A security analyst notices unusual behavior on the network. The IDS on the network was not able to detect the activities. Which of the following should the security analyst use to help the IDS detect such attacks in the future?
Answer(s): A
Signatures are predefined patterns or rules used by an Intrusion Detection System (IDS) to identify known malicious activities or attacks. If the IDS was unable to detect unusual behavior, the security analyst can create or update signatures based on the characteristics of the observed activity. This ensures the IDS can recognize and flag similar activities in the future, improving its effectiveness in detecting such attacks.
To which of the following security categories does an EDR solution belong?
Answer(s): D
An EDR (Endpoint Detection and Response) solution is a technical security control that focuses on monitoring, detecting, and responding to threats on endpoint devices such as desktops, laptops, and servers. It provides real-time visibility, threat detection, and automated responses to mitigate security incidents, making it a part of the technical security category.
A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most difficult to remediate due to the company’s reliance on open-source libraries?
A zero-day vulnerability is a security flaw that is unknown to the vendor or developer and has no available fix at the time of its discovery. When relying on open-source libraries, addressing zero-day vulnerabilities can be particularly challenging because the company depends on the open-source community or the library's maintainers to identify and patch the issue. The company often has limited control over the development and update process for these libraries, making remediation more difficult compared to other vulnerability types where known fixes or mitigations are available.
An organization has a new regulatory requirement to implement corrective controls on a financial system. Which of the following is the most likely reason for the new requirement?
Answer(s): B
Corrective controls are designed to identify and fix issues that arise in a system to prevent further propagation of errors. In a financial system, implementing corrective controls ensures that errors, such as data inaccuracies or processing mistakes, are identified and corrected before they can affect other interconnected systems. Regulatory requirements often mandate such controls to maintain data integrity and reliability across financial operations.
Which of the following is the stage in an investigating when forensic images are obtained?
The acquisition stage in an investigation involves obtaining forensic images of digital evidence. This process includes creating exact copies of data from storage devices (e.g., hard drives, USB drives) or systems while maintaining the integrity of the original evidence. These forensic images are then used for analysis in subsequent stages of the investigation, ensuring that the original evidence remains unaltered.
Post your Comments and Discuss CompTIA SY0-701 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SY0-701 content, but please register or login to continue.