SY0-601 Implementation 2 — Questions and Answers
Question 1: A security engineer is configuring a site-to-site VPN between two offices. Which protocol operates at Layer 3 and provides both authentication and encryption in tunnel mode?
- SSL/TLS
- IPSec (Correct answer)
- L2TP
- PPTP
Correct answer: IPSec
IPSec operates at Layer 3 and in tunnel mode provides authentication and encryption for the entire original IP packet.
Question 2: Which wireless security protocol uses Simultaneous Authentication of Equals (SAE) to replace the Pre-Shared Key handshake and prevent offline dictionary attacks?
- WPA2-Personal
- WPA3-Personal (Correct answer)
- WPA2-Enterprise
- WEP
Correct answer: WPA3-Personal
WPA3-Personal uses SAE (also called Dragonfly handshake) which prevents offline dictionary attacks against captured handshakes.
Question 3: A developer needs to store API keys securely in a cloud-native application. Which solution provides hardware-backed secret storage with automatic rotation capabilities?
- Environment variables in the source code
- A secrets management vault (e.g., HashiCorp Vault) (Correct answer)
- Base64-encoded config files
- Encrypted email attachment
Correct answer: A secrets management vault (e.g., HashiCorp Vault)
A secrets management vault provides centralized, hardware-backed secure storage with access controls and automatic rotation for API keys and credentials.
Question 4: When implementing a PKI, which component is responsible for verifying certificate revocation status in real-time without downloading a full CRL?
- Certificate Authority (CA)
- Registration Authority (RA)
- OCSP Responder (Correct answer)
- Key Escrow
Correct answer: OCSP Responder
An OCSP (Online Certificate Status Protocol) Responder answers real-time queries about whether a specific certificate has been revoked.
Question 5: A network administrator wants to prevent rogue DHCP servers on a LAN. Which switch security feature should be enabled?
- Port security
- DHCP snooping (Correct answer)
- Dynamic ARP inspection
- 802.1X
Correct answer: DHCP snooping
DHCP snooping filters DHCP messages by designating trusted and untrusted ports, blocking rogue DHCP servers on untrusted ports.
Question 6: Which type of encryption uses the same key for both encryption and decryption and is generally faster than its counterpart?
- Asymmetric encryption
- Hashing
- Symmetric encryption (Correct answer)
- Steganography
Correct answer: Symmetric encryption
Symmetric encryption uses a single shared key for both operations and is computationally faster than asymmetric encryption.
Question 7: A company wants to ensure emails cannot be repudiated by senders and that content has not been altered in transit. Which email security technology satisfies both requirements?
- SPF records
- DKIM with digital signatures (Correct answer)
- STARTTLS encryption
- Email content filtering
Correct answer: DKIM with digital signatures
DKIM uses digital signatures to provide both non-repudiation (sender cannot deny) and integrity (tampered email invalidates the signature).
SY0-601 Implementation 2
A security engineer is configuring a site-to-site VPN between two offices.
Which protocol operates at Layer 3 and provides both authentication and encryption in tunnel mode?