CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1201:

  A customer has provided an email address and password to a website as part of the login process. Which of the following BEST describes the email address?

  A. Identification
  B. Authorization
  C. Access control
  D. Authentication
  A. Identification

  ---

  Identification is defined as the claiming of an identity and only has to take place once per authentication or access process. A login process typically consists of an identification such as a username or email address and an authentication which proves you are who you say you are.

• Question 1202:

  Which of the following network devices is used to analyze traffic between various network interfaces?

  A. Proxies
  B. Firewalls
  C. Content inspection
  D. Sniffers
  D. Sniffers

  ---

  A sniffer (packet sniffer) is a tool that intercepts data flowing in a network. If computers are connected to a local area network that is not filtered or switched, the traffic can be broadcast to all computers contained in the same segment. This doesn't generally occur, since computers are generally told to ignore all the comings and goings of traffic from other computers. However, in the case of a sniffer, all traffic is shared when the sniffer software commands the Network Interface Card (NIC) to stop ignoring the traffic. The NIC is put into promiscuous mode, and it reads communications between computers within a particular segment. This allows the sniffer to seize everything that is flowing in the network, which can lead to the unauthorized access of sensitive data. A packet sniffer can take the form of either a hardware or software solution. A sniffer is also known as a packet analyzer.

• Question 1203:

  A recent spike in virus detections has been attributed to end-users visiting www.compnay.com. The business has an established relationship with an organization using the URL of www.company.com but not with the site that has been causing the infections. Which of the following would BEST describe this type of attack?

  A. Typo squatting
  B. Session hijacking
  C. Cross-site scripting
  D. Spear phishing
  A. Typo squatting

  ---

  Typosquatting, also called URL hijacking or fake url, is a form of cybersquatting, and possibly brandjacking which relies on mistakes such as typographical errors made by Internet users when inputting a website address into a web browser. Should a user accidentally enter an incorrect website address, they may be led to any URL (including an alternative website owned by a cybersquatter).

  The typosquatter's URL will usually be one of four kinds, all similar to the victim site address: (In the following, the intended website is "example.com") A common misspelling, or foreign language spelling, of the intended site: exemple.com A misspelling based on typing errors: xample.com or examlpe.com A differently phrased domain name: examples.com A different top-level domain: example.org

  Once in the typosquatter's site, the user may also be tricked into thinking that they are in fact in the real site; through the use of copied or similar logos, website layouts or content.

• Question 1204:

  Ann would like to forward some Personal Identifiable Information to her HR department by email, but she is worried about the confidentiality of the information. Which of the following will accomplish this task securely?

  A. Digital Signatures
  B. Hashing
  C. Secret Key
  D. Encryption
  D. Encryption

  ---

  Encryption is used to prevent unauthorized users from accessing data. Data encryption will support the confidentiality of the email.

• Question 1205:

  Which of the following is a directional antenna that can be used in point-to-point or point-to- multi-point WiFi communication systems? (Select TWO).

  A. Backfire
  B. Dipole
  C. Omni
  D. PTZ
  E. Dish
  A. Backfire
  E. Dish

  ---

  Both the Backfire and the Dish antennae are high gain antenna types that transmit a narrow beam of signal. It can therefore be used as a point-to-point antenna over short distances, but as point-to-multi-point antenna over longer distances.

• Question 1206:

  A security Operations Center was scanning a subnet for infections and found a contaminated machine. One of the administrators disabled the switch port that the machine was connected to, and informed a local technician of the infection. Which of the following steps did the administrator perform?

  A. Escalation
  B. Identification
  C. Notification
  D. Quarantine
  E. Preparation
  C. Notification
  D. Quarantine

• Question 1207:

  A network administrator is attempting to troubleshoot an issue regarding certificates on a secure website. During the troubleshooting process, the network administrator notices that the web gateway proxy on the local network has signed all of the certificates on the local machine. Which of the following describes the type of attack the proxy has been legitimately programmed to perform?

  A. Transitive access
  B. Spoofing
  C. Man-in-the-middle
  D. Replay
  C. Man-in-the-middle

• Question 1208:

  Which of the following is a BEST practice when dealing with user accounts that will only need to be active for a limited time period?

  A. When creating the account, set the account to not remember password history.
  B. When creating the account, set an expiration date on the account.
  C. When creating the account, set a password expiration date on the account.
  D. When creating the account, set the account to have time of day restrictions.
  B. When creating the account, set an expiration date on the account.

  ---

  Disablement is a secure feature to employ on user accounts for temporary workers, interns, or consultants. It automatically disables a user account or causes the account to expire at a specific time and on a specific day.

• Question 1209:

  The call center supervisor has reported that many employees have been playing preinstalled games on company computers and this is reducing productivity. Which of the following would be MOST effective for preventing this behavior?

  A. Acceptable use policies
  B. Host-based firewalls
  C. Content inspection
  D. Application whitelisting
  D. Application whitelisting

  ---

  Application whitelisting is a form of application security which prevents any software from running on a system unless it is included on a preapproved exception list.

• Question 1210:

  A company has had several security incidents in the past six months. It appears that the majority of the incidents occurred on systems with older software on development workstations. Which of the following should be implemented to help prevent similar incidents in the future?

  A. Peer code review
  B. Application whitelisting
  C. Patch management
  D. Host-based firewall
  C. Patch management