organizations to ensure the confidentiality, integrity, and availability of their information systems and data. The CISO's actions of categorizing the system, selecting the controls that apply to the system, implementing the controls, and then assessing the success of the controls before authorizing the system to align with the six steps of the NIST RMF: 1. Categorize information systems 2. Select security controls 3. Implement security controls 4. Assess security controls 5. Authorize information systems 6. Monitor security controls By using the NIST RMF, the CISO can ensure that a comprehensive and systematic approach to information security is taken when evaluating the new ERP system and can reduce the risk of potential security incidents or breaches

    Adapted from community discussion by Dachosenone · 2023-02-11 · 29 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. D

       Dachosenone

       2023-02-11

       Selected C29 upvotes

       C. NIST Risk Management Framework is the framework the CISO is using to evaluate the environment for this new ERP system. The NIST Risk Management Framework (RMF) is a structured approach to managing information security risk that is used by organizations to ensure the confidentiality, integrity, and availability of their information systems and data. The CISO's actions of categorizing the system, selecting the controls that apply to the system, implementing the controls, and then assessing the success of the controls before authorizing the system to align with the six steps of the NIST RMF: 1. Categorize information systems 2. Select security controls 3. Implement security controls 4. Assess security controls 5. Authorize information systems 6. Monitor security controls By using the NIST RMF, the CISO can ensure that a comprehensive and systematic approach to information security is taken when evaluating the new ERP system and can reduce the risk of potential security incidents or breaches

    2. R

       Ranaer

       2023-02-08

       Selected C8 upvotes

       I believe the correct answer here is C. NIST RMF has a simple 7 step process: 1. Essential activities to prepare the organization to manage security and privacy risks 2. Categorize the system and information processed, stored, and transmitted based on an impact analysis 3. Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s) 4. Implement the controls and document how controls are deployed 5. Assess to determine if the controls are in place, operating as intended, and producing the desired results 6. Senior official makes a risk-based decision to authorize the system (to operate) 7. Continuously monitor control implementation and risks to the system. The actions of the CISO correspond to that process. This is why I will select C.

    3. A

       ApplebeesWaiter1122

       2023-05-19

       Selected C4 upvotes

       The NIST Risk Management Framework (RMF) is a widely recognized framework developed by the National Institute of Standards and Technology (NIST) for assessing and managing risks within an organization's information systems. It provides a structured and systematic approach to risk management.

    4. P

       pmmg

       2023-02-06

       4 upvotes

       I think D. From ISO 27002 Information security is achieved by implementing a suitable set of controls, including policies, rules, processes, procedures, organizational structures and software and hardware functions. To meet its specific security and business objectives, the organization should define, implement, monitor, review and improve these controls where necessary.

15. Question 15 of 25

    A retail store has a business requirement to deploy a kiosk computer in an open area. The kiosk computer’s operating system has been hardened and tested. A security engineer is concerned that someone could use removable media to install a rootkit. Which of the following should the security engineer configure to BEST protect the kiosk computer?

    • AMeasured boot
    • BBoot attestation
    • CUEFI
    • DEDR

    Show answer

    Correct answer: A

    How others answered

    • A57%
    • C23%

    Only 57% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "Measured Boot is a new feature of Windows 8 that was created to help better protect your machine from rootkits and other malware. Measured Boot will check each start up component including the firmware all the way to the boot drivers and it will store this information in what is called a Trusted Platform Module (TPM)." https://www.microcenter.com/tech_center/article/8862/what-is-measured-boot

    Adapted from community discussion by RvR109 · 2023-02-15 · 31 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. R

       RvR109

       2023-02-15

       Selected A31 upvotes

       "Measured Boot is a new feature of Windows 8 that was created to help better protect your machine from rootkits and other malware. Measured Boot will check each start up component including the firmware all the way to the boot drivers and it will store this information in what is called a Trusted Platform Module (TPM)." https://www.microcenter.com/tech_center/article/8862/what-is-measured-boot

    2. S

       skorza

       2023-03-03

       Selected A16 upvotes

       CHat GPT says EDR is typically used to detect and respond to threats after they have already bypassed other security measures. It is a reactive measure, rather than a preventative one. In this scenario, it would be better to prevent the rootkit from being installed in the first place, rather than relying on EDR to detect and respond to the threat after the fact. Measured boot, on the other hand, is a preventative measure that ensures the system starts with a known good state and can block the boot process or alert the security team if any changes are detected. Therefore, Measured boot is the BEST option for protecting the kiosk computer from the installation of a rootkit via removable media.

