CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1081:

  A security administrator determined that users within the company are installing unapproved software. Company policy dictates that only certain applications may be installed or ran on the user's computers without exception. Which of the following should the administrator do to prevent all unapproved software from running on the user's computer?

  A. Deploy antivirus software and configure it to detect and remove pirated software
  B. Configure the firewall to prevent the downloading of executable files
  C. Create an application whitelist and use OS controls to enforce it
  D. Prevent users from running as administrator so they cannot install software.
  C. Create an application whitelist and use OS controls to enforce it

• Question 1082:

  The practice of marking open wireless access points is called which of the following?

  A. War dialing
  B. War chalking
  C. War driving
  D. Evil twin
  B. War chalking

  ---

  War chalking is the act of making chalk marks on outdoor surfaces (walls, sidewalks, buildings, sign posts, trees) to indicate the existence of an open wireless network connection, usually offering an Internet connection so that others can benefit from the free wireless access. The open connections typically come from the access points of wireless networks located within buildings to serve enterprises. The chalk symbols indicate the type of access point that is available at that specific spot.

• Question 1083:

  A network administrator argues that WPA2 encryption is not needed, as MAC filtering is enabled on the access point. Which of the following would show the administrator that wpa2 is also needed?

  A. Deploy an evil twin with mac filtering
  B. Flood access point with random mac addresses
  C. Sniff and clone a mac address
  D. DNS poison the access point
  C. Sniff and clone a mac address

• Question 1084:

  Which of the following is the BEST reason to provide user awareness and training programs for organizational staff?

  A. To ensure proper use of social media
  B. To reduce organizational IT risk
  C. To detail business impact analyses
  D. To train staff on zero-days
  B. To reduce organizational IT risk

  ---

  Ideally, a security awareness training program for the entire organization should cover the following areas: Importance of security Responsibilities of people in the organization Policies and procedures Usage policies Account and password-selection criteria Social engineering prevention

  You can accomplish this training either by using internal staff or by hiring outside trainers. This type of training will significantly reduce the organizational IT risk.

• Question 1085:

  A Security Officer on a military base needs to encrypt several smart phones that will be going into the field. Which of the following ports should they block on the firewall?

  A. 53
  B. 110
  C. 143
  D. 443
  A. 53

• Question 1086:

  Which of the following types of encryption will help in protecting files on a PED?

  A. Mobile device encryption
  B. Transport layer encryption
  C. Encrypted hidden container
  D. Database encryption
  A. Mobile device encryption

  ---

  Device encryption encrypts the data on a Personal Electronic Device (PED). This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen.

• Question 1087:

  Which of the following security benefits would be gained by disabling a terminated user account rather than deleting it?

  A. Retention of user keys
  B. Increased logging on access attempts
  C. Retention of user directories and files
  D. Access to quarantined files
  A. Retention of user keys

  ---

  Account Disablement should be implemented when a user will be gone from a company whether they leave temporary or permanently. In the case of permanently leaving the company the account should be disabled. Disablement means that the account will no longer be an active account and that the user keys for that account are retained which would not be the case if the account was deleted from the system.

• Question 1088:

  A security administrator has been tasked with assisting in the forensic investigation of an incident relating to employee misconduct. The employee's supervisor believes evidence of this misconduct can be found on the employee's assigned workstation. Which of the following choices BEST describes what should be done? (Select TWO)

  A. Record time as offset as required and conduct a timeline analysis
  B. Update antivirus definitions and conduct a full scan for infected files
  C. Analyze network traffic, system, and file logs
  D. Create an additional local admin account on that workstation to conduct work from
  E. Delete other user profiles on the system to help narrow down the search space
  F. Patch the system before reconnecting it to the network
  A. Record time as offset as required and conduct a timeline analysis
  C. Analyze network traffic, system, and file logs

• Question 1089:

  Which of the following is the MOST important step for preserving evidence during forensic procedures?

  A. Involve law enforcement
  B. Chain of custody
  C. Record the time of the incident
  D. Report within one hour of discovery
  B. Chain of custody

  ---

  Chain of custody deals with how evidence is secured, where it is stored, and who has access to it. When you begin to collect evidence, you must keep track of that evidence at all times and show who has it, who has seen it, and where it has been. The evidence must always be within your custody, or you're open to dispute about possible evidence tampering. Thus to preserve evidence during a forensic procedure the chain of custody is of utmost importance.

• Question 1090:

  Which of the following provides the BEST explanation regarding why an organization needs to implement IT security policies?

  A. To ensure that false positives are identified
  B. To ensure that staff conform to the policy
  C. To reduce the organizational risk
  D. To require acceptable usage of IT systems
  C. To reduce the organizational risk

  ---

  Once risks has been identified and assessed then there are five possible actions that should be taken. These are: Risk avoidance, Risk transference, Risk mitigation, Risk deterrence and Risk acceptance. Anytime you engage in steps to reduce risk, you are busy with risk mitigation and implementing IT security policy is a risk mitigation strategy.