CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1151:

  Which of the following internal security controls is aimed at preventing two system administrators from completing the same tasks?

  A. Least privilege
  B. Separation of Duties
  C. Mandatory Vacation
  D. Security Policy
  B. Separation of Duties

• Question 1152:

  A network analyst received a number of reports that impersonation was taking place on the network. Session tokens were deployed to mitigate this issue and defend against which of the following attacks?

  A. Replay
  B. DDoS
  C. Smurf
  D. Ping of Death
  A. Replay

  ---

  A replay attack (also known as playback attack) is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. This is carried out either by the originator or by an adversary who intercepts the data and retransmits it, possibly as part of a masquerade attack by IP packet substitution (such as stream cipher attack).

  For example: Suppose Alice wants to prove her identity to Bob. Bob requests her password as proof of identity, which Alice dutifully provides (possibly after some transformation like a hash function); meanwhile, Eve is eavesdropping on the conversation and keeps the password (or the hash). After the interchange is over, Eve (posing as Alice) connects to Bob; when asked for a proof of identity, Eve sends Alice's password (or hash) read from the last session, which Bob accepts thus granting access to Eve.

  Countermeasures: A way to avoid replay attacks is by using session tokens: Bob sends a one-time token to Alice, which Alice uses to transform the password and send the result to Bob (e.g. computing a hash function of the session token appended to the password). On his side Bob performs the same computation; if and only if both values match, the login is successful. Now suppose Eve has captured this value and tries to use it on another session; Bob sends a different session token, and when Eve replies with the captured value it will be different from Bob's computation. Session tokens should be chosen by a (pseudo-) random process. Otherwise Eve may be able to pose as Bob, presenting some predicted future token, and convince Alice to use that token in her transformation. Eve can then replay her reply at a later time (when the previously predicted token is actually presented by Bob), and Bob will accept the authentication. One-time passwords are similar to session tokens in that the password expires after it has been used or after a very short amount of time. They can be used to authenticate individual transactions in addition to sessions. The technique has been widely implemented in personal online banking systems. Bob can also send nonces but should then include a message authentication code (MAC), which Alice should check. Timestamping is another way of preventing a replay attack. Synchronization should be achieved using a secure protocol. For example Bob periodically broadcasts the time on his clock together with a MAC. When Alice wants to send Bob a message, she includes her best estimate of the time on his clock in her message, which is also authenticated. Bob only accepts messages for which the timestamp is within a reasonable tolerance. The advantage of this scheme is that Bob does not need to generate (pseudo-) random numbers, with the trade-off being that replay attacks, if they are performed quickly enough i.e. within that 'reasonable' limit, could succeed.

• Question 1153:

  When designing a new network infrastructure, a security administrator requests that the intranet web server be placed in an isolated area of the network for security purposes. Which of the following design elements would be implemented to comply with the security administrator's request?

  A. DMZ
  B. Cloud services
  C. Virtualization
  D. Sandboxing
  A. DMZ

  ---

  A demilitarized zone (DMZ) is an area of a network that is designed specifically for public users to access. The DMZ is a buffer network between the public untrusted Internet and the private trusted LAN. Often a DMZ is deployed through the use of a multihomed firewall.

• Question 1154:

  Joe an end user has received a virus detection warning. Which of the following is the first course of action that should be taken?

  A. Recovery
  B. Reporting
  C. Remediation
  D. Identification
  B. Reporting

• Question 1155:

  The use of social networking sites introduces the risk of:

  A. Disclosure of proprietary information
  B. Data classification issues
  C. Data availability issues
  D. Broken chain of custody
  A. Disclosure of proprietary information

  ---

  People and processes must be in place to prevent the unauthorized disclosure or proprietary information and sensitive information s these pose a security risk to companies. With social networking your company can be exposed to as many threats as the amount of users that make use of social networking and are not advised on security policy regarding the use of social networking.

• Question 1156:

  A security administrator is using a software program to test the security of a wireless access point. After running the program for a few hours, the access point sends the wireless secret key back to the software program. Which of the following attacks is this an example of?

  A. WPS
  B. IV
  C. Deauth
  D. Replay
  C. Deauth

• Question 1157:

  A security administrator would like to write an access rule to block the three IP addresses given below. Which of the following combinations should be used to include all of the given IP addresses?

  192.168.12.255

  192.168.12.227

  192.168.12.229

  A. 192.168.12.0/25
  B. 192.168.12.128.28
  C. 192.168.12.224/29
  D. 192.168.12.225/30
  B. 192.168.12.128.28

• Question 1158:

  Which of the following controls mitigates the risk of Matt, an attacker, gaining access to a company network by using a former employee's credential?

  A. Account expiration
  B. Password complexity
  C. Account lockout
  D. Dual factor authentication
  A. Account expiration

  ---

  Account expiration is a secure feature to employ on user accounts for temporary workers, interns, or consultants. It automatically disables a user account or causes the account to expire at a specific time and on a specific day.

• Question 1159:

  Which of the following can use RC4 for encryption? (Select TWO).

  A. CHAP
  B. SSL
  C. WEP
  D. AES
  E. 3DES
  B. SSL
  C. WEP

  ---

  Explanation: B: In cryptography, RC4 (Rivest Cipher 4 also known as ARC4 or ARCFOUR meaning Alleged RC4) is the most widely used software stream cipher and is used in popular Internet protocols such as Secure Sockets Layer (SSL) and Transport Layer Security (TLS).

  C: WEP also uses RC4, however WEP is still unsecure.

• Question 1160:

  A corporation is looking to expand their data center but has run out of physical space in which to store hardware. Which of the following would offer the ability to expand while keeping their current data center operated by internal staff?

  A. Virtualization
  B. Subnetting
  C. IaaS
  D. SaaS
  A. Virtualization

  ---

  Virtualization allows a single set of hardware to host multiple virtual machines.