    3. D

       DriftandLuna

       2023-07-30

       5 upvotes

       what a stupid question According to the official cert guide "The second security feature intended to help prevent boot-level malware is measured boot. These boot processes measure each component, starting with the firmware and ending with the boot start drivers. Measured boot does not validate against a known good list of signatures before booting; instead, it relies on the UEFI firmware to hash the firmware, bootloader, drivers, and anything else that is part of the boot process" That seems to suggest option A is a part of option C. But it doesn't end there, it goes on to say "The data gathered is stored in the Trusted Platform Module (TPM), and the logs can be validated remotely to let security administrators know the boot state of the system. This boot attestation process allows comparison against known good states, and administrators can take action if the measured boot shows a difference from the accepted or secure known state" So that then says measured boot is a uefi drive boot attestation process so take your pick from A, B or C!

    4. Z

       Zdane

       2023-04-21

       8 upvotes

       It sounds ok, but ChatGPT often hallucinates info it provides, even making up the sources. I would not depend on it in search for "truth"

16. Question 16 of 25

    A major manufacturing company updated its internal infrastructure and just recently started to allow OAuth applications to access corporate data. Data leakage is now being reported. Which of the following MOST likely caused the issue?

    • APrivilege creep
    • BUnmodified default settings
    • CTLS protocol vulnerabilities
    • DImproper patch management

    Show answer

    Correct answer: B

    How others answered

    • B73%
    • A18%

    Only 73% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B. Unmodified default settings In OAuth2 there is the concept of "scope". The .default scope can be used in any OAuth 2.0 flow and to initiate admin consent. Its use is required in the On-Behalf-Of flow and client credentials flow. Clients can't combine static (.default) consent and dynamic consent in a single request. https://learn.microsoft.com/en-us/azure/active-directory/develop/scopes-oidc Scope is a mechanism in OAuth 2.0 to limit an application's access to a user's account. An application can request one or more scopes, this information is then presented to the user in the consent screen, and the access token issued to the application will be limited to the scopes granted. OAuth does not define any particular values for scopes, since it is highly dependent on the service's internal architecture and needs. https://oauth.net/2/scope/ What is OAuth2 scope? OAuth 2.0 scopes provide a way to limit the amount of access that is granted to an access token.

    Adapted from community discussion by ganymede · 2023-02-22 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. G

       ganymede

       2023-02-22

       16 upvotes

       B. Unmodified default settings In OAuth2 there is the concept of "scope". The .default scope can be used in any OAuth 2.0 flow and to initiate admin consent. Its use is required in the On-Behalf-Of flow and client credentials flow. Clients can't combine static (.default) consent and dynamic consent in a single request. https://learn.microsoft.com/en-us/azure/active-directory/develop/scopes-oidc Scope is a mechanism in OAuth 2.0 to limit an application's access to a user's account. An application can request one or more scopes, this information is then presented to the user in the consent screen, and the access token issued to the application will be limited to the scopes granted. OAuth does not define any particular values for scopes, since it is highly dependent on the service's internal architecture and needs. https://oauth.net/2/scope/ What is OAuth2 scope? OAuth 2.0 scopes provide a way to limit the amount of access that is granted to an access token.

