CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1241:

  A security administrator is tasked with implementing centralized management of all network devices. Network administrators will be required to logon to network devices using their LDAP credentials. All command executed by network administrators on network devices must fall within a preset list of authorized commands and must be logged to a central facility. Which of the following configuration commands should be implemented to enforce this requirement?

  A. LDAP server 10.55.199.3
  B. CN=company, CN=com, OU=netadmin, DC=192.32.10.233
  C. SYSLOG SERVER 172.16.23.50
  D. TACAS server 192.168.1.100
  B. CN=company, CN=com, OU=netadmin, DC=192.32.10.233

• Question 1242:

  During a Linux security audit at a local college, it was noted that members of the dean's group were able to modify employee records in addition to modifying student records, resulting in an audit exception. The college security policy states that the dean's group should only have the ability to modify student records. Assuming that the correct user and group ownerships are in place, which of the following sets of permissions should have been assigned to the directories containing the employee records?

  A. R-x---rwx
  B. Rwxrwxrwx
  C. Rwx----wx
  D. Rwxrwxr-
  B. Rwxrwxrwx

• Question 1243:

  A security technician is attempting to access a wireless network protected with WEP. The technician does not know any information about the network. Which of the following should the technician do to gather information about the configuration of the wireless network?

  A. Spoof the MAC address of an observed wireless network client
  B. Ping the access point to discover the SSID of the network
  C. Perform a dictionary attack on the access point to enumerate the WEP key
  D. Capture client to access point disassociation packets to replay on the local PC's loopback
  A. Spoof the MAC address of an observed wireless network client

  ---

  With ARP spoofing (also known as ARP poisoning), the MAC (Media Access Control) address of the data is faked. By faking this value, it is possible to make it look as if the data came from a network that it did not. This can be used to gain access to the network, to fool the router into sending data here that was intended for another host, or to launch a DoS attack. In all cases, the address being faked is an address of a legitimate user, and that makes it possible to get around such measures as allow/deny lists. Note: As an example, the initialization vector (IV) that WEP uses for encryption is 24-bit, which is quite weak and means that IVs are reused with the same key. By examining the repeating result, it was easy for attackers to crack the WEP secret key. This is known as an IV attack.

• Question 1244:

  Symmetric encryption utilizes __________, while asymmetric encryption utilizes _________.

  A. Public keys, one time
  B. Shared keys, private keys
  C. Private keys, session keys
  D. Private keys, public keys
  D. Private keys, public keys

  ---

  Symmetrical systems require the key to be private between the two parties. With asymmetric systems, each circuit has one key. In more detail:

  *

  Symmetric algorithms require both ends of an encrypted message to have the same key and processing algorithms. Symmetric algorithms generate a secret key that must be protected. A symmetric key, sometimes referred to as a secret key or private key, is a key that isn't disclosed to people who aren't authorized to use the encryption system.

  *

  Asymmetric algorithms use two keys to encrypt and decrypt data. These asymmetric keys are referred to as the public key and the private key. The sender uses the public key to encrypt a message, and the receiver uses the private key to decrypt the message; what one key does, the other one undoes.

• Question 1245:

  Ann, a security analyst, has discovered that her company has very high staff turnover and often user accounts are not disabled after an employee leaves the company. Which of the following could Ann implement to help identify accounts that are still active for terminated employees?

  A. Routine audits
  B. Account expirations
  C. Risk assessments
  D. Change management
  A. Routine audits

  ---

  Routine audits are carried out after you have implemented security controls based on risk. These audits include aspects such as user rights and permissions and specific events.

• Question 1246:

  Which of the following would a security administrator implement in order to identify change from the standard configuration on a server?

  A. Penetration test
  B. Code review
  C. Baseline review
  D. Design review
  C. Baseline review

  ---

  The standard configuration on a server is known as the baseline. The IT baseline protection approach is a methodology to identify and implement computer security measures in an organization. The aim is the achievement of an adequate and appropriate level of security for IT systems. This is known as a baseline. A baseline report compares the current status of network systems in terms of security updates, performance or other metrics to a predefined set of standards (the baseline).

• Question 1247:

  Which of the following types of logs could provide clues that someone has been attempting to compromise the SQL Server database?

  A. Event
  B. SQL_LOG
  C. Security
  D. Access
  A. Event

  ---

  Event logs include Application logs, such as those where SQL Server would write entries. This is where you would see logs with details of someone trying to access a SQL database.

• Question 1248:

  Joe is the accounts payable agent for ABC Company. Joe has been performing accounts payable function for the ABC Company without any supervision. Management has noticed several new accounts without billing invoices that were paid. Which of the following is the BEST management option for review of the new accounts?

  A. Mandatory vacation
  B. Job rotation
  C. Separation of duties
  D. Replacement
  A. Mandatory vacation

  ---

  A mandatory vacation policy requires all users to take time away from work to refresh. Mandatory vacation give the employee a chance to refresh, but it also gives the company a chance to make sure that others can fill in any gaps in skills and satisfies the need to have replication or duplication at all levels. Mandatory vacations also provide an opportunity to discover fraud. In this case mandatory vacations can allow the company to review all the new accounts.

• Question 1249:

  Which of the following describes purposefully injecting extra input during testing, possibly causing an application to crash?

  A. Input validation
  B. Exception handling
  C. Application hardening
  D. Fuzzing
  D. Fuzzing

  ---

  Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks.

• Question 1250:

  Which of the following is an XML based open standard used in the exchange of authentication and authorization information between different parties?

  A. LDAP
  B. SAML
  C. TACACS+
  D. Kerberos
  B. SAML

  ---

  Security Assertion Markup Language (SAML) is an open-standard data format centred on XML. It is used for supporting the exchange of authentication and authorization details between systems, services, and devices.