CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 121:

  After visiting a website, a user receives an email thanking them for a purchase which they did not request. Upon investigation the security administrator sees the following source code in a pop-up window:

  Which of the following has MOST likely occurred?

  A. SQL injection
  B. Cookie stealing
  C. XSRF
  D. XSS
  C. XSRF

  ---

  XSRF or cross-site request forgery applies to web applications and is an attack that exploits the web application's trust of a user who known or is supposed to have been authenticated. This is often accomplished without the user's knowledge.

• Question 122:

  A victim is logged onto a popular home router forum site in order to troubleshoot some router configuration issues. The router is a fairly standard configuration and has an IP address of

  192.168.1.1. The victim is logged into their router administrative interface in one tab and clicks a forum link in another tab. Due to clicking the forum link, the home router reboots. Which of the following attacks MOST likely occurred?

  A. Brute force password attack
  B. Cross-site request forgery
  C. Cross-site scripting
  D. Fuzzing
  B. Cross-site request forgery

  ---

  Cross-Site Request Forgery--also known as XSRF, session riding, and one-click attack--involves unauthorized commands coming from a trusted user to the website. This is often done without the user's knowledge, and it employs some type of social networking to pull it off. For example, assume that Evan and Spencer are chatting through Facebook. Spencer sends Evan a link to what he purports is a funny video that will crack him up. Evan clicks the link, but it actually brings up Evan's bank account information in another browser tab, takes a screenshot of it, closes the tab, and sends the information to Spencer. The reason the attack is possible is because Evan is a trusted user with his own bank. In order for it to work, Evan would need to have recently accessed that bank's website and have a cookie that had yet to expire. The best protection against cross-site scripting is to disable the running of scripts (and browser profi les).

• Question 123:

  A Human Resources user is issued a virtual desktop typically assigned to Accounting employees. A system administrator wants to disable certain services and remove the local accounting groups installed by default on this virtual machine. The system administrator is adhering to which of the following security best practices?

  A. Black listing applications
  B. Operating System hardening
  C. Mandatory Access Control
  D. Patch Management
  B. Operating System hardening

  ---

  Operating System hardening is the process of securing the operating system by reducing its surface of vulnerability. Reducing the surface of vulnerability typically includes removing unnecessary functions and features, removing unnecessary usernames or logins and disabling unnecessary services.

• Question 124:

  Which of the following should be implemented to stop an attacker from mapping out addresses and/or devices on a network?

  A. Single sign on
  B. IPv6
  C. Secure zone transfers
  D. VoIP
  C. Secure zone transfers

  ---

  C: A primary DNS server has the "master copy" of a zone, and secondary DNS servers keep copies of the zone for redundancy. When changes are made to zone data on the primary DNS server, these changes must be distributed to the secondary DNS servers for the zone. This is done through zone transfers. If you allow zone transfers to any server, all the resource records in the zone are viewable by any host that can contact your DNS server. Thus you will need to secure the zone transfers to stop an attacker from mapping out your addresses and devices on your network.

• Question 125:

  In an effort to test the effectiveness of an organization's security awareness training, a penetrator tester crafted an email and sent it to all of the employees to see how many of them clicked on the enclosed links. Which of the following is being tested?

  A. How many employees are susceptible to a SPAM attack
  B. How many employees are susceptible to a cross-site scripting attack
  C. How many employees are susceptible to a phishing attack
  D. How many employees are susceptible to a vishing attack
  A. How many employees are susceptible to a SPAM attack

• Question 126:

  An administrator needs to renew a certificate for a web server. Which of the following should be submitted to a CA?

  A. CSR
  B. Recovery agent
  C. Private key
  D. CRL
  A. CSR

  ---

  In public key infrastructure (PKI) systems, a certificate signing request (also CSR or certification request) is a message sent from an applicant to a certificate authority in order to apply for a digital identity certificate. When you renew a certificate you send a CSR to the CA to get the certificate resigned.

• Question 127:

  A security administrator finds that an intermediate CA within the company was recently breached. The certificates held on this system were lost during the attack, and it is suspected that the attackers had full access to the system. Which of the following is the NEXT action to take in this scenario?

  A. Use a recovery agent to restore the certificates used by the intermediate CA
  B. Revoke the certificate for the intermediate CA
  C. Recover the lost keys from the intermediate CA key escrow
  D. Issue a new certificate for the root CA
  B. Revoke the certificate for the intermediate CA

• Question 128:

  Which of the following can Joe, a security administrator, implement on his network to capture attack details that are occurring while also protecting his production network?

  A. Security logs
  B. Protocol analyzer
  C. Audit logs
  D. Honeypot
  D. Honeypot

  ---

  A honeypot is a system whose purpose it is to be attacked. An administrator can watch and study the attack to research current attack methodologies.

  According to the Wepopedia.com, a Honeypot luring a hacker into a system has several main purposes:

  The administrator can watch the hacker exploit the vulnerabilities of the system, thereby learning where the system has weaknesses that need to be redesigned. The hacker can be caught and stopped while trying to obtain root access to the

  system. By studying the activities of hackers, designers can better create more secure systems that are potentially invulnerable to future hackers.

  There are two main types of honeypots:

  Production - A production honeypot is one used within an organization's environment to help mitigate risk.

  Research ?A research honeypot add value to research in computer security by providing a platform to study the threat.

• Question 129:

  Company XYZ recently salvaged company laptops and removed all hard drives, but the Chief Information Officer (CIO) is concerned about disclosure of confidential information. Which of the following is the MOST secure method to dispose of these hard drives?

  A. Degaussing
  B. Physical Destruction
  C. Lock up hard drives in a secure safe
  D. Wipe
  B. Physical Destruction

  ---

  The physical description of hard drives is the only secure means of disposing hard drives. This can include incineration, an acid bath, and crushing.

• Question 130:

  The security consultant is assigned to test a client's new software for security, after logs show targeted attacks from the Internet. To determine the weaknesses, the consultant has no access to the application program interfaces, code, or data structures. This is an example of which of the following types of testing?

  A. Black box
  B. Penetration
  C. Gray box
  D. White box
  A. Black box

  ---

  Black-box testing is a method of software testing that examines the functionality of an application without peering into its internal structures or workings. This method of test can be applied to virtually every level of software testing: unit,

  integration, system and acceptance. It typically comprises most if not all higher level testing, but can also dominate unit testing as well.

  Specific knowledge of the application's code/internal structure and programming knowledge in general is not required. The tester is aware of what the software is supposed to do but is not aware of how it does it. For instance, the tester is

  aware that a particular input returns a certain, invariable output but is not aware of how the software produces the output in the first place.