    2. P

       princajen

       2023-03-24

       8 upvotes

       If an incorrectly configured default OAuth scope is the cause of the data leakage, then the answer would be "B. Unmodified default settings", as the default settings in the OAuth implementation were not properly configured. However, since the original question did not provide enough information about the cause of the data leakage, both answers "A. Privilege creep" and "B. Unmodified default settings" could be possible causes, and the more likely answer would depend on the specific details of the scenario.

    3. A

       ApplebeesWaiter1122

       2023-05-25

       6 upvotes

       From my understanding of Privilege Creep, it about gradual accumulation of excessive privileges or access rights by users or accounts over time. It occurs when users are granted more privileges than they require to perform their job functions, and these privileges are not revoked or adjusted as job roles change or organizational needs evolve. Privilege creep can happen in various systems, such as operating systems, databases, applications, and network environments. It typically occurs due to inadequate access control management and the absence of regular reviews and audits of user privileges.

    4. G

       ganymede

       2023-03-05

       3 upvotes

       I asked chatgpt if an incorrectly configurd default OAuth scope could cause this data leakage. It agreed that it can. Chatgpt: Unmodified default settings in OAuth can also be a likely cause of data leakage. OAuth scopes define the level of access an application has to a particular resource. The default scope may be configured to provide access to resources that it shouldn't, resulting in unauthorized access to sensitive data. This can occur if the default scope was not modified to restrict access to only the necessary resources for the application. Therefore, B. Unmodified default settings can also be a likely cause of data leakage in this scenario.

17. Question 17 of 25

    As part of the building process for a web application, the compliance team requires that all PKI certificates are rotated annually and can only contain wildcards at the secondary subdomain level. Which of the following certificate properties will meet these requirements?

    • AHTTPS://*.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022
    • BHTTPS://app1.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022
    • CHTTPS://*.app1.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022
    • DHTTPS://*.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2023

    Show answer

    Correct answer: C

    How others answered

    • C95%

    Explanation

    Answer: A. HTTPS://*.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022. The question asks for the secondary subdomain. If the the domain is comptia.org then the SECONDARY subdomain would be the wildcard in HTTPS://*.comptia.org. In Answer C the domain goes three levels deep HTTPS://*.app1.comptia.org. And in D , Although the wildcard placement is correct the dates are two years instead of 1 year.

    Adapted from community discussion by Binx · 2023-02-24 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • comptia.org documentation
    • comptia.org documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. [

       [Removed]

       2023-12-12

       Selected C27 upvotes

       Believe in yourselves, you're not alone. I've been grinding here too, doubting myself but...I'll never stop.

    2. B

       Binx

       2023-02-24

       6 upvotes

       Answer: A. HTTPS://*.comptia.org, Valid from April 10 00:00:00 2021 - April 8 12:00:00 2022. The question asks for the secondary subdomain. If the the domain is comptia.org then the SECONDARY subdomain would be the wildcard in HTTPS://*.comptia.org. In Answer C the domain goes three levels deep HTTPS://*.app1.comptia.org. And in D , Although the wildcard placement is correct the dates are two years instead of 1 year.

    3. A

       AbdullahMohammad251

       2024-05-08

       Selected C2 upvotes

       A contains wildcards at the 1st subdomain level B doesn't contain wildcards D contains wildcards at the 1st subdomain level + certificate is valid for 2 years C contains wildcards at the second subdomain level and a certificate valid for one year. * - used for wildcards in the first subdomain level app1 - is the second subdomain comptia - is the domain org - is the top-level domain

    4. A

       allthegoodnicknamesaretaken

       2023-02-15

       4 upvotes

       Also that's valid for 2 years and it can only be valid for 1 year

18. Question 18 of 25

    A systems engineer thinks a business system has been compromised and is being used to exfiltrate data to a competitor. The engineer contacts the CSIRT. The CSIRT tells the engineer to immediately disconnect the network cable and to not do anything else. Which of the following is the most likely reason for this request?

    • AThe CSIRT thinks an insider threat is attacking the network.
    • BOutages of business-critical systems cost too much money.
    • CThe CSIRT does not consider the systems engineer to be trustworthy.
    • DMemory contents, including fileless malware, are lost when the power is turned off.

