COMPTIA SECURITY PLUS SYO 601 2026
FINAL EXAM CRAM SHEET AND STUDY NOTES
◉ You are troubleshooting an issue with a Windows desktop and
need to display the machine's active TCP connections. Which of the
following commands should you use?
A.netstat
B. ipconfig
C. net use
D. ping. Answer: netstat
◉ You are investigating a suspected compromise. You have noticed
several files that you don't recognize. How can you quickly and
effectively check if the files have been infected with malware?
A.Run the Strings tool against each file to identify common malware
identifiers
B. Disassemble the files and conduct static analysis on them using
IDA Pro
C. Scan the files using a local anti-virus/anti-malware engine
,D. Submit the files to an open-source intelligence provider like
VirusTotal. Answer: Submit the files to an open-source intelligence
provider like VirusTotal
◉ Which of the following ports should you block at the firewall if
you want to prevent a remote login to a server from occurring?
A.143
B. 21
C. 22
D. 80. Answer: C. 22
◉ A corporate workstation was recently infected with malware. The
malware was able to access the workstation's credential store and
steal all the usernames and passwords from the machine. Then, the
malware began to infect other workstations on the network using
the usernames and passwords it stole from the first workstation.
The IT Director has directed its IT staff to develop a plan to prevent
this issue from occurring again. Which of the following would BEST
prevent this from reoccurring?
A. Install a Unified Threat Management system on the network to
monitor for suspicious traffic
B. Install an anti-virus or anti-malware solution that uses heuristic
analysis
, C. Monitor all workstations for failed login attempts and forward
them to a centralized SYSLOG server
D. Install a host-based intrusion detection system on all of the
corporate workstations.. Answer: B. Install an anti-virus or anti-
malware solution that uses heuristic analysis
◉ What type of scan will measure the size or distance of a person's
external features with a digital video camera?
A. Signature kinetics scan
B. Iris scan
C. Facial recognition scan
D. Retinal scan. Answer: C. Facial recognition scan
◉ Which of the following items represents a document that includes
detailed information on when an incident was detected, how
impactful the incident was, how it was remediated, the effectiveness
of the incident response, and any identified gaps that might require
improvement?
A. Chain of custody report
B. Forensic analysis report
C. Lessons learned report
D. Trends analysis report. Answer: C. Lessons learned report
FINAL EXAM CRAM SHEET AND STUDY NOTES
◉ You are troubleshooting an issue with a Windows desktop and
need to display the machine's active TCP connections. Which of the
following commands should you use?
A.netstat
B. ipconfig
C. net use
D. ping. Answer: netstat
◉ You are investigating a suspected compromise. You have noticed
several files that you don't recognize. How can you quickly and
effectively check if the files have been infected with malware?
A.Run the Strings tool against each file to identify common malware
identifiers
B. Disassemble the files and conduct static analysis on them using
IDA Pro
C. Scan the files using a local anti-virus/anti-malware engine
,D. Submit the files to an open-source intelligence provider like
VirusTotal. Answer: Submit the files to an open-source intelligence
provider like VirusTotal
◉ Which of the following ports should you block at the firewall if
you want to prevent a remote login to a server from occurring?
A.143
B. 21
C. 22
D. 80. Answer: C. 22
◉ A corporate workstation was recently infected with malware. The
malware was able to access the workstation's credential store and
steal all the usernames and passwords from the machine. Then, the
malware began to infect other workstations on the network using
the usernames and passwords it stole from the first workstation.
The IT Director has directed its IT staff to develop a plan to prevent
this issue from occurring again. Which of the following would BEST
prevent this from reoccurring?
A. Install a Unified Threat Management system on the network to
monitor for suspicious traffic
B. Install an anti-virus or anti-malware solution that uses heuristic
analysis
, C. Monitor all workstations for failed login attempts and forward
them to a centralized SYSLOG server
D. Install a host-based intrusion detection system on all of the
corporate workstations.. Answer: B. Install an anti-virus or anti-
malware solution that uses heuristic analysis
◉ What type of scan will measure the size or distance of a person's
external features with a digital video camera?
A. Signature kinetics scan
B. Iris scan
C. Facial recognition scan
D. Retinal scan. Answer: C. Facial recognition scan
◉ Which of the following items represents a document that includes
detailed information on when an incident was detected, how
impactful the incident was, how it was remediated, the effectiveness
of the incident response, and any identified gaps that might require
improvement?
A. Chain of custody report
B. Forensic analysis report
C. Lessons learned report
D. Trends analysis report. Answer: C. Lessons learned report
