CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1031:

  Which of the following is built into the hardware of most laptops but is not setup for centralized management by default?

  A. Whole disk encryption
  B. TPM encryption
  C. USB encryption
  D. Individual file encryption
  B. TPM encryption

  ---

  Trusted Platform Module (TPM) is a hardware-based encryption solution that is embedded in the system's motherboard and is enabled or disable in BIOS. It helps with hash key generation and stores cryptographic keys, passwords, or certificates.

• Question 1032:

  Which of the following MOST interferes with network-based detection techniques?

  A. Mime-encoding
  B. SSL
  C. FTP
  D. Anonymous email accounts
  B. SSL

  ---

  Secure Sockets Layer (SSL) is used to establish secure TCP communication between two machines by encrypting the communication. Encrypted communications cannot easily be inspected for anomalies by network-based intrusion detection systems (NIDS).

• Question 1033:

  Which of the following is BEST used to break a group of IP addresses into smaller network segments or blocks?

  A. NAT
  B. Virtualization
  C. NAC
  D. Subnetting
  D. Subnetting

  ---

  Subnetting is a dividing process used on networks to divide larger groups of hosts into smaller collections.

• Question 1034:

  In which of the following scenarios would it be preferable to implement file level encryption instead of whole disk encryption?

  A. A server environment where the primary security concern is integrity and not file recovery
  B. A cloud storage environment where multiple customers use the same hardware but possess different encryption keys
  C. A SQL environment where multiple customers access the same database
  D. A large datacenter environment where each customer users dedicated hardware resources
  B. A cloud storage environment where multiple customers use the same hardware but possess different encryption keys

• Question 1035:

  An employee connects a wireless access point to the only jack in the conference room to provide Internet access during a meeting. The access point is configured to use WPA2- TKIP. A malicious user is able to intercept clear text HTTP communication between the meeting attendees and the Internet. Which of the following is the reason the malicious user is able to intercept and see the clear text communication?

  A. The malicious user has access to the WPA2-TKIP key.
  B. The wireless access point is broadcasting the SSID.
  C. The malicious user is able to capture the wired communication.
  D. The meeting attendees are using unencrypted hard drives.
  C. The malicious user is able to capture the wired communication.

  ---

  In this question, the wireless users are using WPA2-TKIP. While TKIP is a weak encryption protocol, it is still an encryption protocol. Therefore, the wireless communications between the laptops and the wireless access point are encrypted. The question states that user was able to intercept `clear text' HTTP communication between the meeting attendees and the Internet. The HTTP communications are unencrypted as they travel over the wired network. Therefore, the malicious user must have been able to capture the wired communication. TKIP and AES are two different types of encryption that can be used by a Wi-Fi network. TKIP stands for "Temporal Key Integrity Protocol." It was a stopgap encryption protocol introduced with WPA to replace the very-insecure WEP encryption at the time. TKIP is actually quite similar to WEP encryption. TKIP is no longer considered secure, and is now deprecated.

• Question 1036:

  A security researcher wants to reverse engineer an executable file to determine if it is malicious. The file was found on an underused server and appears to contain a zero-day exploit. Which of the following can the researcher do to determine if the file is malicious in nature?

  A. TCP/IP socket design review
  B. Executable code review
  C. OS Baseline comparison
  D. Software architecture review
  C. OS Baseline comparison

  ---

  Zero-Day Exploits begin exploiting holes in any software the very day it is discovered. It is very difficult to respond to a zero-day exploit. Often, the only thing that you as a security administrator can do is to turn off the service. Although this can be a costly undertaking in terms of productivity, it is the only way to keep the network safe. In this case you want to check if the executable file is malicious. Since a baseline represents a secure state is would be possible to check the nature of the executable file in an isolated environment against the OS baseline.

• Question 1037:

  A security technician at a small business is worried about the Layer 2 switches in the network suffering from a DoS style attack caused by staff incorrectly cabling network connections between switches.

  Which of the following will BEST mitigate the risk if implemented on the switches?

  A. Spanning tree
  B. Flood guards
  C. Access control lists
  D. Syn flood
  A. Spanning tree

  ---

  Spanning Tree is designed to eliminate network `loops' from incorrect cabling between switches. Imagine two switches named switch 1 and switch 2 with two network cables connecting the switches. This would cause a network loop. A network loop between two switches can cause a `broadcast storm' where a broadcast packet is sent out of all ports on switch 1 which includes two links to switch 2. The broadcast packet is then sent out of all ports on switch 2 which includes links back to switch 1. The broadcast packet will be sent out of all ports on switch 1 again which includes two links to switch 2 and so on thus flooding the network with broadcast traffic. The Spanning-Tree Protocol (STP) was created to overcome the problems of transparent bridging in redundant networks. The purpose of STP is to avoid and eliminate loops in the network by negotiating a loop-free path through a root bridge. This is done by determining where there are loops in the network and blocking links that are redundant. Spanning-Tree Protocol executes an algorithm called the Spanning-Tree Algorithm (STA). In order to find redundant links, STA will choose a reference point called a Root Bridge, and then determines all the available paths to that reference point. If it finds a redundant path, it chooses for the best path to forward and for all other redundant paths to block. This effectively severs the redundant links within the network. All switches participating in STP gather information on other switches in the network through an exchange of data messages. These messages are referred to as Bridge Protocol Data Units (BPDUs). The exchange of BPDUs in a switched environment will result in the election of a root switch for the stable spanning-tree network topology, election of designated switch for every switched segment, and the removal of loops in the switched network by placing redundant switch ports in a backup state.

• Question 1038:

  A forensic analyst is reviewing electronic evidence after a robbery. Security cameras installed at the site were facing the wrong direction to capture the incident. The analyst ensures the cameras are turned to face the proper direction. Which of the following types of controls is being used?

  A. Detective
  B. Deterrent
  C. Corrective
  D. Preventive
  C. Corrective

  ---

  A corrective control would be any corrective action taken to correct any existing control that were faulty or wrongly installed ?as in this case the cameras were already there, it just had to be adjusted to perform its function as intended.

• Question 1039:

  The finance department just procured a software application that needs to communicate back to the vendor server via SSL. Which of the following default ports on the firewall must the security engineer open to accomplish this task?

  A. 80
  B. 130
  C. 443
  D. 3389
  C. 443

• Question 1040:

  An IT director is looking to reduce the footprint of their company's server environment. They have decided to move several internally developed software applications to an alternate environment, supported by an external company. Which of the following BEST describes this arrangement?

  A. Infrastructure as a Service
  B. Storage as a Service
  C. Platform as a Service
  D. Software as a Service
  A. Infrastructure as a Service

  ---

  Cloud users install operating-system images and their application software on the cloud infrastructure to deploy their applications. In this model, the cloud user patches and maintains the operating systems and the application software.