    Show answer

    Correct answer: D

    How others answered

    • D61%
    • A39%

    Only 61% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Memory contents including files and malware are lost when the power is turned off. This is because memory is a volatile storage device that requires constant power to retain data. If a system has been compromised and is being used to exfiltrate data to a competitor, the CSIRT may want to preserve the memory contents for forensic analysis and evidence collection. Therefore, the CSIRT may tell the engineer to immediately disconnect the network cable and not do anything else to prevent further data loss or tampering. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://resources.infosecinstitute.com/topic/memory-acquisition-and-analysis/

    Adapted from community discussion by ApplebeesWaiter1122 · 2023-05-11 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • comptia.org documentation
    • comptia.org documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. A

       ApplebeesWaiter1122

       2023-05-11

       Selected D15 upvotes

       Memory contents including files and malware are lost when the power is turned off. This is because memory is a volatile storage device that requires constant power to retain data. If a system has been compromised and is being used to exfiltrate data to a competitor, the CSIRT may want to preserve the memory contents for forensic analysis and evidence collection. Therefore, the CSIRT may tell the engineer to immediately disconnect the network cable and not do anything else to prevent further data loss or tampering. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://resources.infosecinstitute.com/topic/memory-acquisition-and-analysis/

    2. T

       TheRoot9

       2023-05-03

       Selected D3 upvotes

       The most likely reason for the CSIRT’s request is that memory contents, including fileless malware, are lost when the power is turned off. Disconnecting the network cable and turning off the system can help prevent further data exfiltration and limit the damage caused by the attack. It can also help preserve evidence that can be used to investigate the attack. The CSIRT may also suspect that an insider threat is attacking the network or that the systems engineer is not trustworthy. However, these are less likely reasons for the request.

    3. X

       Xabovion

       2023-05-14

       Selected D4 upvotes

       Not asking the devices to be turned off, but only disconecting the network cable, prevent further exfiltration, while preserving the memory contents by not completly shutting it down. Make sure to read at least twice the questions, there's plenty of time.

    4. B

       BigIshai

       2023-08-23

       Selected D4 upvotes

       The CSIRT simply contained the incident by disconnecting the compromised computer from the network. however, essential evidence lies in the memory(RAM) in the system which will all be lost should power be cut.

19. Question 19 of 25

    Which of the following is the BEST example of a cost-effective physical control to enforce a USB removable media restriction policy?

    • APutting security/antitamper tape over USB ports, logging the port numbers, and regularly inspecting the ports
    • BImplementing a GPO that will restrict access to authorized USB removable media and regularly verifying that it is enforced
    • CPlacing systems into locked, key-controlled containers with no access to the USB ports
    • DInstalling an endpoint agent to detect connectivity of USB and removable media

    Show answer

    Correct answer: A

    How others answered

    • A58%
    • B31%

    Only 58% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer: Putting security/antitamper tape over USB ports, logging the port numbers, and regularly inspecting the ports ============================================= Explanation: The question is asking for two specific requirements for the solution: 1. A solution that's cost-effective 2. A solution that's a physical control The option to implement a GPO (B) and installing an endpoint agent (D) are software-based implementations, while in the case of the GPO being cost-effective, they do not address the physical control requirement for the solution. Option C would address the requirement as a physical control by preventing users from physically access the USB port and likely the best out all of the given options, however, this option is not cheapest so it's not addressing the cost-effectiveness required for the solution. Only option A would address each requirement of the solution being a cost-effective physical control that can be implemented.

    Adapted from community discussion by rodwave · 2022-11-10 · 79 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. R

       rodwave

       2022-11-10

       Selected A79 upvotes

       Answer: Putting security/antitamper tape over USB ports, logging the port numbers, and regularly inspecting the ports ============================================= Explanation: The question is asking for two specific requirements for the solution: 1. A solution that's cost-effective 2. A solution that's a physical control The option to implement a GPO (B) and installing an endpoint agent (D) are software-based implementations, while in the case of the GPO being cost-effective, they do not address the physical control requirement for the solution. Option C would address the requirement as a physical control by preventing users from physically access the USB port and likely the best out all of the given options, however, this option is not cheapest so it's not addressing the cost-effectiveness required for the solution. Only option A would address each requirement of the solution being a cost-effective physical control that can be implemented.

