CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1021:

  A technician has implemented a system in which all workstations on the network will receive security updates on the same schedule. Which of the following concepts does this illustrate?

  A. Patch management
  B. Application hardening
  C. White box testing
  D. Black box testing
  A. Patch management

  ---

  Patch management is the process of maintaining the latest source code for applications and operating systems by applying the latest vendor updates. This helps protect a systems from newly discovered attacks and vulnerabilities. A part of patch management is testing the effects of vendor updates on a test system before applying the updates on a production system, and scheduling updates.

• Question 1022:

  Many employees are receiving email messages similar to the one shown below: From IT department

  To employee

  Subject email quota exceeded

  Pease click on the following link http:www.website.info/email.php?quota=1Gb and provide your username and password to increase your email quota. Upon reviewing other similar emails, the security administrator realized that all the phishing URLs have the following common elements; they all use HTTP, they all come from .info domains, and they all contain the same URI.

  Which of the following should the security administrator configure on the corporate content filter to prevent users from accessing the phishing URL, while at the same time minimizing false positives?

  A. BLOCK http://www.*.info/"
  B. DROP http://"website.info/email.php?*
  C. Redirect http://www,*. Info/email.php?quota=*TOhttp://company.com/corporate_polict.html
  D. DENYhttp://*.info/email.php?quota=1Gb
  D. DENYhttp://*.info/email.php?quota=1Gb

• Question 1023:

  Jane, an IT security technician, needs to create a way to secure company mobile devices. Which of the following BEST meets this need?

  A. Implement voice encryption, pop-up blockers, and host-based firewalls.
  B. Implement firewalls, network access control, and strong passwords.
  C. Implement screen locks, device encryption, and remote wipe capabilities.
  D. Implement application patch management, antivirus, and locking cabinets.
  C. Implement screen locks, device encryption, and remote wipe capabilities.

  ---

  Explanation: Screen-lock is a security feature that requires the user to enter a password after a short period of inactivity before they can access the system again. This feature ensures that if your device is left unattended or is lost or stolen, it

  will be difficult for anyone else to access your data or applications.

  Device encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen. Remote wipe is the process of deleting data on a device in the event that

  the device is stolen. This is performed over remote connections such as the mobile phone service or the internet connection and helps ensure that sensitive data is not accessed by unauthorized people.

• Question 1024:

  Which of the following protocols allows for the LARGEST address space?

  A. IPX
  B. IPv4
  C. IPv6
  D. Appletalk
  C. IPv6

  ---

  The main advantage of IPv6 over IPv4 is its larger address space. The length of an IPv6 address is 128 bits, compared with 32 bits in IPv4.

• Question 1025:

  Public key certificates and keys that are compromised or were issued fraudulently are listed on which of the following?

  A. PKI
  B. ACL
  C. CA
  D. CRL
  D. CRL

  ---

  A CRL is a locally stored record containing revoked certificates and revoked keys.

• Question 1026:

  A recent audit has discovered that at the time of password expiration clients are able to recycle the previous credentials for authentication. Which of the following controls should be used together to prevent this from occurring? (Select TWO).

  A. Password age
  B. Password hashing
  C. Password complexity
  D. Password history
  E. Password length
  A. Password age
  D. Password history

  ---

  D: Password history determines the number of previous passwords that cannot be used when a user changes his password. For example, a password history value of 5 would disallow a user from changing his password to any of his previous 5 passwords.

  A: When a user is forced to change his password due to a maximum password age period expiring, he could change his password to a previously used password. Or if a password history value of 5 is configured, the user could change his password six times to cycle back round to his original password. This is where the minimum password age comes in. This is the period that a password must be used for. For example, a minimum password age of 30 would determine that when a user changes his password, he must continue to use the same password for at least 30 days.

• Question 1027:

  An auditing team has found that passwords do not meet best business practices. Which of the following will MOST increase the security of the passwords? (Select TWO).

  A. Password Complexity
  B. Password Expiration
  C. Password Age
  D. Password Length
  E. Password History
  A. Password Complexity
  D. Password Length

  ---

  Passwords should have the strength to avoid discovery through attack, but it should also be easy enough for the user to remember. The length and complexity of a password combined are vital factors in defining a password's strength.

• Question 1028:

  Which of the following are restricted to 64-bit block sizes? (Select TWO).

  A. PGP
  B. DES
  C. AES256
  D. RSA
  E. 3DES
  F. AES
  B. DES
  E. 3DES

  ---

  B: The Data Encryption Standard (DES) has been used since the mid-1970s. It was the primary standard used in government and industry until it was replaced by AES. It's based on a 56-bit key and has several modes that offer security and integrity. It is now considered insecure because of the small key size.

  E: Triple-DES (3DES) is a technological upgrade of DES. 3DES is still used, even though AES is the preferred choice for government applications. 3DES is considerably harder to break than many other systems, and it's more secure than DES. It increases the key length to 168 bits (using three 56-bit DES keys).

• Question 1029:

  An administrator needs to connect a router in one building to a router in another using Ethernet. Each router is connected to a managed switch and the switches are connected to each other via a fiber line. Which of the following should be configured to prevent unauthorized devices from connecting to the network?

  A. Configure each port on the switches to use the same VLAN other than the default one
  B. Enable VTP on both switches and set to the same domain
  C. Configure only one of the routers to run DHCP services
  D. Implement port security on the switches
  D. Implement port security on the switches

  ---

  Port security in IT can mean several things:

  The physical control of all connection points, such as RJ-45 wall jacks or device ports, so that no unauthorized users or unauthorized devices can attempt to connect into an open port.

  The management of TCP and User Datagram Protocol (UDP) ports. If a service is active and assigned to a port, then that port is open. All the other 65,535 ports (of TCP or UDP) are closed if a service isn't actively using them. Port knocking

  is a security system in which all ports on a system appear closed. However, if the client sends packets to a specific set of ports in a certain order, a bit like a secret knock, then the desired service port becomes open and allows the client

  software to connect to the service.

• Question 1030:

  The Chief Executive Officer (CEO) receives a suspicious voice mail warning of credit card fraud. No one else received the voice mail. Which of the following BEST describes this attack?

  A. Whaling
  B. Vishing
  C. Spear phishing
  D. Impersonation
  A. Whaling

  ---

  Whaling is a specific kind of malicious hacking within the more general category of phishing, which involves hunting for data that can be used by the hacker. In general, phishing efforts are focused on collecting personal data about users. In whaling, the targets are high-ranking bankers, executives or others in powerful positions or job titles. Hackers who engage in whaling often describe these efforts as "reeling in a big fish," applying a familiar metaphor to the process of scouring technologies for loopholes and opportunities for data theft. Those who are engaged in whaling may, for example, hack into specific networks where these powerful individuals work or store sensitive data. They may also set up keylogging or other malware on a work station associated with one of these executives. There are many ways that hackers can pursue whaling, leading C-level or top- level executives in business and government to stay vigilant about the possibility of cyber threats.