CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 991:

  New magnetic locks were ordered for an entire building. In accordance with company policy, employee safety is the top priority. In case of a fire where electricity is cut, which of the following should be taken into consideration when installing the new locks?

  A. Fail safe
  B. Fault tolerance
  C. Fail secure
  D. Redundancy
  A. Fail safe

• Question 992:

  Users report that they are unable to access network printing services. The security technician checks the router access list and sees that web, email, and secure shell are allowed. Which of the following is blocking network printing?

  A. Port security
  B. Flood guards
  C. Loop protection
  D. Implicit deny
  D. Implicit deny

  ---

  Implicit deny says that if you aren't explicitly granted access or privileges for a resource, you're denied access by default. The scenario does not state that network printing is allowed in the router access list, therefore, it must be denied by default.

• Question 993:

  After Matt, a user, enters his username and password at the login screen of a web enabled portal, the following appears on his screen:

  `Please only use letters and numbers on these fields'

  Which of the following is this an example of?

  A. Proper error handling
  B. Proper input validation
  C. Improper input validation
  D. Improper error handling
  B. Proper input validation

  ---

  Input validation is an aspect of secure coding and is intended to mitigate against possible user input attacks, such as buffer overflows and fuzzing. Input validation checks every user input submitted to the application before processing that input. The check could be a length, a character type, a language type, or a domain.

• Question 994:

  Employee badges are encoded with a private encryption key and specific personal information.

  The encoding is then used to provide access to the network. Which of the following describes this access control type?

  A. Smartcard
  B. Token
  C. Discretionary access control
  D. Mandatory access control
  A. Smartcard

  ---

  Smart cards are credit-card-sized IDs, badges, or security passes with an embedded integrated circuit chip that can include data regarding the authorized bearer. This data can then be used for identification and/or authentication purposes.

• Question 995:

  Which of the following is a hardware based encryption device?

  A. EFS
  B. TrueCrypt
  C. TPM
  D. SLE
  C. TPM

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates.

• Question 996:

  Which of the following should a security technician implement to identify untrusted certificates?

  A. CA
  B. PKI
  C. CRL
  D. Recovery agent
  C. CRL

  ---

  Untrusted certificates and keys are revoked and put into the CRL. Note: The CRL (Certificate revocation list) is exactly what its name implies: a list of subscribers paired with digital certificate status. The list enumerates revoked certificates along with the reason(s) for revocation. The dates of certificate issue, and the entities that issued them, are also included.

• Question 997:

  Which of the following algorithms has well documented collisions? (Select TWO).

  A. AES
  B. MD5
  C. SHA
  D. SHA-256
  E. RSA
  B. MD5
  C. SHA

  ---

  B: MD5 biggest weakness is that it does not have strong collision resistance, and thus it is no longer recommended for use.

  C: SHA-1 (also known as SHA) is being retired from most government uses; the U.S. National Institute of Standards and Technology said, "Federal agencies should stop using SHA-1 for...applications that require collision resistance as soon

  as practical, and must use the SHA-2 family of hash functions for these applications after 2010", though that was later relaxed.

  Note: The hashing algorithm must have few or no collisions. This means that hashing two different inputs does not give the same output.

  Cryptographic hash functions are usually designed to be collision resistant. But many hash functions that were once thought to be collision resistant were later broken. MD5 and SHA- 1 in particular both have published techniques more

  efficient than brute force for finding collisions.

• Question 998:

  A system administrator needs to ensure that certain departments have more restrictive controls to their shared folders than other departments. Which of the following security controls would be implemented to restrict those departments?

  A. User assigned privileges
  B. Password disablement
  C. Multiple account creation
  D. Group based privileges
  D. Group based privileges

  ---

  Group-based privileges assign privileges or access to a resource to all members of a group. Group-based access control grants every member of the group the same level of access to a specific object.

• Question 999:

  An administrator implements SELinux on a production web server. After implementing this, the web server no longer serves up files from users' home directories. To rectify this, the administrator creates a new policy as the root user. This is an example of which of the following? (Select TWO).

  A. Enforcing SELinux in the OS kernel is role-based access control
  B. Enforcing SELinux in the OS kernel is rule-based access control
  C. The policy added by the root user is mandatory access control
  D. Enforcing SELinux in the OS kernel is mandatory access control
  E. The policy added by the root user is role-based access control
  F. The policy added by the root user is rule-based access control
  D. Enforcing SELinux in the OS kernel is mandatory access control
  F. The policy added by the root user is rule-based access control

  ---

  Enforcing SELinux in the OS kernel is mandatory access control. SELinux is Security Enhanced Linux which is a locked down version of the OS kernel. Mandatory Access Control (MAC) is a relatively inflexible method for how information access is permitted. In a MAC environment, all access capabilities are predefined. Users can't share information unless their rights to share it are established by administrators. Consequently, administrators must make any changes that need to be made to such rights. This process enforces a rigid model of security. However, it is also considered the most secure security model.

  The policy added by the root user is rule-based access control. The administrator has defined a policy that states that users folders should be served by the web server. Rule-Based Access Control (RBAC) uses the settings in preconfigured security policies to make all decisions.

• Question 1000:

  Two members of the finance department have access to sensitive information. The company is concerned they may work together to steal information. Which of the following controls could be implemented to discover if they are working together?

  A. Least privilege access
  B. Separation of duties
  C. Mandatory access control
  D. Mandatory vacations
  D. Mandatory vacations

  ---

  A mandatory vacation policy requires all users to take time away from work to refresh. Mandatory vacation give the employee a chance to refresh, but it also gives the company a chance to make sure that others can fill in any gaps in skills and satisfies the need to have replication or duplication at all levels. Mandatory vacations also provide an opportunity to discover fraud. In this case mandatory vacations can prevent the two members from colluding to steal the information that they have access to.