SY0-601 UPDATED SCRIPT 2026 PRACTICE
SOLUTIONS GRADED A+
● 01. Which of the following disaster recovery sites would require the
MOST time to get operations back online?
a) Colocation
b) Cold
c) Hot
d) Warm. Answer: b) Cold
● 02. A Chief Financial Officer (CFO) has been receiving email
messages that have suspicious links embedded from unrecognized
senders.
The emails ask the recipient for identity verification. The IT department
has not received reports of this happening to anyone else.
Which of the following is the MOST likely explanation for this
behavior?
a) The CFO is the target of a whaling attack.
b) The CFO is the target of identity fraud.
c) The CFO is receiving spam that got past the mail filters.
d) The CFO is experiencing an impersonation attack.. Answer: a) The
CFO is the target of a whaling attack.
, ● 03. Why do vendors provide MD5 values for their software patches?
a) To provide the necessary key for patch activation
b) To allow the downloader to verify the authenticity of the site
providing the patch
c) To ensure that auto-updates are enabled for subsequent patch releases
d) To allow the recipient to verify the integrity of the patch prior to
installation. Answer: d) To allow the recipient to verify the integrity of
the patch prior to installation
● 04. The IT department receives a call one morning about users being
unable to access files on the network shared drives. An IT technician
investigates and determines the files became encrypted at 12:00 a.m.
While the files are being recovered from backups, one of the IT
supervisors realizes the day is the birthday of a technician who was fired
two months prior.
Which of the following describes what MOST likely occurred?
a) The fired technician placed a logic bomb.
b) The fired technician installed a rootkit on all the affected users'
computers.
c) The fired technician installed ransomware on the file server.
d) The fired technician left a network worm on an old work computer..
Answer: a) The fired technician placed a logic bomb.
SOLUTIONS GRADED A+
● 01. Which of the following disaster recovery sites would require the
MOST time to get operations back online?
a) Colocation
b) Cold
c) Hot
d) Warm. Answer: b) Cold
● 02. A Chief Financial Officer (CFO) has been receiving email
messages that have suspicious links embedded from unrecognized
senders.
The emails ask the recipient for identity verification. The IT department
has not received reports of this happening to anyone else.
Which of the following is the MOST likely explanation for this
behavior?
a) The CFO is the target of a whaling attack.
b) The CFO is the target of identity fraud.
c) The CFO is receiving spam that got past the mail filters.
d) The CFO is experiencing an impersonation attack.. Answer: a) The
CFO is the target of a whaling attack.
, ● 03. Why do vendors provide MD5 values for their software patches?
a) To provide the necessary key for patch activation
b) To allow the downloader to verify the authenticity of the site
providing the patch
c) To ensure that auto-updates are enabled for subsequent patch releases
d) To allow the recipient to verify the integrity of the patch prior to
installation. Answer: d) To allow the recipient to verify the integrity of
the patch prior to installation
● 04. The IT department receives a call one morning about users being
unable to access files on the network shared drives. An IT technician
investigates and determines the files became encrypted at 12:00 a.m.
While the files are being recovered from backups, one of the IT
supervisors realizes the day is the birthday of a technician who was fired
two months prior.
Which of the following describes what MOST likely occurred?
a) The fired technician placed a logic bomb.
b) The fired technician installed a rootkit on all the affected users'
computers.
c) The fired technician installed ransomware on the file server.
d) The fired technician left a network worm on an old work computer..
Answer: a) The fired technician placed a logic bomb.
