SY0-601 Implementation 3 — Questions and Answers
Question 1: An organization is implementing endpoint protection and wants behavioral-based detection rather than relying on signature databases. Which technology should they deploy?
- Antivirus with daily signature updates
- Host-based Intrusion Detection System (HIDS) with anomaly detection (Correct answer)
- Full disk encryption
- Application whitelisting only
Correct answer: Host-based Intrusion Detection System (HIDS) with anomaly detection
A HIDS with anomaly/behavioral detection monitors activity patterns and flags deviations from baseline without requiring known malware signatures.
Question 2: Which secure coding practice directly mitigates SQL injection vulnerabilities by separating SQL code from user-supplied data?
- Input length validation
- Output encoding
- Parameterized queries (prepared statements) (Correct answer)
- Error message suppression
Correct answer: Parameterized queries (prepared statements)
Parameterized queries treat user input strictly as data parameters, preventing it from being interpreted as SQL commands.
Question 3: A company's mobile device policy requires that corporate data be wiped from a device without affecting personal data when an employee leaves. Which MDM capability achieves this?
- Full device wipe
- Remote lock
- Containerization with selective wipe (Correct answer)
- Geofencing
Correct answer: Containerization with selective wipe
Containerization separates corporate and personal data into distinct containers, allowing selective wipe of only the corporate container.
Question 4: Which firewall type can inspect the full HTTP request and response content, including payload, to block application-layer attacks like XSS and SQL injection?
- Packet filtering firewall
- Stateful inspection firewall
- Web Application Firewall (WAF) (Correct answer)
- Circuit-level gateway
Correct answer: Web Application Firewall (WAF)
A WAF operates at Layer 7 and inspects HTTP/HTTPS content to detect and block application-layer attacks targeting web applications.
Question 5: An admin needs to securely manage network devices from a remote location. Which protocol should replace Telnet to ensure encrypted management sessions?
- SNMP v1
- SSH (Correct answer)
- HTTP
- FTP
Correct answer: SSH
SSH (Secure Shell) encrypts the entire management session including credentials, replacing the plaintext Telnet protocol.
Question 6: A security team wants to implement a solution that decrypts and inspects encrypted HTTPS traffic at the network perimeter. Which approach is being used?
- Deep packet inspection of unencrypted headers only
- SSL/TLS inspection (SSL decryption proxy) (Correct answer)
- Port mirroring for all traffic
- MAC filtering
Correct answer: SSL/TLS inspection (SSL decryption proxy)
SSL/TLS inspection uses a proxy that terminates the encrypted connection, inspects the plaintext, then re-encrypts it toward the destination.
Question 7: When configuring an 802.1X network, which component validates user credentials and enforces access policies during authentication?
- Supplicant
- Authenticator (network switch)
- Authentication Server (RADIUS) (Correct answer)
- Certificate Revocation List
Correct answer: Authentication Server (RADIUS)
The Authentication Server, typically a RADIUS server, validates credentials provided by the supplicant and tells the authenticator whether to allow access.
SY0-601 Implementation 3
An organization is implementing endpoint protection and wants behavioral-based detection rather than relying on signature databases.
Which technology should they deploy?