SY0-601 Implementation 2

Question 1

A security engineer is configuring a site-to-site VPN between two offices. Which protocol operates at Layer 3 and provides both authentication and encryption in tunnel mode?

Accepted Answer

IPSec

Answer

IPSec operates at Layer 3 and in tunnel mode provides authentication and encryption for the entire original IP packet.

Question 2

Which wireless security protocol uses Simultaneous Authentication of Equals (SAE) to replace the Pre-Shared Key handshake and prevent offline dictionary attacks?

Accepted Answer

WPA3-Personal

Answer

WPA3-Personal uses SAE (also called Dragonfly handshake) which prevents offline dictionary attacks against captured handshakes.

Question 3

A developer needs to store API keys securely in a cloud-native application. Which solution provides hardware-backed secret storage with automatic rotation capabilities?

Accepted Answer

A secrets management vault (e.g., HashiCorp Vault)

Answer

A secrets management vault provides centralized, hardware-backed secure storage with access controls and automatic rotation for API keys and credentials.

Question 4

When implementing a PKI, which component is responsible for verifying certificate revocation status in real-time without downloading a full CRL?

Accepted Answer

OCSP Responder

Answer

An OCSP (Online Certificate Status Protocol) Responder answers real-time queries about whether a specific certificate has been revoked.

Question 5

A network administrator wants to prevent rogue DHCP servers on a LAN. Which switch security feature should be enabled?

Accepted Answer

DHCP snooping

Answer

DHCP snooping filters DHCP messages by designating trusted and untrusted ports, blocking rogue DHCP servers on untrusted ports.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Implementation 2