An administrator would like to review the effectiveness of existing security in the enterprise. Which
of the following would be the BEST place to start?
A.
Review past security incidents and their resolution
B.
Rewrite the existing security policy
C.
Implement an intrusion prevention system
D.
Install honey pot systems
Explanation:
The main functions of intrusion prevention systems are to identify malicious activity, log
information about this activity, attempt to block/stop it, and report it
Review by implementing IPS? I dont’t get this at all…
With how the answer is worded it doesn’t make sense. But IPS would be the best choice if “Implement” was discarded.
Can anyone confirm this is a real question and a correct answer? If so, I will sit for the exam tomorrow because any studying I do will not help in answering questions like this one. Terrible!
The correct answer should be to review past security incidents and their resolution. This will give you insight into what types of incidents have occurred, how incident response is handled, how long it takes to handle an incident, what resources are used and who handles them. Talk to the person(s) who handle the most incidents and go from there. Real world.
To “review” I suspect “Install honey pot systems” would be the way to go – and try to compromise it. In any case, the answer given is WRONG
I know where you live
ATTENTION PLEASE!!! The SY0-401 Exam Will Retire On July 31, 2018, and then the New Exam is SY0-501!
(28/Dec/2017 Updated) New SY0-501 Exam Questions:
Lab Simulation 1 — Available Security Controls for Each Building
You have just received some room and WiFi access control recommendations from a security consulting company. Click on each building to bring up available security controls. Please implement the following requirements:
……
Lab Simulation 2 — Configure the Firewall
Configure the firewall (fill out the table) to allow these four rules:
– Only allow the Accounting computer to have HTTPS access to the Administrative server.
– Only allow the HR computer to be able to communicate with the Server 2 System over SCP.
– Allow the IT computer to have access to both the Administrative Server 1 and Administrative Server 2.
……
NEW QUESTION 141
A company wants to ensure that the validity of publicly trusted certificates used by its web server can be determined even during an extended internet outage. Which of the following should be implemented?
A. Recovery agent
B. Ocsp
C. Crl
D. Key escrow
Answer: B
NEW QUESTION 142
An administrator intends to configure an IPSec solution that provides ESP with integrity protection, but not confidentiality protection. Which of the following AES modes of operation would meet this integrity-only requirement?
A. HMAC
B. PCBC
C. CBC
D. GCM
E. CFB
Answer: A
NEW QUESTION 143
The Chief Security Officer (CSO) has issued a new policy that requires that all internal websites be configured for HTTPS traffic only. The network administrator has been tasked to update all internal sites without incurring additional costs. Which of the following is the best solution for the network administrator to secure each internal website?
A. Use certificates signed by the company CA.
B. Use a signing certificate as a wild card certificate.
C. Use certificates signed by a public CA.
D. Use a self-signed certificate on each internal server.
Answer: D
NEW QUESTION 144
A security program manager wants to actively test the security posture of a system. The system is not yet in production and has no uptime requirement or active user base. Which of the following methods will produce a report which shows vulnerabilities that were actually exploited?
A. Peer review
B. Component testing
C. Penetration testing
D. Vulnerability testing
Answer: C
Explanation:
A penetration test, or pen test, is an attempt to evaluate the security of an IT infrastructure by safely trying to exploit vulnerabilities.
NEW QUESTION 145
A new intern in the purchasing department requires read access to shared documents. Permissions are normally controlled through a group called “purchasing”, however, the purchasing group permissions allow write access. Which of the following would be the BEST course of action?
A. Modify all the shared files with read only permissions for the intern.
B. Create a new group that has only read permissions for the files.
C. Remove all permissions for the shared files.
D. Add the intern to the “purchasing” group.
Answer: B
NEW QUESTION 146
A business has recently deployed laptops to all sales employees. The laptops will be used primarily from home offices and while traveling, and a high amount of wireless mobile use is expected. To protect the laptops while connected to untrusted wireless networks, which of the following would be the BEST method for reducing the risk of having the laptops compromised?
A. MAC filtering
B. Virtualization
C. OS hardening
D. Application white-listing
Answer: C
NEW QUESTION 147
A security engineer is configuring a system that requires the X.509 certificate information to be pasted into a form field in Base64 encoded format to import it into the system. Which of the following certificate formats should the engineer use to obtain the information in the required format?
A. PFX
B. PEM
C. DER
D. CER
Answer: B
NEW QUESTION 148
When performing data acquisition on a workstation, which of the following should be captured based on memory volatility? (Select TWO.)
A. USB-attached hard disk
B. Swap/pagefile
C. Mounted network storage
D. ROM
E. RAM
Answer: AD
NEW QUESTION 149
When configuring settings in a mandatory access control environment, which of the following specifies the subjects that can access specific data objects?
A. Owner
B. System
C. Administrator
D. User
Answer: C
NEW QUESTION 150
……
NEW QUESTION 151
A user clicked an email link that led to a website that infected the workstation with a virus. The virus encrypted all the network shares to which the user had access. The virus was not detected or blocked by the company’s email filter, website filter, or antivirus. Which of the following describes what occurred?
A. The user’s account was over-privileged.
B. Improper error handling triggered a false negative in all three controls.
C. The email originated from a private email server with no malware protection.
D. The virus was a zero-day attack.
Answer: A
NEW QUESTION 152
Which of the fallowing security controls does an iris scanner provide?
A. Logical
B. Administrative
C. Corrective
D. Physical
E. Detective
F. Deterrent
Answer: D
NEW QUESTION 153
……
P.S. Get The Newest SY0-501 Dumps In PDF And VCE From — https://www.passleader.com/sy0-501.html (182q VCE and PDF)
Good Luck!
What’s more, part of the new 182Q SY0-501 dumps are available here:
https://drive.google.com/open?id=1Ei1CtZKTLawI_2jpkecHaVbM_kXPMZAu
Best Regards!