CompTIA Updated SY0-601 Exam Questions and Answers by ayeza

Data is being exfiltrated when an internal system is sending a large amount of unusual DNS queries to systems on the internet over short periods of time during non-business hours. Data exfiltration is the unauthorized transfer of data from a system or network to an external destination or actor. Data exfiltration can be performed by malicious insiders or external attackers who have compromised the system or network. DNS queries are requests for resolving domain names to IP addresses. DNS queries can be used as a covert channel for data exfiltration by encoding data in the domain names or subdomains and sending them to a malicious DNS server that can decode and collect the data. References: https://www.comptia.org/blog/what-is-data-exfiltration https: //www.certblaster.com/wp-content/uploads/2020/11/CompTIA-Security-SY0-601-Exam-Objectives-1.0.pdf

A service level agreement (SLA) defines response time, escalation points, and performance metrics. An SLA is a contract between a service provider and a customer that specifies the level and quality of service that will be delivered. An SLA typically includes metrics such as availability, reliability, throughput, latency, security, etc., as well as penalties or remedies for failing to meet them. An SLA also defines how issues will be reported and resolved, how often reviews will be conducted, and how changes will be communicated.

The security engineer is an example of a data custodian. A data custodian is a person who is responsible for implementing and maintaining the security controls for the data, such as encryption, backup, access control, etc. A data custodian acts on behalf of the data owner, who is the person who has the authority and accountability for the data. A data controller is a person who determines the purposes and means of processing the data, such as a company or an organization. A data processor is a person who processes the data on behalf of the data controller, such as a service provider or a vendor1.

chmod is a Linux command that can be used to change or modify the permissions of files and directories. The /etc/shadow file is a system file that stores the encrypted passwords of user accounts in Linux. The /etc/shadow file should have restricted permissions to prevent unauthorized access or modification of the passwords. The recommended permissions for the /etc/shadow file are read/write for root user only (600). If the systems administrator observes that the /etc/shadow file has permissions beyond the baseline recommendation, they can use the chmod command to resolve this issue by setting the appropriate permissions for the file. For example, chmod 600 /etc/shadow would set the permissions of the /etc/shadow file to read/write for root user only. 181920 References: CompTIA Security+ SY0-601 Certification Study Guide, Chapter 9: Implementing Identity and Access Management Controls, page 404; chmod - Wikipedia; Linux /etc/shadow file - nixCraft; How to Change File Permissions in Linux - Linuxize