CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1051:

  Which the following flags are used to establish a TCP connection? (Select TWO).

  A. PSH
  B. ACK
  C. SYN
  D. URG
  E. FIN
  B. ACK
  C. SYN

  ---

  To establish a TCP connection, the three-way (or 3-step) handshake occurs:

  SYN: The active open is performed by the client sending a SYN to the server. The client sets the segment's sequence number to a random value A. SYN-ACK: In response, the server replies with a SYN-ACK. The acknowledgment number is set to one more than the received sequence number i.e. A+1, and the sequence number that the server chooses for the packet is another random number, B. ACK: Finally, the client sends an ACK back to the server. The sequence number is set to the received acknowledgement value i.e. A+1, and the acknowledgement number is set to one more than the received sequence number i.e. B+1.

• Question 1052:

  Which of the following represents a cryptographic solution where the encrypted stream cannot be captured by a sniffer without the integrity of the stream being compromised?

  A. Elliptic curve cryptography.
  B. Perfect forward secrecy.
  C. Steganography.
  D. Quantum cryptography.
  D. Quantum cryptography.

  ---

  Quantum cryptography is a cryptosystem that is completely secure against being compromised without knowledge of the sender or the receiver of the messages.

• Question 1053:

  Which of the following types of application attacks would be used to identify malware causing security breaches that have NOT yet been identified by any trusted sources?

  A. Zero-day
  B. LDAP injection
  C. XML injection
  D. Directory traversal
  A. Zero-day

  ---

  The security breaches have NOT yet been identified. This is zero day vulnerability. A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it--this exploit is called a zero day attack. Uses of zero day attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the vulnerability becomes known, a race begins for the developer, who must protect users.

• Question 1054:

  A security administrator is tasked with ensuring that all devices have updated virus definition files before they are allowed to access network resources. Which of the following technologies would be used to accomplish this goal?

  A. NIDS
  B. NAC
  C. DLP
  D. DMZ
  E. Port Security
  B. NAC

  ---

  Network Access Control (NAC) means controlling access to an environment through strict adherence to and implementation of security policies.

• Question 1055:

  A security engineer discovers that during certain times of day, the corporate wireless network is dropping enough packets to significantly degrade service. Which of the following should be the engineer's FIRST step in troubleshooting the issues?

  A. Configure stronger encryption
  B. Increase the power level
  C. Change to a higher gain antenna
  D. Perform a site survey
  B. Increase the power level

• Question 1056:

  Which of the following would allow the organization to divide a Class C IP address range into several ranges?

  A. DMZ
  B. Virtual LANs
  C. NAT
  D. Subnetting
  D. Subnetting

  ---

  Subnetting is a dividing process used on networks to divide larger groups of hosts into smaller collections.

• Question 1057:

  A security administrator wants to deploy security controls to mitigate the threat of company employees' personal information being captured online. Which of the following would BEST serve this purpose?

  A. Anti-spyware
  B. Antivirus
  C. Host-based firewall
  D. Web content filter
  A. Anti-spyware

  ---

  Spyware monitors a user's activity and uses network protocols to reports it to a third party without the user's knowledge. This is usually accomplished using a tracking cookie.

• Question 1058:

  A business has recently adopted a policy allowing employees to use personal cell phones and tablets to access company email accounts while out of the office. Joe an employee was using a personal cell phone for email access and was recently terminated. It is suspected that Joe saved confidential client emails on his personal cell phone. Joe claims that the data on the phone is completely personal and refuse to allow the company access to inspect the cell phone. Which of the following is the MOST likely cause of this dispute?

  A. Onboarding procedures
  B. Fair use policy
  C. Device ownership D. User acceptance
  C. Device ownership D. User acceptance

• Question 1059:

  A program has been discovered that infects a critical Windows system executable and stays dormant in memory. When a Windows mobile phone is connected to the host, the program infects the phone's boot loader and continues to target additional Windows PCs or phones. Which of the following malware categories BEST describes this program?

  A. Zero-day
  B. Trojan
  C. Virus
  D. Rootkit
  C. Virus

  ---

  A computer virus is a program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are man-made. A simple virus that can make

  a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of

  transmitting itself across networks and bypassing security systems.

  Some people distinguish between general viruses and worms. A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs.

• Question 1060:

  Which of the following could a security administrator implement to mitigate the risk of tailgating for a large organization?

  A. Train employees on correct data disposal techniques and enforce policies.
  B. Only allow employees to enter or leave through one door at specified times of the day.
  C. Only allow employees to go on break one at a time and post security guards 24/7 at each entrance.
  D. Train employees on risks associated with social engineering attacks and enforce policies.
  D. Train employees on risks associated with social engineering attacks and enforce policies.

  ---

  Tailgating is the term used for someone being so close to you when you enter a building that they are able to come in right behind you without needing to use a key, a card, or any other security device. Many social engineering intruders needing physical access to a site will use this method of gaining entry. Educate users to beware of this and other social engineering ploys and prevent them from happening.