A systems administrator receives a text message from an unknown number claiming to be the Chief Executive Officer of the company. The message states an emergency situation requires a password reset. Which of the following threat vectors is being used?
Answer(s): B
Smishing (SMS phishing) is a type of social engineering attack where attackers use text messages to deceive individuals into revealing sensitive information or performing actions like a password reset. In this case, the unknown sender pretending to be the CEO and requesting a password reset via text exemplifies smishing.
A Chief Information Security Officer (CISO) wants to:-Prevent employees from downloading malicious content.-Establish controls based on departments and users.-Map internet access for business applications to specific service accounts.-Restrict content based on categorization.Which of the following should the CSO implement?
Answer(s): D
A Next-Generation Firewall (NGFW) offers advanced capabilities such as:-Preventing malicious content downloads through deep packet inspection and intrusion prevention systems (IPS).-Establishing controls based on departments and users by integrating with directory services like Active Directory for user-based policies.-Mapping internet access to business applications through application-level control and service account integration.-Restricting content based on categorization using URL filtering and content categorization features.-
A company is aware of a given security risk related to a specific market segment. The business chooses not to accept responsibility and target their services to a different market segment. Which of the following describes this risk management strategy?
Answer(s): C
The company's decision to change its target market to eliminate exposure to a specific security risk is an example of risk avoidance. This strategy involves modifying plans, processes, or business models to eliminate the potential for a particular risk to occur, rather than mitigating or transferring it. By targeting a different market segment, the company effectively avoids the identified risk.
A security analyst needs to improve the company’s authentication policy following a password audit. Which of the following should be included in the policy? (Choose two.)
Answer(s): A,B
Length: Longer passwords are more resistant to brute-force attacks. Requiring a minimum length (e.g., 12-16 characters) significantly improves password security.Complexity: Ensuring passwords include a mix of uppercase letters, lowercase letters, numbers, and special characters makes them harder to guess or crack using dictionary attacks.Including both length and complexity in the authentication policy helps to enhance overall password strength and security.
Which of the following is an example of a treatment strategy for a continuous risk?
Answer(s): A
A continuous risk is an ongoing threat that requires ongoing mitigation and monitoring efforts. Phishing attempts are a continuous risk to organizations as attackers frequently target users via emails. An email gateway acts as a treatment strategy by actively filtering out malicious emails, thereby reducing the likelihood of successful phishing attacks. This proactive approach addresses the ongoing nature of the threat.
Post your Comments and Discuss CompTIA SY0-701 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SY0-701 content, but please register or login to continue.