CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1161:

  Which of the following would an attacker use to penetrate and capture additional traffic prior to performing an IV attack?

  A. DNS poisoning
  B. DDoS
  C. Replay attack
  D. Dictionary attacks
  D. Dictionary attacks

• Question 1162:

  A security technician needs to open ports on a firewall to allow for domain name resolution. Which of the following ports should be opened? (Select TWO).

  A. TCP 21
  B. TCP 23
  C. TCP 53
  D. UDP 23
  E. UDP 53
  C. TCP 53
  E. UDP 53

  ---

  DNS uses TCP and UDP port 53. TCP port 53 is used for zone transfers, whereas UDP port 53 is used for queries.

• Question 1163:

  Matt, a security analyst, needs to select an asymmetric encryption method that allows for the same level of encryption strength with a lower key length than is typically necessary. Which of the following encryption methods offers this capability?

  A. Twofish
  B. Diffie-Hellman
  C. ECC
  D. RSA
  C. ECC

  ---

  Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. One of the main benefits in comparison with non-ECC cryptography (with plain Galois fields as a basis) is the same level of security provided by keys of smaller size.

• Question 1164:

  Ann, a security analyst, is preparing for an upcoming security audit. To ensure that she identifies unapplied security controls and patches without attacking or compromising the system, Ann would use which of the following?

  A. Vulnerability scanning
  B. SQL injection
  C. Penetration testing
  D. Antivirus update
  A. Vulnerability scanning

  ---

  A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates.

  A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security.

• Question 1165:

  A security engineer is given new application extensions each month that need to be secured prior to implementation. They do not want the new extensions to invalidate or interfere with existing application security. Additionally, the engineer wants to ensure that the new requirements are approved by the appropriate personnel. Which of the following should be in place to meet these two goals? (Select TWO).

  A. Patch Audit Policy
  B. Change Control Policy
  C. Incident Management Policy
  D. Regression Testing Policy
  E. Escalation Policy
  F. Application Audit Policy
  B. Change Control Policy
  D. Regression Testing Policy

  ---

  A backout (regression testing) is a reversion from a change that had negative consequences. It could be, for example, that everything was working fi ne until you installed a service pack on a production machine, and then services that were normally available were no longer accessible. The backout, in this instance, would revert the system to the state that it was in before the service pack was applied. Backout plans can include uninstalling service packs, hotfi xes, and patches, but they can also include reversing a migration and using previous firmware. A key component to creating such a plan is identifying what events will trigger your implementing the backout. A change control policy refers to the structured approach that is followed to secure a company's assets in the event of changes occurring.

• Question 1166:

  An auditor is given access to a conference room to conduct an analysis. When they connect their laptop's Ethernet cable into the wall jack, they are not able to get a connection to the Internet but have a link light. Which of the following is MOST likely causing this issue?

  A. Ethernet cable is damaged
  B. The host firewall is set to disallow outbound connections
  C. Network Access Control
  D. The switch port is administratively shutdown
  C. Network Access Control

  ---

  Network Access Control (NAC) means controlling access to an environment through strict adherence to and implementation of security policies. The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control.

• Question 1167:

  A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been created for a frequently used application. She notifies the software vendor and asks them for remediation steps, but is alarmed to find that no patches are available to mitigate this vulnerability.

  Which of the following BEST describes this exploit?

  A. Malicious insider threat
  B. Zero-day
  C. Client-side attack
  D. Malicious add-on
  B. Zero-day

  ---

  A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it--this exploit is called a zero day attack. Uses of zero day

  attacks can include infiltrating malware, spyware or allowing unwanted access to user information. The term "zero day" refers to the unknown nature of the hole to those outside of the hackers, specifically, the developers. Once the

  vulnerability becomes known, a race begins for the developer, who must protect users.

  In this question, there are no patches are available to mitigate the vulnerability. This is therefore a zero-day vulnerability.

• Question 1168:

  A user attempting to log on to a workstation for the first time is prompted for the following information before being granted access: username, password, and a four-digit security pin that was mailed to him during account registration. This is an example of which of the following?

  A. Dual-factor authentication
  B. Multifactor authentication
  C. Single factor authentication
  D. Biometric authentication
  C. Single factor authentication

  ---

  Multi-factor authentication (MFA) is a method of computer access control which a user can pass by successfully presenting authentication factors from at least two of the three categories:

  knowledge factors ("things only the user knows"), such as passwords possession factors ("things only the user has"), such as ATM cards inherence factors ("things only the user is"), such as biometrics

  In this question a username, password, and a four-digit security pin knowledge are all knowledge factors (something the user knows). Therefore, this is single-factor authentication.

• Question 1169:

  Using proximity card readers instead of the traditional key punch doors would help to mitigate:

  A. Impersonation
  B. Tailgating
  C. Dumpster diving
  D. Shoulder surfing
  D. Shoulder surfing

  ---

  Using a traditional key punch door, a person enters a code into a keypad to unlock the door. Someone could be watching the code being entered. They would then be able to open the door by entering the code. The process of watching the key code being entered is known as shoulder surfing.

  Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information. Shoulder surfing is an effective way to get information in crowded places because it's relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done long distance with the aid of binoculars or other vision-enhancing devices. To prevent shoulder surfing, experts recommend that you shield paperwork or your keypad from view by using your body or cupping your hand.

• Question 1170:

  An administrator, Ann, wants to ensure that only authorized devices are connected to a switch. She decides to control access based on MAC addresses. Which of the following should be configured?

  A. Implicit deny
  B. Private VLANS
  C. Flood guard
  D. Switch port security
  D. Switch port security