CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1281:

  Verifying the integrity of data submitted to a computer program at or during run-time, with the intent of preventing the malicious exploitation of unintentional effects in the structure of the code, is BEST described as which of the following?

  A. Output sanitization
  B. Input validation
  C. Application hardening
  D. Fuzzing
  B. Input validation

  ---

  Input validation is a defensive technique intended to mitigate against possible user input attacks, such as buffer overflows and fuzzing. Input validation checks every user input submitted to the application before processing that input. The check could be a length, a character type, a language type, or a domain.

• Question 1282:

  A user casually browsing the Internet is redirected to a warez site where a number of pop- ups appear. After clicking on a pop-up to complete a survey, a drive-by download occurs. Which of the following is MOST likely to be contained in the download?

  A. Backdoor
  B. Spyware
  C. Logic bomb
  D. DDoS
  E. Smurf
  B. Spyware

  ---

  Explanation: Spyware is software that is used to gather information about a person or organization without their knowledge and sends that information to another entity. Whenever spyware is used for malicious purposes, its presence is typically hidden from the user and can be difficult to detect. Some spyware, such as keyloggers, may be installed by the owner of a shared, corporate, or public computer intentionally in order to monitor users.

• Question 1283:

  During a routine configuration audit, a systems administrator determines that a former employee placed an executable on an application server. Once the system was isolated and diagnosed, it was determined that the executable was programmed to establish a connection to a malicious command and control server. Which of the following forms of malware is best described in the scenario?

  A. Logic bomb
  B. Rootkit
  C. Back door
  D. Ransomware
  B. Rootkit

• Question 1284:

  Ann, a system analyst, discovered the following log. Which of the following or techniques does this indicate?

  {bp1@localmachine}$ Is-al

  Total 12

  Drwxrwxr-x

  

  A. Protocol analyzer
  B. Port scanner
  C. Vulnerability
  D. Banner grabbing
  A. Protocol analyzer

• Question 1285:

  The finance department works with a bank which has recently had a number of cyber attacks. The finance department is concerned that the banking website certificates have been compromised. Which of the following can the finance department check to see if any of the bank's certificates are still valid?

  A. Bank's CRL
  B. Bank's private key
  C. Bank's key escrow
  D. Bank's recovery agent
  A. Bank's CRL

  ---

  The finance department can check if any of the bank's certificates are in the CRL or not. If a certificate is not in the CRL then it is still valid. The CRL (Certificate revocation list) is exactly what its name implies: a list of subscribers paired with digital certificate status. The list enumerates revoked certificates along with the reason(s) for revocation. The dates of certificate issue, and the entities that issued them, are also included. In addition, each list contains a proposed date for the next release.

• Question 1286:

  Which of the following does full disk encryption prevent?

  A. Client side attacks
  B. Clear text access
  C. Database theft
  D. Network-based attacks
  B. Clear text access

  ---

  Full-disk encryption encrypts the data on the device. This feature ensures that the data on the device cannot be accessed in a useable form should the device be stolen.

• Question 1287:

  Joe, the chief technical officer (CTO) is concerned that the servers and network devices may not be able to handle the growing needs of the company. He has asked his network engineer to being monitoring the performance of these devices and present statistics to management for capacity planning. Which of the following protocols should be used to this?

  A. SNMP
  B. SSH
  C. TLS
  D. ICMP
  A. SNMP

• Question 1288:

  A system administrator needs to implement 802.1x whereby when user logs into the network, the authentication server communicates to the network switch and assigns the user to the proper VLAN. Which of the following protocols should be used?

  A. RADIUS
  B. Kerberos
  C. LDAP
  D. MSCHAP
  A. RADIUS

• Question 1289:

  The helpdesk reports increased calls from clients reporting spikes in malware infections on their systems. Which of the following phases of incident response is MOST appropriate as a FIRST response?

  A. Recovery
  B. Follow-up
  C. Validation
  D. Identification
  E. Eradication
  F. Containment
  D. Identification

  ---

  To be able to respond to the incident of malware infection you need to know what type of malware was used since there are many types of malware around. This makes identification critical in this case.

• Question 1290:

  A company hires a penetration testing team to test its overall security posture. The organization has not disclosed any information to the penetration testing team and has allocated five days for testing. Which of the following types of testing will the penetration testing team have to conduct?

  A. Static analysis
  B. Gray Box
  C. White box
  D. Black box
  D. Black box