    2. C

       CTE_Instructor

       2023-03-02

       17 upvotes

       Option A involves a lot of additional cost for security tape and regular inspection... inspection = time = money. Option B is essentially no cost because it uses existing domain software and infrastructure to enforce. Restricting access is by definition a physical control. Option C also involves money (Like option A) and is not cost effective. Option D involves purchasing individual end point agent software... again not cost effective. They are all able to control the physical hardware by disallowing removable media or otherwise restricting it, however only one is cost effect - Option B, implementing a Group Policy Object.

    3. B

       brewoz404sd

       2023-02-15

       16 upvotes

       The answer is GPO not A. Cost effective is only A, GPOs are configured in AD and require no additional cost accepts the network admin to config. A requires purchasing tape, paying techs to go to all systems and cover! Not cost effective at all. What if the organization has 2000 computers, you are going to pay techs to go out with tape! No! Answer is GPO, easy, zero cost, and bullet proof!

    4. S

       Sentry13

       2023-04-18

       10 upvotes

       Also from GPT: Group Policy Object (GPO) is not a physical control, but rather a technical control Physical controls are security measures that are implemented physically, such as locks, fences, barriers, cameras, and security guards. They are designed to prevent or deter unauthorized physical access to equipment, facilities, or information. In the context of a USB removable media restriction policy, a physical control could be a USB port blocker, which is a physical device that blocks access to USB ports on a computer or other device. This device physically prevents unauthorized USB devices from being plugged in, thereby restricting the use of removable media. So, the BEST example of a cost-effective physical control to enforce a USB removable media restriction policy would be option A, putting security/antitamper tape over USB ports, logging the port numbers, and regularly inspecting the ports. While this option may not be as effective as USB port blockers, it is a cost-effective physical control that can help enforce the policy.

20. Question 20 of 25

    A security analyst is reviewing computer logs because a host was compromised by malware. After the computer was infected it displayed an error screen and shut down. Which of the following should the analyst review first to determine more information?

    • ADump file
    • BSystem log
    • CWeb application log
    • DSecurity log

    Show answer

    Correct answer: A

    How others answered

    • A53%
    • B46%

    Only 53% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A dump file is the first thing that a security analyst should review to determine more information about a compromised device that displayed an error screen and shut down. A dump file is a file that contains a snapshot of the memory contents of a device at the time of a system crash or error. A dump file can help a security analyst analyze the cause and source of the crash or error, as well as identify any malicious code or activity that may have triggered it. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/introduction-to-crash-dump-files

    Adapted from community discussion by Jacksoms · 2023-12-01 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • comptia.org documentation
    • comptia.org documentation
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. J

       Jacksoms

       2023-12-01

       Selected A3 upvotes

       A dump file is the first thing that a security analyst should review to determine more information about a compromised device that displayed an error screen and shut down. A dump file is a file that contains a snapshot of the memory contents of a device at the time of a system crash or error. A dump file can help a security analyst analyze the cause and source of the crash or error, as well as identify any malicious code or activity that may have triggered it. References: https://www.comptia.org/certifications/security#examdetails https://www.comptia.org/content/guides/comptia-security-sy0-601-exam-objectives https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/introduction-to-crash-dump-files

    2. M

       MF757

       2024-03-28

       Selected A4 upvotes

       A dump file, also known as a memory dump or crash dump, contains a snapshot of the system memory at the time of a crash or error. Analyzing the dump file can provide valuable information about the state of the system, including details about the error that occurred, which can help in understanding the nature of the compromise and identifying the malware responsible for the incident.

