CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1231:

  A user, Ann, has been issued a smart card and is having problems opening old encrypted email. Ann published her certificates to the local windows store and to the global address list. Which of the following would still need to be performed?

  A. Setup the email security with her new certificates
  B. Recover her old private certificate
  C. Reinstall her previous public certificate
  D. Verify the correct email address is associated with her certificate
  A. Setup the email security with her new certificates

• Question 1232:

  Joe, a user, reports to the system administrator that he is receiving an error stating his certificate has been revoked. Which of the following is the name of the database repository for these certificates?

  A. CSR
  B. OCSP
  C. CA
  D. CRL
  D. CRL

  ---

  A certificate revocation list (CRL) is created and distributed to all CAs to revoke a certificate or key.

• Question 1233:

  Which of the following attacks is generally initiated from a botnet?

  A. Cross site scripting attack
  B. HTTP header injection
  C. Distributed denial of service
  D. A war driving attack
  C. Distributed denial of service

• Question 1234:

  A company has implemented PPTP as a VPN solution. Which of the following ports would need to be opened on the firewall in order for this VPN to function properly? (Select TWO).

  A. UDP 1723
  B. TCP 500
  C. TCP 1723
  D. UDP 47
  E. TCP 47
  C. TCP 1723
  D. UDP 47

  ---

  A PPTP tunnel is instantiated by communication to the peer on TCP port 1723. This TCP connection is then used to initiate and manage a second GRE tunnel to the same peer. The PPTP GRE packet format is non-standard, including an additional acknowledgement field replacing the typical routing field in the GRE header. However, as in a normal GRE connection, those modified GRE packets are directly encapsulated into IP packets, and seen as IP protocol number 47.

• Question 1235:

  A BYOD policy in which employees are able to access the wireless guest network is in effect in an organization. Some users however are using the Ethernet port in personal laptops to the wired network. Which of the following could an administrator use to ensure that unauthorized devices are not allowed to access the wired network?

  A. VLAN access rules configured to reject packets originating from unauthorized devices
  B. Router access lists configured to block the IP addresses of unauthorized devices
  C. Firewall rules configured to block the MAC addresses of unauthorized devices
  D. Port security configured shut down the port when unauthorized devices connect
  D. Port security configured shut down the port when unauthorized devices connect

• Question 1236:

  A large multinational corporation with networks in 30 countries wants to establish an understanding of their overall public-facing network attack surface. Which of the following security techniques would be BEST suited for this?

  A. External penetration test
  B. Internal vulnerability scan
  C. External vulnerability scan
  D. Internal penetration test
  C. External vulnerability scan

  ---

  In this question, we need to determine the public-facing network attack surface. We therefore need to perform a vulnerability scan from outside the network; in other words, an external vulnerability scan. A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Vulnerability scanning typically refers to the scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software or malicious employees in an enterprise.

• Question 1237:

  A company has purchased an application that integrates into their enterprise user directory for account authentication. Users are still prompted to type in their usernames and passwords. Which of the following types of authentication is being utilized here?

  A. Separation of duties
  B. Least privilege
  C. Same sign-on
  D. Single sign-on
  C. Same sign-on

  ---

  Explanation: Same sign-on requires the users to re-enter their credentials but it allows them to use the same credentials that they use to sign on locally.

• Question 1238:

  A server administrator notes that a fully patched application often stops running due to a memory error. When reviewing the debugging logs they notice code being run calling an internal process to exploit the machine. Which of the following attacks does this describes?

  A. Malicious add-on
  B. SQL injection
  C. Cross site scripting
  D. Zero-day
  D. Zero-day

• Question 1239:

  Which of the following controls should critical application servers implement to protect themselves from other potentially compromised application services?

  A. NIPS
  B. Content filter
  C. NIDS
  D. Host-based firewalls
  D. Host-based firewalls

  ---

  A host-based firewall is designed to protect the host from network based attack by using filters to limit the network traffic that is allowed to enter or leave the host. The action of a filter is to allow, deny, or log the network packet. Allow enables the packet to continue toward its destination. Deny blocks the packet from going any further and effectively discarding it. Log records information about the packet into a log file. Filters can be based on protocol and ports. By blocking protocols and ports that are not required, other potentially compromised application services would be prevented from being exploited across the network.

• Question 1240:

  Visible security cameras are considered to be which of the following types of security controls?

  A. Technical
  B. Compensating
  C. Deterrent
  D. Administrative
  C. Deterrent

  ---

  Since a deterrent access control method is designed to discourage the violation of security policies, so a camera can be used to discourage individuals from taking unwanted action.