CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 101:

  A malicious individual is attempting to write too much data to an application's memory. Which of the following describes this type of attack?

  A. Zero-day
  B. SQL injection
  C. Buffer overflow
  D. XSRF
  C. Buffer overflow

  ---

  A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity. In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information. Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability.

• Question 102:

  Which of the following types of attacks involves interception of authentication traffic in an attempt to gain unauthorized access to a wireless network?

  A. Near field communication
  B. IV attack
  C. Evil twin
  D. Replay attack
  B. IV attack

  ---

  An initialization vector is a random number used in combination with a secret key as a means to encrypt data. This number is sometimes referred to as a nonce, or "number occurring once," as an encryption program uses it only once per session. An initialization vector is used to avoid repetition during the data encryption process, making it impossible for hackers who use dictionary attack to decrypt the exchanged encrypted message by discovering a pattern. This is known as an IV attack. A particular binary sequence may be repeated more than once in a message, and the more it appears, the more the encryption method is discoverable. For example if a one-letter word exists in a message, it may be either "a" or "I" but it can't be "e" because the word "e" is non-sensical in English, while "a" has a meaning and "I" has a meaning. Repeating the words and letters makes it possible for software to apply a dictionary and discover the binary sequence corresponding to each letter. Using an initialization vector changes the binary sequence corresponding to each letter, enabling the letter "a" to be represented by a particular sequence in the first instance, and then represented by a completely different binary sequence in the second instance.

  WEP (Wireless Equivalent Privacy) is vulnerable to an IV attack. Because RC4 is a stream cipher, the same traffic key must never be used twice. The purpose of an IV, which is transmitted as plain text, is to prevent any repetition, but a 24-bit IV is not long enough to ensure this on a busy network. The way the IV was used also opened WEP to a related key attack. For a 24-bit IV, there is a 50% probability the same IV will repeat after 5000 packets.

• Question 103:

  A security administrator is required to submit a detailed implementation plan and back out plan to get approval prior to updating the firewall and other security devices. Which of the following types of risk mitigation strategies is being followed?

  A. Change management
  B. Routine audit
  C. Rights and permissions review
  D. Configuration management
  D. Configuration management

• Question 104:

  Which of the following is synonymous with a server's certificate?

  A. Public key
  B. CRL
  C. Private key
  D. Recovery agent
  A. Public key

  ---

  A public key certificate (also known as a digital certificate or identity certificate) is an electronic document used to prove ownership of a public key.

• Question 105:

  An administrator is investigating a system that may potentially be compromised and sees the following log entries on the router.

  *Jul 15 14:47:29.779: %Router1: list 101 permitted TCP 192.10.3.204(57222) (FastEthernet 0/3) -> 10.10.1.5 (6667), 3 packets.

  *Jul 15 14:47:38.779: %Router1: list 101 permitted TCP 192.10.3.204(57222) (FastEthernet 0/3) -> 10.10.1.5 (6667), 6 packets.

  *Jul 15 14:47:45.779: %Router1: list 101 permitted TCP 192.10.3.204(57222) (FastEthernet 0/3) -> 10.10.1.5 (6667), 8 packets.

  Which of the following BEST describes the compromised system?

  A. It is running a rogue web server
  B. It is being used in a man-in-the-middle attack
  C. It is participating in a botnet
  D. It is an ARP poisoning attack
  C. It is participating in a botnet

• Question 106:

  Which of the following should be deployed to prevent the transmission of malicious traffic between virtual machines hosted on a singular physical device on a network?

  A. HIPS on each virtual machine
  B. NIPS on the network
  C. NIDS on the network
  D. HIDS on each virtual machine
  A. HIPS on each virtual machine

  ---

  Host-based intrusion prevention system (HIPS) is an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host.

• Question 107:

  A program displays:

  ERROR: this program has caught an exception and will now terminate.

  Which of the following is MOST likely accomplished by the program's behavior?

  A. Operating system's integrity is maintained
  B. Program's availability is maintained
  C. Operating system's scalability is maintained
  D. User's confidentiality is maintained
  A. Operating system's integrity is maintained

  ---

  The purpose of error handling is to maintain the security and integrity of the system. Integrity is compromised when unauthorized modification occurs.

• Question 108:

  During an audit, the security administrator discovers that there are several users that are no longer employed with the company but still have active user accounts. Which of the following should be performed?

  A. Account recovery
  B. Account disablement
  C. Account lockouts
  D. Account expiration
  B. Account disablement

  ---

  Account Disablement should be implemented when a user will be gone from a company whether they leave temporary or permanently. In the case of permanently leaving the company the account should be disabled. Disablement means that the account will no longer be an active account.

• Question 109:

  Which of the following is an attack vector that can cause extensive physical damage to a datacenter without physical access?

  A. CCTV system access
  B. Dial-up access
  C. Changing environmental controls
  D. Ping of death
  C. Changing environmental controls

  ---

  Environmental systems include heating, air conditioning, humidity control, fire suppression, and power systems. All of these functions are critical to a well-designed physical plant. A computer room will typically require full-time environmental control. Changing any of these controls (when it was set to its optimum values) will result in damage.

• Question 110:

  An attacker went to a local bank and collected disposed paper for the purpose of collecting data that could be used to steal funds and information from the bank's customers. This is an example of:

  A. Impersonation
  B. Whaling
  C. Dumpster diving
  D. Hoaxes
  C. Dumpster diving