    3. J

       jb844

       2023-06-06

       Selected A4 upvotes

       "A" As the name suggests, dump files contain the information “dumped” from a program's memory when it crashes. That means you get information such as the processes that were running at the time of the crash, date and time stamp, associated programs and drivers, and more.

    4. C

       Comicbookman

       2023-11-18

       2 upvotes

       Given the scenario where a host was compromised by malware, displayed an error screen, and then shut down, the first log the analyst should review to gather more information would likely be: A. Dump file A dump file (also known as a crash dump or memory dump) contains a snapshot of the system's memory at the time of a system crash or error. Analyzing the dump file could provide crucial information about the state of the system, potential causes of the error or shutdown, and details about the malware's actions or impact on the system. Reviewing the system log (B) can certainly provide valuable insights into system events and potential errors leading up to the shutdown. However, in the context of a compromised system that displayed an error screen and then shut down, examining the dump file (A) might provide more immediate and detailed information about the specific state of the system at the time of the crash.

21. Question 21 of 25

    Security analysts have noticed the network becomes flooded with malicious packets at specific times of the day. Which of the following should the analysts use to investigate this issue?

    • AWeb metadata
    • BBandwidth monitors
    • CSystem files
    • DCorrelation dashboards

    Show answer

    Correct answer: B

    How others answered

    • B83%
    • D17%

    Explanation

    Bandwidth monitors can be used to capture network traffic and identify any unusual traffic patterns, such as a spike in traffic during specific times of the day. This can help security analysts investigate and identify any potential malicious activity. Web metadata is not likely to be useful in investigating network traffic, system files are typically used to troubleshoot and diagnose system issues, and correlation dashboards are used to analyze and present data from multiple sources in a single view.

    Adapted from community discussion by ApplebeesWaiter1122 · 2023-05-15 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • comptia.org documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. A

       ApplebeesWaiter1122

       2023-05-15

       Selected B18 upvotes

       Bandwidth monitors can be used to capture network traffic and identify any unusual traffic patterns, such as a spike in traffic during specific times of the day. This can help security analysts investigate and identify any potential malicious activity. Web metadata is not likely to be useful in investigating network traffic, system files are typically used to troubleshoot and diagnose system issues, and correlation dashboards are used to analyze and present data from multiple sources in a single view.

    2. L

       LeonardSnart

       2023-06-27

       Selected B5 upvotes

       Bandwidth Monitors Chapter 8, “Using Risk Management Tools,” discusses several tools used to capture network traffic, and these can be used as bandwidth monitors forensic investigations. It’s common for administrators to keep these packet captures. By comparing captures taken at different times, investigators can determine changes in network traffic. If an organization recently suffered a data breach, investigators may be able to identify when there was an increase in outgoing traffic. This may help them determine when the network was first attacked, and maybe even the first computer that was infected with malware." -Security+ Get Certified Get Ahead SY0-601 by Darril Gibson

    3. M

       mouettespaghetti

       2023-05-02

       6 upvotes

       -B is correct, Bandwidth monitors Security analysts should use bandwidth monitors to investigate the issue of the network becoming flooded with malicious packets at specific times of the day. Bandwidth monitors can help identify unusual spikes in network traffic and can be used to monitor bandwidth usage by specific hosts or applications. By analyzing the data collected by the bandwidth monitors, analysts can identify the source and nature of the malicious traffic.

    4. T

       TONADO

       2023-10-31

       3 upvotes

       I go with D: correlation dashboards are tools that allow security analysts to monitor and analyze multiple sources of data and events in real time.. They can help identify patterns, trends,anomalies and threats by correlating different types of of data and events such as network traffic, logs, alerts, and incidents. they can also help investigate network flooding by showing source, destination, volume and type of malicious packets and their impact on the network performance and availability. Reference: https://www.comptia.org/blog/what-is-a-correlation dashboard.

22. Question 22 of 25

    An organization has hired a red team to simulate attacks on its security posture. Which of the following will the blue team do after detecting an IoC?

