CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1341:

  Which of the following would BEST deter an attacker trying to brute force 4-digit PIN numbers to access an account at a bank teller machine?

  A. Account expiration settings
  B. Complexity of PIN
  C. Account lockout settings
  D. PIN history requirements
  C. Account lockout settings

  ---

  Account lockout settings determine the number of failed login attempts before the account gets locked and how long the account will be locked out for. For example, an account can be configured to lock if three incorrect passwords (or in this case PIN's) are entered. The account can then be configured to automatically unlock after a period of time or stay locked until someone manually unlocks it.

• Question 1342:

  A security team has established a security awareness program. Which of the following would BEST prove the success of the program?

  A. Policies
  B. Procedures
  C. Metrics
  D. Standards
  C. Metrics

  ---

  All types of training should be followed up- be tested to see if it worked and how much was learned in the training process. You must follow up and gather training metrics to validate compliance and security posture. By training metrics, we mean some quantifiable method for determining the efficacy of training.

• Question 1343:

  A company recently received accreditation for a secure network, In the accreditation letter, the auditor specifies that the company must keep its security plan current with changes in the network and evolve the systems to adapt to new threats. Which of the following security controls will BEST achieve this goal?

  A. Change management
  B. Group Policy
  C. Continuous monitoring
  D. Credential management
  D. Credential management

• Question 1344:

  Which of the following is a notification that an unusual condition exists and should be investigated?

  A. Alert
  B. Trend
  C. Alarm
  D. Trap
  A. Alert

  ---

  We need to look carefully at the wording of the question to determine the answer. This question is asking about an "unusual condition" that should be investigated. There are different levels of alerts from Critical to Warning to Information only. An Alarm would be triggered by a serious definite problem that needs resolving urgently. An "unusual condition" probably wouldn't trigger an alarm; it is more likely to trigger an Alert.

• Question 1345:

  Ann a member of the Sales Department has been issued a company-owned laptop for use when traveling to remote sites. Which of the following would be MOST appropriate when configuring security on her laptop?

  A. Configure the laptop with a BIOS password
  B. Configure a host-based firewall on the laptop
  C. Configure the laptop as a virtual server
  D. Configure a host based IDS on the laptop
  A. Configure the laptop with a BIOS password

• Question 1346:

  During which of the following phases of the Incident Response process should a security administrator define and implement general defense against malware?

  A. Lessons Learned
  B. Preparation
  C. Eradication
  D. Identification
  B. Preparation

  ---

  Incident response procedures involves: Preparation; Incident identification; Escalation and notification; Mitigation steps; Lessons learned; Reporting; Recover/reconstitution procedures; First responder; Incident isolation (Quarantine; Device removal); Data breach; Damage and loss control. It is important to stop malware before it ever gets hold of a system 璽hus you should know which malware is out there and take defensive measures - this means preparation to guard against malware infection should be done.

• Question 1347:

  A risk assessment team is concerned about hosting data with a cloud service provider (CSP) which of the following findings would justify this concern?

  A. The CPS utilizes encryption for data at rest and in motion
  B. The CSP takes into account multinational privacy concerns
  C. The financial review indicates the company is a startup
  D. SLA state service tickets will be resolved in less than 15 minutes
  B. The CSP takes into account multinational privacy concerns

• Question 1348:

  A user of the wireless network is unable to gain access to the network. The symptoms are:

  1.) Unable to connect to both internal and Internet resources

  2.) The wireless icon shows connectivity but has no network access

  The wireless network is WPA2 Enterprise and users must be a member of the wireless security group to authenticate. Which of the following is the MOST likely cause of the connectivity issues?

  A. The wireless signal is not strong enough
  B. A remote DDoS attack against the RADIUS server is taking place
  C. The user's laptop only supports WPA and WEP
  D. The DHCP scope is full
  E. The dynamic encryption key did not update while the user was offline
  A. The wireless signal is not strong enough

• Question 1349:

  A recent intrusion has resulted in the need to perform incident response procedures. The incident response team has identified audit logs throughout the network and organizational systems which hold details of the security breach. Prior to this incident, a security consultant informed the company that they needed to implement an NTP server on the network. Which of the following is a problem that the incident response team will likely encounter during their assessment?

  A. Chain of custody
  B. Tracking man hours
  C. Record time offset
  D. Capture video traffic
  C. Record time offset

  ---

  It is quite common for workstation as well as server times to be off slightly from actual time. Since a forensic investigation is usually dependent on a step-by-step account of what has happened, being able to follow events in the correct time sequence is critical. Because of this, it is imperative to record the time offset on each affected machine during the investigation. One method of assisting with this is to add an entry to a log file and note the time that this was done and the time associated with it on the system. There is no mention that this was done by the incident response team.

• Question 1350:

  A consultant has been tasked to assess a client's network. The client reports frequent network outages. Upon viewing the spanning tree configuration, the consultant notices that an old and law performing edge switch on the network has been elected to be the root bridge. Which of the following explains this scenario?

  A. The switch also serves as the DHCP server
  B. The switch has the lowest MAC address
  C. The switch has spanning tree loop protection enabled
  D. The switch has the fastest uplink port
  C. The switch has spanning tree loop protection enabled