CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1111:

  A security administrator has been tasked with improving the overall security posture related to desktop machines on the network. An auditor has recently that several machines with confidential customer information displayed in the screens are left unattended during the course of the day. Which of the following could the security administrator implement to reduce the risk associated with the finding?

  A. Implement a clean desk policy
  B. Security training to prevent shoulder surfing
  C. Enable group policy based screensaver timeouts
  D. Install privacy screens on monitors
  C. Enable group policy based screensaver timeouts

• Question 1112:

  Using a heuristic system to detect an anomaly in a computer's baseline, a system administrator was able to detect an attack even though the company signature based IDS and antivirus did not detect it. Further analysis revealed that the attacker had downloaded an executable file onto the company PC from the USB port, and executed it to trigger a privilege escalation flaw.

  Which of the following attacks has MOST likely occurred?

  A. Cookie stealing
  B. Zero-day
  C. Directory traversal
  D. XML injection
  B. Zero-day

  ---

  The vulnerability was unknown in that the IDS and antivirus did not detect it. This is zero day vulnerability.

  A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it--this exploit is called a zero day attack. Uses of zero day

  attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the

  vulnerability becomes known, a race begins for the developer, who must protect users.

• Question 1113:

  Recently the desktop support group has been performing a hardware refresh and has replaced numerous computers. An auditor discovered that a number of the new computers did not have the company's antivirus software installed on them, Which of the following could be utilized to notify the network support group when computers without the antivirus software are added to the network?

  A. Network port protection
  B. NAC
  C. NIDS
  D. Mac Filtering
  C. NIDS

• Question 1114:

  While securing a network it is decided to allow active FTP connections into the network. Which of the following ports MUST be configured to allow active FTP connections? (Select TWO).

  A. 20
  B. 21
  C. 22
  D. 68
  E. 69
  A. 20
  B. 21

  ---

  FTP (File Transfer Protocol) makes use of ports 20 and 21

• Question 1115:

  Users require access to a certain server depending on their job function. Which of the following would be the MOST appropriate strategy for securing the server?

  A. Common access card
  B. Role based access control
  C. Discretionary access control
  D. Mandatory access control
  B. Role based access control

  ---

  Role-based Access Control is basically based on a user's job description. When a user is assigned a specific role in an environment, that user's access to objects is granted based on the required tasks of that role.

• Question 1116:

  Which of the following technologies can store multi-tenant data with different security requirements?

  A. Data loss prevention
  B. Trusted platform module
  C. Hard drive encryption
  D. Cloud computing
  D. Cloud computing

  ---

  One of the ways cloud computing is able to obtain cost efficiencies is by putting data from various clients on the same machines. This "multitenant" nature means that workloads from different clients can be on the same system, and a flaw in implementation could compromise security.

• Question 1117:

  A security administrator implements access controls based on the security classification of the data and need-to-know information. Which of the following BEST describes this level of access control?

  A. Implicit deny
  B. Role-based Access Control
  C. Mandatory Access Controls
  D. Least privilege
  C. Mandatory Access Controls

  ---

  Mandatory Access Control allows access to be granted or restricted based on the rules of classification. MAC also includes the use of need to know. Need to know is a security restriction where some objects are restricted unless the subject has a need to know them.

• Question 1118:

  A security manager installed a standalone fingerprint reader at the data center. All employees that need to access the data center have been enrolled to the reader and local reader database is always kept updates. When an employee who has been enrolled uses the fingerprint reader the door to the data center opens. Which of the following does this demonstrate? (Select THREE)

  A. Two-factor authentication
  B. Single sign-on
  C. Something you have
  D. Identification
  E. Authentication
  F. Authorization
  A. Two-factor authentication
  D. Identification
  E. Authentication

• Question 1119:

  Mandatory vacations are a security control which can be used to uncover which of the following?

  A. Fraud committed by a system administrator
  B. Poor password security among users
  C. The need for additional security staff
  D. Software vulnerabilities in vendor code
  A. Fraud committed by a system administrator

  ---

  Mandatory vacations also provide an opportunity to discover fraud apart from the obvious benefits of giving employees a chance to refresh and making sure that others in the company can fill those positions and make the company less dependent on those persons; a sort pf replication and duplication at all levels.

• Question 1120:

  A security technician wants to improve the strength of a weak key by making it more secure against brute force attacks. Which of the following would achieve this?

  A. Blowfish
  B. Key stretching
  C. Key escrow
  D. Recovery agent
  A. Blowfish