CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1321:

  Computer evidence at a crime is preserved by making an exact copy of the hard disk. Which of the following does this illustrate?

  A. Taking screenshots
  B. System image capture
  C. Chain of custody
  D. Order of volatility
  B. System image capture

  ---

  A system image would be a snapshot of what exists at the moment. Thus capturing an image of the operating system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it.

• Question 1322:

  A malicious user has collected the following list of information:

  192.168.1.5 OpenSSH-Server_5.8

  192.168.1.7 OpenSSH-Server_5.7

  192.168.1.9 OpenSSH-Server_5.7

  Which of the following techniques is MOST likely to gather this type of data?

  A. Banner grabbing
  B. Port scan
  C. Host scan
  D. Ping scan
  B. Port scan

• Question 1323:

  Which of the following implementation steps would be appropriate for a public wireless hot- spot?

  A. Reduce power level
  B. Disable SSID broadcast
  C. Open system authentication
  D. MAC filter
  C. Open system authentication

  ---

  For a public wireless hot-spot, you want members of the public to be able to access the wireless network without having to provide them with a password. Therefore, Open System Authentication is the best solution.

  Open System Authentication (OSA) is a process by which a computer can gain access to a wireless network that uses the Wired Equivalent Privacy (WEP) protocol. With OSA, a computer equipped with a wireless modem can access any WEP network and receive files that are not encrypted. For OSA to work, the service set identifier (SSID) of the computer should match the SSID of the wireless access point. The SSID is a sequence of characters that uniquely names a wireless local area network (WLAN). The process occurs in three steps. First, the computer sends a request for authentication to the access point. Then the access point generates an authentication code, usually at random, intended for use only during that session. Finally, the computer accepts the authentication code and becomes part of the network as long as the session continues and the computer remains within range of the original access point. If it is necessary to exchange encrypted data between a WEP network access point and a wireless-equipped computer, a stronger authentication process called Shared Key Authentication (SKA) is required.

• Question 1324:

  A resent OS patch caused an extended outage. It took the IT department several hours to uncover the cause of the issue due to the system owner who installed the patch being out of the office. Which of the following could help reduce the likelihood of this situation occurring in the future?

  A. Separation of duties
  B. Change management procedures
  C. Incident management procedures
  D. User rights audits and reviews
  B. Change management procedures

• Question 1325:

  A forensics analyst is tasked identifying identical files on a hard drive. Due to the large number of files to be compared, the analyst must use an algorithm that is known to have the lowest collision rate. Which of the following should be selected?

  A. MD5
  B. RC4
  C. SHA-128
  D. AES-256
  C. SHA-128

• Question 1326:

  A system administrator is implementing a firewall ACL to block specific communication to and from a predefined list of IP addresses, while allowing all other communication. Which of the following rules is necessary to support this

  implementation?

  A. Implicit allow as the last rule
  B. Implicit allow as the first rule
  C. Implicit deny as the first rule
  D. Implicit deny as the last rule
  C. Implicit deny as the first rule

• Question 1327:

  The Chief Information Officer (CIO) receives an anonymous threatening message that says "beware of the 1st of the year". The CIO suspects the message may be from a former disgruntled employee planning an attack. Which of the following should the CIO be concerned with?

  A. Smurf Attack
  B. Trojan
  C. Logic bomb
  D. Virus
  C. Logic bomb

  ---

  A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files should they

  ever be terminated from the company.

  Software that is inherently malicious, such as viruses and worms, often contain logic bombs that execute a certain payload at a pre-defined time or when some other condition is met. This technique can be used by a virus or worm to gain

  momentum and spread before being noticed. Some viruses attack their host systems on specific dates, such as Friday the 13th or April Fool's Day. Trojans that activate on certain dates are often called "time bombs".

  To be considered a logic bomb, the payload should be unwanted and unknown to the user of the software. As an example, trial programs with code that disables certain functionality after a set time are not normally regarded as logic bombs.

• Question 1328:

  A database administrator would like to start encrypting database exports stored on the SAN, but the storage administrator warns that this may drastically increase the amount of disk space used by the exports. Which of the following explains the reason for the increase in disk space usage?

  A. Deduplication is not compatible with encryption
  B. The exports are being stored on smaller SAS drives
  C. Encrypted files are much larger than unencrypted files
  D. The SAN already uses encryption at rest
  C. Encrypted files are much larger than unencrypted files

  ---

  Encryption adds overhead to the data which results in and increase in file size. This overhead is attached to each file and could include the encryption/decryption key, data recovery files and data decryption field in file header. As a result, requires increased storage space.

• Question 1329:

  Pete, an IT Administrator, needs to secure his server room. Which of the following mitigation methods would provide the MOST physical protection?

  A. Sign in and sign out logs
  B. Mantrap
  C. Video surveillance
  D. HVAC
  B. Mantrap

  ---

  Mantraps are designed to contain an unauthorized, potentially hostile person/individual physically until authorities arrive. Mantraps are typically manufactured with bulletproof glass, high-strength doors, and locks and to allow the minimal amount of individuals depending on its size. Some mantraps even include scales that will weigh the person. The doors are designed in such a way as to open only when the mantrap is occupied or empty and not in-between. This means that the backdoor must first close before the front door will open. Mantraps are in most cases also combined with guards. This is the most physical protection any one measure will provide.

• Question 1330:

  Which of the following steps in incident response procedures entails of the incident and identification of knowledge gained that can be applied to future handling of incidents?

  A. Recovery procedures
  B. Escalation and notification
  C. Reporting
  D. Lessons learned
  D. Lessons learned