CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1091:

  A military base wants to incorporate biometrics into its new security measures, but the head of security does not want them to be the sole method of authentication. For unmanned entry points, which of the following solutions would work BEST?

  A. Use voice print and a bollard
  B. Use a retina scanner and a thumbprint
  C. Use CCTV and a PIN
  D. Use a retina scan and a PIN code
  D. Use a retina scan and a PIN code

• Question 1092:

  Users in the HR department were recently informed that they need to implement a user training and awareness program which is tailored to their department. Which of the following types of training would be the MOST appropriate for this department?

  A. Handing PII
  B. Risk mitigation
  C. Input validation
  D. Hashing
  A. Handing PII

• Question 1093:

  The marketing department wants to distribute pens with embedded USB drives to clients. In the past this client has been victimized by social engineering attacks which led to a loss of sensitive data. The security administrator advises the marketing department not to distribute the USB pens due to which of the following?

  A. The risks associated with the large capacity of USB drives and their concealable nature
  B. The security costs associated with securing the USB drives over time
  C. The cost associated with distributing a large volume of the USB pens
  D. The security risks associated with combining USB drives and cell phones on a network
  A. The risks associated with the large capacity of USB drives and their concealable nature

  ---

  USB drive and other USB devices represent a security risk as they can be used to either bring malicious code into a secure system or to copy and remove sensitive data out of the system.

• Question 1094:

  After viewing wireless traffic, an attacker notices the following networks are being broadcasted by local access points:

  Corpnet

  Coffeeshop

  FreePublicWifi

  Using this information the attacker spoofs a response to make nearby laptops connect back to a malicious device. Which of the following has the attacker created?

  A. Infrastructure as a Service
  B. Load balancer
  C. Evil twin
  D. Virtualized network
  C. Evil twin

  ---

  In this question, the attacker has created another wireless network that is impersonating one of more of the three wireless networks listed in the question. This is known as an Evil Twin.

  An evil twin, in the context of network security, is a rogue or fake wireless access point (WAP) that appears as a genuine hotspot offered by a legitimate provider. In an evil twin attack, an eavesdropper or hacker fraudulently creates this rogue

  hotspot to collect the personal data of unsuspecting users. Sensitive data can be stolen by spying on a connection or using a phishing technique.

  For example, a hacker using an evil twin exploit may be positioned near an authentic Wi-Fi access point and discover the service set identifier (SSID) and frequency. The hacker may then send a radio signal using the exact same frequency

  and SSID. To end users, the rogue evil twin appears as their legitimate hotspot with the same name. In wireless transmissions, evil twins are not a new phenomenon. Historically, they were known as honeypots or base station clones. With the

  advancement of wireless technology and the use of wireless devices in public areas, it is very easy for novice users to set up evil twin exploits.

• Question 1095:

  

  

  Correct Answer. Check the answer below
  Check the answer below

  ---

  Use the following answer for this simulation task:

  Source IP

  Destination IP

  Port number

  TCP/UDP

  Allow/Deny

  10.4.255.10/24

  10.4.255.101

  443

  TCP

  Allow

  10.4.255.10/23

  10.4.255.2

  22

  TCP

  Allow

  10.4.255.10/25

  10.4.255.101

  Any

  Any

  Allow

  10.4.255.10/25

  10.4.255.102

  Any

  Any

  Allow

  Firewall rules act like ACLs, and they are used to dictate what traffic can pass between the firewall and the internal network. Three possible actions can be taken based on the rule's criteria:

  Block the connection

  Allow the connection

  Allow the connection only if it is secured

  TCP is responsible for providing a reliable, one-to-one, connection-oriented session. TCP establishes a connection and ensures that the other end receives any packets sent. Two hosts communicate packet results with each other. TCP also

  ensures that packets are decoded and sequenced properly. This connection is persistent during the session. When the session ends, the connection is torn down.

  UDP provides an unreliable connectionless communication method between hosts. UDP is considered a best-effort protocol, but it's considerably faster than TCP. The sessions don't establish a synchronized session like the kind used in TCP,

  and UDP doesn't guarantee error-free communications. The primary purpose of UDP is to send small packets of information. The application is responsible for acknowledging the correct reception of the data.

  Port 22 is used by both SSH and SCP with UDP.

  Port 443 is used for secure web connections

• Question 1096:

  In order for Sara, a client, to logon to her desktop computer, she must provide her username, password, and a four digit PIN. Which of the following authentication methods is Sara using?

  A. Three factor
  B. Single factor
  C. Two factor
  D. Four factor
  B. Single factor

  ---

  Single-factor authentication is when only one authentication factor is used. In this case, Something you know is being used as an authentication factor. Username, password, and PIN form part of Something you know.

• Question 1097:

  Which of the following types of authentication packages user credentials in a ticket?

  A. Kerberos
  B. LDAP
  C. TACACS+
  D. RADIUS
  A. Kerberos

  ---

  The basic process of Kerberos authentication is as follows:

  The subject provides logon credentials.

  The Kerberos client system encrypts the password and transmits the protected credentials to the KDC.

  The KDC verifies the credentials and then creates a ticket-granting ticket (TGT--a hashed form of the subject's password with the addition of a time stamp that indicates a valid lifetime). The TGT is encrypted and sent to the client. The client

  receives the TGT. At this point, the subject is an authenticated principle in the Kerberos realm.

  The subject requests access to resources on a network server. This causes the client to request a service ticket (ST) from the KDC.

  The KDC verifies that the client has a valid TGT and then issues an ST to the client. The ST includes a time stamp that indicates its valid lifetime.

  The client receives the ST.

  The client sends the ST to the network server that hosts the desired resource. The network server verifies the ST. If it's verified, it initiates a communication session with the client. From this point forward, Kerberos is no longer involved.

• Question 1098:

  A server crashes at 6 pm. Senior management has determined that data must be restored within two hours of a server crash. Additionally, a loss of more than one hour worth of data is detrimental to the company's financial well-being. Which of the following is the RTO?

  A. 7pm
  B. 8pm
  C. 9pm
  D. 10pm
  B. 8pm

• Question 1099:

  An agent wants to create fast and efficient cryptographic keys to use with Diffie-Hellman without using prime numbers to generate the keys. Which of the following should be used?

  A. Elliptic curve cryptography
  B. Quantum cryptography
  C. Public key cryptography
  D. Symmetric cryptography
  D. Symmetric cryptography

• Question 1100:

  Which of the following MOST specifically defines the procedures to follow when scheduled system patching fails resulting in system outages?

  A. Risk transference
  B. Change management
  C. Configuration management
  D. Access control revalidation
  B. Change management

  ---

  Change Management is a risk mitigation approach and refers to the structured approach that is followed to secure a company's assets. In this case `scheduled system patching'.