CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1071:

  A security administrator has been tasked with setting up a new internal wireless network that must use end to end TLS. Which of the following may be used to meet this objective?

  A. WPA
  B. HTTPS
  C. WEP
  D. WPA 2
  D. WPA 2

  ---

  Wi-Fi Protected Access 2 (WPA2) was intended to provide security that's equivalent to that on a wired network, and it implements elements of the 802.11i standard. In April 2010, the Wi-Fi Alliance announced the inclusion of additional Extensible Authentication Protocol (EAP) types to its certification programs for WPA- and WPA2- Enterprise certification programs. EAP-TLS is included in this certification program. Note: Although WPA mandates the use of TKIP, WPA2 requires Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). CCMP uses 128-bit AES encryption with a 48-bit initialization vector. With the larger initialization vector, it increases the difficulty in cracking and minimizes the risk of a replay attack.

• Question 1072:

  During a data breach cleanup it is discovered that not all of the sites involved have the necessary data wiping tools. The necessary tools are quickly distributed to the required technicians, but when should this problem BEST be revisited?

  A. Reporting
  B. Preparation
  C. Mitigation
  D. Lessons Learned
  B. Preparation

• Question 1073:

  The method to provide end users of IT systems and applications with requirements related to acceptable use, privacy, new threats and trends, and use of social networking is:

  A. Security awareness training.
  B. BYOD security training.
  C. Role-based security training.
  D. Legal compliance training.
  A. Security awareness training.

  ---

  Security awareness and training are critical to the success of a security effort. They include explaining policies, procedures, and current threats to both users and management.

• Question 1074:

  An attack that is using interference as its main attack to impede network traffic is which of the following?

  A. Introducing too much data to a targets memory allocation
  B. Utilizing a previously unknown security flaw against the target
  C. Using a similar wireless configuration of a nearby network
  D. Inundating a target system with SYN requests
  A. Introducing too much data to a targets memory allocation

• Question 1075:

  a malicious attacker has intercepted HTTP traffic and inserted an ASCII line that sets the referrer URL. Which of the following is the attacker most likely utilizing?

  A. Header manipulation
  B. Cookie hijacking
  C. Cross-site scripting
  D. Xml injection
  D. Xml injection

• Question 1076:

  Sara, the Chief Information Officer (CIO), has requested an audit take place to determine what services and operating systems are running on the corporate network. Which of the following should be used to complete this task?

  A. Fingerprinting and password crackers
  B. Fuzzing and a port scan
  C. Vulnerability scan and fuzzing
  D. Port scan and fingerprinting
  D. Port scan and fingerprinting

  ---

  Different services use different ports. When a service is enabled on a computer, a network port is opened for that service. For example, enabling the HTTP service on a web server will open port 80 on the server. By determining which ports are open on a remote server, we can determine which services are running on that server. A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it.

  A port scan or portscan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine.

  Fingerprinting is a means of ascertaining the operating system of a remote computer on a network. Fingerprinting is more generally used to detect specific versions of applications or protocols that are run on network servers. Fingerprinting can be accomplished "passively" by sniffing network packets passing between hosts, or it can be accomplished "actively" by transmitting specially created packets to the target machine and analyzing the response

• Question 1077:

  Which of the following malware types is MOST likely to execute its payload after Jane, an employee, has left the company?

  A. Rootkit
  B. Logic bomb
  C. Worm
  D. Botnet
  B. Logic bomb

  ---

  This is an example of a logic bomb. The logic bomb is configured to `go off' or when Jane has left the company.

  A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they

  ever be terminated from the company.

  Software that is inherently malicious, such as viruses and worms, often contain logic bombs that execute a certain payload at a pre-defined time or when some other condition is met. This technique can be used by a virus or worm to gain

  momentum and spread before being noticed. Some viruses attack their host systems on specific dates, such as Friday the 13th or April Fool's Day. Trojans that activate on certain dates are often called "time bombs".

  To be considered a logic bomb, the payload should be unwanted and unknown to the user of the software. As an example, trial programs with code that disables certain functionality after a set time are not normally regarded as logic bombs.

• Question 1078:

  A software developer wants to ensure that the application is verifying that a key is valid before establishing SSL connections with random remote hosts on the internet. Which of the following should be used in the code? (Select TWO)

  A. Escrowed keys
  B. SSL symmetric encryption key
  C. Software code private key
  D. OCSP
  E. Remote server public key
  A. Escrowed keys
  D. OCSP

• Question 1079:

  Which of the following concepts defines the requirement for data availability?

  A. Authentication to RADIUS
  B. Non-repudiation of email messages
  C. Disaster recovery planning
  D. Encryption of email messages
  C. Disaster recovery planning

  ---

  A disaster-recovery plan, or scheme, helps an organization respond effectively when a disaster occurs. Disasters may include system failure, network failure, infrastructure failure, and natural disaster. The primary emphasis of such a plan is reestablishing services and minimizing losses.

• Question 1080:

  In the course of troubleshooting wireless issues from users a technician discovers that users are connecting to their home SSIDs which the technician scans but detects none of these SSIDs. The technician eventually discovers a rouge access point that spoofs any SSID request. Which of the following allows wireless use while mitigating this type of attack?

  A. Configure the device to verify access point MAC addresses
  B. Disable automatic connection to known SSIDs
  C. Only connect to trusted wireless networks
  D. Enable MAC filtering on the wireless access point
  A. Configure the device to verify access point MAC addresses