    • AReimage the impacted workstations.
    • BActivate runbooks for incident response.
    • CConduct forensics on the compromised system.
    • DConduct passive reconnaissance to gather information.

    Show answer

    Correct answer: B

    How others answered

    • B85%
    • C15%

    Explanation

    What??? The whole point of having red team sims is to practice incident response? If your first move is forensics then the red team will own your whole network before you even know what is going on

    Adapted from community discussion by daddylonglegs · 2023-10-11 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. V

       varun0

       2022-09-01

       Selected B40 upvotes

       Incident is detected, now incident response has to happen. Runbook describes everyone's roles during incident response.

    2. D

       daddylonglegs

       2023-10-11

       14 upvotes

       What??? The whole point of having red team sims is to practice incident response? If your first move is forensics then the red team will own your whole network before you even know what is going on

    3. P

       Protract8593

       2023-07-23

       Selected B8 upvotes

       After detecting an Indicator of Compromise (IoC), the blue team's primary action will be to activate runbooks for incident response. Incident response runbooks are predefined procedures and guidelines that outline the steps to be taken when specific security incidents are detected. These runbooks are essential for organizing and streamlining the response process to security incidents, including those identified through IoCs.

    4. S

       Sanj

       2023-02-08

       9 upvotes

       This is a simulation - so the blue team has to do forensics not incident response

23. Question 23 of 25

    An audit identified PII being utilized in the development environment of a critical application. The Chief Privacy Officer (CPO) is adamant that this data must be removed; however, the developers are concerned that without real data they cannot perform functionality tests and search for specific data. Which of the following should a security professional implement to best satisfy both the CPO's and the development team's requirements?

    • AData purge
    • BData encryption
    • CData masking
    • DData tokenization

    Show answer

    Correct answer: C

    How others answered

    • C58%
    • B33%

    Only 58% agreed on this answer — treat it as contested rather than settled.

    Explanation

    This is interesting as this is a question that's already presented in earlier questions of this collection. However, anonymization is presented in the older question; here it is not. Moreover, data masking is present in both. I'm going with C

    Adapted from community discussion by TreeeSon · 2023-09-22 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. T

       TreeeSon

       2023-09-22

       Selected C7 upvotes

       This is interesting as this is a question that's already presented in earlier questions of this collection. However, anonymization is presented in the older question; here it is not. Moreover, data masking is present in both. I'm going with C

    2. A

       ApplebeesWaiter1122

       2023-07-28

       Selected C4 upvotes

       Data masking, also known as data obfuscation or data anonymization, is a technique used to protect sensitive data by disguising original data with modified content. It allows the development team to perform functionality tests and search for specific data without exposing real sensitive information. Instead, the masked data presents a representation of the original data that does not reveal any sensitive details. By implementing data masking, the company can maintain data privacy and security while still enabling the development team to work with realistic data for testing and development purposes.

    3. M

       mtnews

       2023-07-06

       Selected C4 upvotes

       Similar to question #6. In this case the answer should be C. Data masking

    4. J

       JT4

       2023-09-21

       Selected C2 upvotes

       Data masking refers to modifying data to hide the original content. The primary reason to do so is to protect sensitive information such as PII. The process retains usable data but converts it to inauthentic data. Get Certified Get Ahead SY0-601 Darril Gibson

24. Question 24 of 25

    Which of the following is the BEST action to foster a consistent and auditable incident response process?

    • AIncent new hires to constantly update the document with external knowledge.
    • BPublish the document in a central repository that is easily accessible to the organization.
    • CRestrict eligibility to comment on the process to subject matter experts of each IT silo.
    • DRotate CIRT members to foster a shared responsibility model in the organization.

    Show answer

    Correct answer: B

    How others answered

    • B75%
    • D25%

    Explanation

    I think is B, because there are 2 requirements " Consistent & Auditable". D, will foster consistent IR process, but not auditable. B, will ensure consistency in understanding in IR process & document is auditable.

