CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1191:

  A security analyst is reviewing the following packet capture of an attack directed at a company's server located in the DMZ:

  

  Which of the following ACLs provides the BEST protection against the above attack and any further attacks from the same IP, while minimizing service interruption?

  A. DENY TCO From ANY to 172.31.64.4
  B. Deny UDP from 192.168.1.0/24 to 172.31.67.0/24
  C. Deny IP from 192.168.1.10/32 to 0.0.0.0/0
  D. Deny TCP from 192.168.1.10 to 172.31.67.4
  D. Deny TCP from 192.168.1.10 to 172.31.67.4

• Question 1192:

  Which of the following describes the purpose of an MOU?

  A. Define interoperability requirements
  B. Define data backup process
  C. Define onboard/offboard procedure
  D. Define responsibilities of each party
  D. Define responsibilities of each party

  ---

  MOU or Memorandum of Understanding is a document outlining which party is responsible for what portion of the work.

• Question 1193:

  An overseas branch office within a company has many more technical and non-technical security incidents than other parts of the company. Which of the following management controls should be introduced to the branch office to improve their state of security?

  A. Initial baseline configuration snapshots
  B. Firewall, IPS and network segmentation
  C. Event log analysis and incident response
  D. Continuous security monitoring processes
  D. Continuous security monitoring processes

  ---

  Continuous monitoring may involve regular measurements of network traffic levels, routine evaluations for regulatory compliance, and checks of network security device configurations. It also points toward the never-ending review of what resources a user actually accesses, which is critical for preventing insider threats.

  Incorrect Options:

  A: An initial baseline configuration snapshot would allow for the standardized minimal level of security that all systems in an organization must comply with to be enforced. This will not cover the non-technical security incidents.

  B: A Firewall, IPS and network segmentation will offer technical protection, but not non- technical security protection.

  C: Event log analysis and incident response will not cover the non-technical security incidents.

  Reference:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis, 2014, p. 154.

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp. 207, 208

• Question 1194:

  A software company sends their offsite backup tapes to a third party storage facility. TO meet confidentiality the tapes should be:

  A. Labeled
  B. Hashed
  C. Encrypted
  D. Duplicated
  A. Labeled

• Question 1195:

  Which of the following authentication methods requires the user, service provider and an identity provider to take part in the authentication process?

  A. RADIUS
  B. SAML
  C. Secure LDAP
  D. Kerberos
  A. RADIUS

• Question 1196:

  Two users need to securely share encrypted files via email. Company policy prohibits users from sharing credentials or exchanging encryption keys. Which of the following can be implemented to enable users to share encrypted data while abiding by company policies?

  A. Key escrow
  B. Digital signatures
  C. PKI
  D. Hashing
  B. Digital signatures

• Question 1197:

  A security administrator wants to test the reliability of an application which accepts user provided parameters. The administrator is concerned with data integrity and availability. Which of the following should be implemented to accomplish this task?

  A. Secure coding
  B. Fuzzing
  C. Exception handling
  D. Input validation
  B. Fuzzing

  ---

  Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks.

• Question 1198:

  An administrator needs to allow both secure and regular web traffic into a network. Which of the following ports should be configured? (Select TWO)

  A. 25
  B. 53
  C. 80
  D. 110
  E. 143
  F. 443
  C. 80
  F. 443

• Question 1199:

  A company would like to implement two-factor authentication for its vulnerability management database to require system administrators to use their token and random PIN codes. Which of the following authentication services accomplishes this objective?

  A. SAML
  B. TACACS+
  C. Kerberos
  D. RADIUS
  D. RADIUS

• Question 1200:

  Which of the following is true about the CRL?

  A. It should be kept public
  B. It signs other keys
  C. It must be kept secret
  D. It must be encrypted
  A. It should be kept public

  ---

  The CRL must be public so that it can be known which keys and certificates have been revoked.

  In the operation of some cryptosystems, usually public key infrastructures (PKIs), a certificate revocation list (CRL) is a list of certificates (or more specifically, a list of serial numbers for certificates) that have been revoked, and therefore,

  entities presenting those (revoked) certificates should no longer be trusted.