CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 111:

  Various employees have lost valuable customer data due to hard drives failing in company provided laptops. It has been discovered that the hard drives used in one model of laptops provided by the company has been recalled by the manufactory, The help desk is only able to replace the hard drives after they fail because there is no centralized records of the model of laptop given to each specific user. Which of the following could have prevented this situation from occurring?

  A. Data backups
  B. Asset tracking
  C. Support ownership
  D. BYOD policies
  A. Data backups

• Question 112:

  A technician is configuring a wireless guest network. After applying the most recent changes the technician finds the new devices can no longer find the wireless network by name but existing devices are still able to use the wireless network. Which of the following security measures did the technician MOST likely implement to cause this Scenario?

  A. Deactivation of SSID broadcast
  B. Reduction of WAP signal output power
  C. Activation of 802.1X with RADIUS
  D. Implementation of MAC filtering
  E. Beacon interval was decreased
  A. Deactivation of SSID broadcast

• Question 113:

  Which of the following is being tested when a company's payroll server is powered off for eight hours?

  A. Succession plan
  B. Business impact document
  C. Continuity of operations plan
  D. Risk assessment plan
  C. Continuity of operations plan

  ---

  Continuity of operations plan is the effort to ensure the continued performance of critical business functions during a wide range of potential emergencies.

• Question 114:

  Ann, the security administrator, wishes to implement multifactor security. Which of the following should be implemented in order to compliment password usage and smart cards?

  A. Hard tokens
  B. Fingerprint readers
  C. Swipe badge readers
  D. Passphrases
  B. Fingerprint readers

  ---

  A multifactor authentication method uses two or more processes for logon. A twofactor method might use smart cards and biometrics for logon. For obvious reasons, the two or more factors employed should not be from the same category.

• Question 115:

  Pete, a security analyst, has been tasked with explaining the different types of malware to his colleagues. The two malware types that the group seems to be most interested in are botnets and viruses. Which of the following explains the difference between these two types of malware?

  A. Viruses are a subset of botnets which are used as part of SYN attacks.
  B. Botnets are a subset of malware which are used as part of DDoS attacks.
  C. Viruses are a class of malware which create hidden openings within an OS.
  D. Botnets are used within DR to ensure network uptime and viruses are not.
  B. Botnets are a subset of malware which are used as part of DDoS attacks.

  ---

  A botnet is a collection of Internet-connected programs communicating with other similar programs in order to perform tasks. This can be as mundane as keeping control of an Internet Relay Chat (IRC) channel, or it could be used to send spam email or participate in distributed denial-of-service attacks. The word botnet is a combination of the words robot and network. The term is usually used with a negative or malicious connotation. Computers can be co-opted into a botnet when they execute malicious software. This can be accomplished by luring users into making a drive-by download, exploiting web browser vulnerabilities, or by tricking the user into running a Trojan horse program, which may come from an email attachment. This malware will typically install modules that allow the computer to be commanded and controlled by the botnet's operator. Many computer users are unaware that their computer is infected with bots. Depending on how it is written, a Trojan may then delete itself, or may remain present to update and maintain the modules.

• Question 116:

  Jane, a security administrator, has been tasked with explaining authentication services to the company's management team. The company runs an active directory infrastructure. Which of the following solutions BEST relates to the host authentication protocol within the company's environment?

  A. Kerberos
  B. Least privilege
  C. TACACS+
  D. LDAP
  A. Kerberos

  ---

  Kerberos was accepted by Microsoft as the chosen authentication protocol for Windows 2000 and Active Directory domains that followed.

• Question 117:

  A company needs to receive data that contains personally identifiable information. The company requires both the transmission and data at rest to be encrypted. Which of the following achieves this goal? (Select TWO).

  A. SSH
  B. TFTP
  C. NTLM
  D. TKIP
  E. SMTP
  F. PGP/GPG
  A. SSH
  F. PGP/GPG

  ---

  We can use SSH to encrypt the transmission and PGP/GPG to encrypt the data at rest (on disk).

  A: Secure Shell (SSH) is a cryptographic protocol that can be used to secure network communication. It establishes a secure tunnel over an insecure network.

  F: Pretty Good Privacy (PGP) is a data encryption and decryption solution that can be used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications.

• Question 118:

  An employee finds a usb drive in the employee lunch room and plugs the drive into a shared workstation to determine who owns the drive. When the drive is inserted, a command prompt opens and a script begins to run. The employee notifies a technician who determines that data on a server have been compromised. This is an example of:

  A. Device removal
  B. Data disclosure
  C. Incident identification
  D. Mitigation steps
  C. Incident identification

• Question 119:

  On Monday, all company employees report being unable to connect to the corporate wireless network, which uses 802.1x with PEAP. A technician verifies that no configuration changes were made to the wireless network and its supporting infrastructure, and that there are no outages.

  Which of the following is the MOST likely cause for this issue?

  A. Too many incorrect authentication attempts have caused users to be temporarily disabled.
  B. The DNS server is overwhelmed with connections and is unable to respond to queries.
  C. The company IDS detected a wireless attack and disabled the wireless network.
  D. The Remote Authentication Dial-In User Service server certificate has expired.
  D. The Remote Authentication Dial-In User Service server certificate has expired.

  ---

  The question states that the network uses 802.1x with PEAP. The 802.1x authentication server is typically an EAP-compliant Remote Access Dial-In User Service (RADIUS). A RADIUS server will be configured with a digital certificate. When

  a digital certificate is created, an expiration period is configured by the Certificate Authority (CA). The expiration period is commonly one or two years.

  The question states that no configuration changes have been made so it's likely that the certificate has expired.

• Question 120:

  Which of the following delineates why it is important to perform egress filtering and monitoring on Internet connected security zones of interfaces on a firewall?

  A. Egress traffic is more important than ingress traffic for malware prevention
  B. To rebalance the amount of outbound traffic and inbound traffic
  C. Outbound traffic could be communicating to known botnet sources
  D. To prevent DDoS attacks originating from external network
  B. To rebalance the amount of outbound traffic and inbound traffic