CompTIA SY0-301 Online Practice Questions and Exam Preparation

CompTIA SY0-301 Online Questions & Answers

• Question 51:

  Fuzzing is a security assessment technique that allows testers to analyze the behavior of software applications under which of the following conditions?

  A. Unexpected input
  B. Invalid output
  C. Parameterized input
  D. Valid output
  A. Unexpected input

• Question 52:

  A security analyst has been informed that the development team has plans to develop an application which does not meet the company's password policy. Which of the following should be done NEXT?

  A. Contact the Chief Information Officer and ask them to change the company password policy so that the application is made compliant.
  B. Tell the application development manager to code the application to adhere to the company's password policy.
  C. Ask the application development manager to submit a risk acceptance memo so that the issue can be documented.
  D. Inform the Chief Information Officer of non-adherence to the security policy so that the developers can be reprimanded.
  B. Tell the application development manager to code the application to adhere to the company's password policy.

• Question 53:

  An organization does not have adequate resources to administer its large infrastructure. A security administrator wishes to integrate the security controls of some of the network devices in the organization. Which of the following methods would BEST accomplish this goal?

  A. Unified Threat Management
  B. Virtual Private Network
  C. Single sign on
  D. Role-based management
  A. Unified Threat Management

• Question 54:

  When verifying file integrity on a remote system that is bandwidth limited, which of the following tool combinations provides the STRONGEST confidence?

  A. MD5 and 3DES
  B. MD5 and SHA-1
  C. SHA-256 and RSA
  D. SHA-256 and AES
  B. MD5 and SHA-1

• Question 55:

  A security administrator needs a locally stored record to remove the certificates of a terminated employee. Which of the following describes a service that could meet these requirements?

  A. OCSP
  B. PKI
  C. CA
  D. CRL
  D. CRL

• Question 56:

  Which of the following is a best practice when a mistake is made during a forensics examination?

  A. The examiner should verify the tools before, during, and after an examination.
  B. The examiner should attempt to hide the mistake during cross-examination.
  C. The examiner should document the mistake and workaround the problem.
  D. The examiner should disclose the mistake and assess another area of the disc.
  C. The examiner should document the mistake and workaround the problem.

• Question 57:

  Which of the following is described as an attack against an application using a malicious file?

  A. Client side attack
  B. Spam
  C. Impersonation attack
  D. Phishing attack
  A. Client side attack

• Question 58:

  After a production outage, which of the following documents contains detailed information on the order in which the system should be restored to service?

  A. Succession planning
  B. Disaster recovery plan
  C. Information security plan
  D. Business impact analysis
  B. Disaster recovery plan

• Question 59:

  Which of the following common access control models is commonly used on systems to ensure a "need to know" based on classification levels?

  A. Role Based Access Controls
  B. Mandatory Access Controls
  C. Discretionary Access Controls
  D. Access Control List
  B. Mandatory Access Controls

• Question 60:

  Which of the following wireless security measures can an attacker defeat by spoofing certain properties of their network interface card?

  A. WEP
  B. MAC filtering
  C. Disabled SSID broadcast
  D. TKIP
  B. MAC filtering