    Adapted from community discussion by G4ct756 · 2022-10-19 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • comptia.org documentation
    • nist.gov documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. G

       G4ct756

       2022-10-19

       Selected B22 upvotes

       I think is B, because there are 2 requirements " Consistent & Auditable". D, will foster consistent IR process, but not auditable. B, will ensure consistency in understanding in IR process & document is auditable.

    2. S

       sterfryy

       2022-12-09

       17 upvotes

       The best action to foster a consistent and auditable incident response process is to publish the document in a central repository that is easily accessible to the organization. This will ensure that all members of the organization have access to the latest version of the document and can refer to it easily in the event of an incident. It will also enable the organization to track changes to the document over time, helping to ensure that the incident response process remains up to date and effective.

    3. T

       TinyTrexArmz

       2023-02-03

       13 upvotes

       Maybe quote the materials you're looking at and/or provide a reference.

    4. R

       redsidemanc2

       2022-09-08

       11 upvotes

       NIST SP 800-137 under Computer Incident Response Team (CIRT) D is correct and only one that makes sense really

25. Question 25 of 25

    A company is looking to migrate some servers to the cloud to minimize its technology footprint. The company has 100 databases that are on premises. Which of the following solutions will require the LEAST management and support from the company?

    • ASaaS
    • BIaaS
    • CPaaS
    • DSDN

    Show answer

    Correct answer: A

    How others answered

    • A61%
    • C36%

    Only 61% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I think this is one of those questions where real-life experience doesn't answer the question correctly here. The question seems to be focusing more on which form of cloud computing requires the LEAST amount of management (SaaS) with the database part of the question being filler.

    Adapted from community discussion by Hewn · 2022-09-02 · 50 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • azure.microsoft.com documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-601 or CertExamHQ.

    1. H

       Hewn

       2022-09-02

       Selected A50 upvotes

       I think this is one of those questions where real-life experience doesn't answer the question correctly here. The question seems to be focusing more on which form of cloud computing requires the LEAST amount of management (SaaS) with the database part of the question being filler.

    2. S

       stoneface

       2022-08-31

       19 upvotes

       I concur with this - an example of a Database service offered as a PaaS model is Azure SQL Database, is a fully managed platform as a service (PaaS. PaaS capabilities built into Azure SQL Database enable you to focus on the domain-specific database administration and optimization activities that are critical for your business. https://docs.microsoft.com/en-us/azure/azure-sql/database/sql-database-paas-overview?view=azuresql

    3. F

       freyprey

       2023-09-14

       Selected A3 upvotes

       here is a quote from CompTIA study guide. The most recent : ,, Platform as a Service Platform as a service (PaaS) provides resources somewhere between SaaS and IaaS. A typical PaaS solution would provide servers and storage network infrastructure (as per IaaS) but also provide a multi-tier web application/database platform on top. This platform could be based on Oracle or MS SQL or PHP and MySQL. Examples include Oracle Database (oracle.com/database), Microsoft Azure SQL Database (azure. microsoft.com/services/sql-database), and Google App Engine (cloud.google.com/ appengine). As distinct from SaaS though, this platform would not be configured to actually do anything. Your own developers would have to create the software (the CRM or e‑commerce application) that runs using the platform. The service provider would be responsible for the integrity and availability of the platform components, but you would be responsible for the security of the application you created on the platform. " SO reading this i think this debate is closed. The answer is SaaS although in practice things are a little more different.

    4. P

       Protract8593

       2023-07-24

       Selected A4 upvotes

       SaaS is a cloud computing model where the cloud provider hosts applications and makes them available to users over the internet. In this model, the cloud provider takes care of managing the infrastructure, middleware, software, and data, allowing the company to focus solely on using the applications without worrying about the underlying maintenance and management. In the case of migrating databases to the cloud using SaaS, the company would not have to deal with database server administration, patching, backups, or other maintenance tasks. The cloud provider handles all of these aspects, making it the option that requires the least management and support from the company.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-601 practice, question 1 of 25