CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1211:

  Users have reported receiving unsolicited emails in their inboxes, often times with malicious links embedded. Which of the following should be implemented in order to redirect these messages?

  A. Proxy server
  B. Spam filter
  C. Network firewall
  D. Application firewall.
  B. Spam filter

• Question 1212:

  A security assurance officer is preparing a plan to measure the technical state of a customer's enterprise. The testers employed to perform the audit will be given access to the customer facility and network. The testers will not be given access to the details of custom developed software used by the customer. However the testers with have access to the source code for several open source applications and pieces of networking equipment used at the facility, but these items will not be within the scope of the audit. Which of the following BEST describes the appropriate method of testing or technique to use in this scenario? (Select TWO)

  A. Social engineering
  B. All source
  C. Black box
  D. Memory dumping
  E. Penetration
  C. Black box
  E. Penetration

• Question 1213:

  Which of the following is a software vulnerability that can be avoided by using input validation?

  A. Buffer overflow
  B. Application fuzzing
  C. Incorrect input
  D. Error handling
  C. Incorrect input

• Question 1214:

  An administrator wishes to hide the network addresses of an internal network when connecting to the Internet. The MOST effective way to mask the network address of the users would be by passing the traffic through a:

  A. stateful firewall
  B. packet-filtering firewall
  C. NIPS
  D. NAT
  D. NAT

  ---

  NAT serves as a basic firewall by only allowing incoming traffic that is in response to an internal system's request.

• Question 1215:

  Joe a technician is tasked with finding a way to test operating system patches for a wide variety of servers before deployment to the production environment while utilizing a limited amount of hardware resources. Which of the following would provide the BEST environment for performing this testing?

  A. OS hardening
  B. Application control
  C. Virtualization
  D. Sandboxing
  C. Virtualization

• Question 1216:

  Which of the following should the security administrator implement to limit web traffic based on country of origin? (Select THREE).

  A. Spam filter
  B. Load balancer
  C. Antivirus
  D. Proxies
  E. Firewall
  F. NIDS
  G. URL filtering
  D. Proxies
  E. Firewall
  G. URL filtering

  ---

  A proxy server is a server that acts as an intermediary for requests from clients seeking resources from other servers.

  Firewalls manage traffic using a rule or a set of rules. A URL is a reference to a resource that specifies the location of the resource. A URL filter is used to block access to a site based on all or part of a URL.

• Question 1217:

  Matt, a security administrator, wants to configure all the switches and routers in the network in order to securely monitor their status. Which of the following protocols would he need to configure on each device?

  A. SMTP
  B. SNMPv3
  C. IPSec
  D. SNMP
  B. SNMPv3

  ---

  Explanation: Currently, SNMP is predominantly used for monitoring and performance management. SNMPv3 defines a secure version of SNMP and also facilitates remote configuration of the SNMP entities.

• Question 1218:

  The network security manager has been notified by customer service that employees have been sending unencrypted confidential information via email. Which of the following should the manager select to BEST detect and provide notification of these occurrences?

  A. DLP
  B. SSL
  C. DEP
  D. UTM
  A. DLP

• Question 1219:

  Which of the following is the BEST method for ensuring all files and folders are encrypted on all corporate laptops where the file structures are unknown?

  A. Folder encryption
  B. File encryption
  C. Whole disk encryption
  D. Steganography
  C. Whole disk encryption

  ---

  Full-disk encryption encrypts the data on the hard drive of the device or on a removable drive. This feature ensures that the data on the device or removable drive cannot be accessed in a useable form should it be stolen. Furthermore, full-disk encryption is not dependant on knowledge of the file structure.

• Question 1220:

  Which of the following BEST describes the type of attack that is occurring? (Select TWO).

  

  

  A. DNS spoofing
  B. Man-in-the-middle
  C. Backdoor
  D. Replay
  E. ARP attack
  F. Spear phishing
  G. Xmas attack
  A. DNS spoofing
  E. ARP attack

  ---

  We have a legit bank web site and a hacker bank web site. The hacker has a laptop connected to the network. The hacker is redirecting bank web site users to the hacker bank web site instead of the legit bank web site. This can be done using two methods: DNS Spoofing and ARP Attack (ARP Poisoning).

  A: DNS spoofing (or DNS cache poisoning) is a computer hacking attack, whereby data is introduced into a Domain Name System (DNS) resolver's cache, causing the name server to return an incorrect IP address, diverting traffic to the attacker's computer (or any other computer). A domain name system server translates a human-readable domain name (such as example.com) into a numerical IP address that is used to route communications between nodes. Normally if the server doesn't know a requested translation it will ask another server, and the process continues recursively. To increase performance, a server will typically remember (cache) these translations for a certain amount of time, so that, if it receives another request for the same translation, it can reply without having to ask the other server again. When a DNS server has received a false translation and caches it for performance optimization, it is considered poisoned, and it supplies the false data to clients. If a DNS server is poisoned, it may return an incorrect IP address, diverting traffic to another computer (in this case, the hacker bank web site server).

  E: Address Resolution Protocol poisoning (ARP poisoning) is a form of attack in which an attacker changes the Media Access Control (MAC) address and attacks an Ethernet LAN by changing the target computer's ARP cache with a forged ARP request and reply packets. This modifies the layer -Ethernet MAC address into the hacker's known MAC address to monitor it. Because the ARP replies are forged, the target computer unintentionally sends the frames to the hacker's computer first instead of sending it to the original destination. As a result, both the user's data and privacy are compromised. An effective ARP poisoning attempt is undetectable to the user. ARP poisoning is also known as ARP cache poisoning or ARP poison routing (APR).