SY0-601 Implementation 4 — Questions and Answers
Question 1: A sysadmin is hardening a Linux server and wants to ensure that only explicitly authorized applications can execute. Which OS security feature enforces this?
- AppArmor or SELinux application whitelisting (Correct answer)
- Antivirus scanning
- Disabling unused services
- Host-based firewall
Correct answer: AppArmor or SELinux application whitelisting
AppArmor and SELinux can enforce mandatory access control policies that restrict which applications can run and what resources they can access.
Question 2: Which DNS security extension prevents DNS cache poisoning by digitally signing DNS records to ensure authenticity and integrity?
- DNSSEC (Correct answer)
- DNS over HTTPS (DoH)
- Split-horizon DNS
- DNS sinkholing
Correct answer: DNSSEC
DNSSEC adds cryptographic signatures to DNS records, allowing resolvers to verify that responses are authentic and unaltered.
Question 3: A company is deploying a cloud workload and wants to ensure network microsegmentation between individual virtual machines. Which technology enables this?
- Traditional VLANs
- Software-Defined Networking (SDN) with security groups (Correct answer)
- Physical firewalls between each VM
- MAC address filtering
Correct answer: Software-Defined Networking (SDN) with security groups
SDN security groups apply policy-based rules at the virtual network interface level, enabling microsegmentation between individual cloud workloads.
Question 4: Which authentication protocol sends credentials in plaintext and should be replaced in favor of more secure alternatives in enterprise environments?
- Kerberos
- NTLM v2
- PAP (Correct answer)
- CHAP
Correct answer: PAP
PAP (Password Authentication Protocol) transmits credentials in cleartext and is considered insecure for modern enterprise authentication.
Question 5: An organization wants to implement data loss prevention (DLP) that scans files leaving the network via email. At which layer of security controls does this primarily operate?
- Physical security controls
- Network-based DLP at the email gateway (Correct answer)
- Endpoint physical lockdown
- Perimeter patching
Correct answer: Network-based DLP at the email gateway
Network-based DLP solutions inspect data in transit at the email gateway to detect and block unauthorized transmission of sensitive information.
Question 6: Which key exchange algorithm allows two parties to establish a shared secret over an insecure channel without transmitting the secret itself?
- RSA key exchange
- Diffie-Hellman (DH) (Correct answer)
- AES key wrapping
- MD5 hashing
Correct answer: Diffie-Hellman (DH)
Diffie-Hellman allows two parties to independently compute the same shared secret using public values exchanged over an insecure channel.
Question 7: A security architect needs to ensure that a compromised session key does not expose past communications. Which property of cryptographic protocols provides this guarantee?
- Key stretching
- Perfect Forward Secrecy (PFS) (Correct answer)
- Certificate pinning
- Key escrow
Correct answer: Perfect Forward Secrecy (PFS)
Perfect Forward Secrecy uses ephemeral session keys so that compromising long-term keys does not decrypt previously recorded sessions.
SY0-601 Implementation 4
A sysadmin is hardening a Linux server and wants to ensure that only explicitly authorized applications can execute.
Which OS security feature enforces this?