CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1351:

  An administrator has two servers and wants them to communicate with each other using a secure algorithm. Which of the following choose to provide both CRC integrity checks and RCA encryption?

  A. NTLM
  B. RSA
  C. CHAP
  D. ECDHE
  D. ECDHE

  ---

  ECDHE provides both CRC integrity checks and RCA encryption. Adding an ephemeral key to Elliptic Curve Diffie-Hellman turns it into ECDHE. It is the ephemeral component of each of these that provides the perfect forward secrecy. Forward secrecy is a property of any key exchange system, which ensures that if one key is compromised, subsequent keys will not also be compromised. Perfect forward secrecy occurs when this process is unbreakable.

• Question 1352:

  Which of the following is a control that allows a mobile application to access and manipulate information which should only be available by another application on the same mobile device (e.g. a music application posting the name of the current song playing on the device on a social media site)?

  A. Co-hosted application
  B. Transitive trust
  C. Mutually exclusive access
  D. Dual authentication
  B. Transitive trust

  ---

  Transitive trust is a form of trust that flows from one entity to another so that if A trusts B and B trusts C, A automatically trusts C.

• Question 1353:

  Ann, the Chief Technology Officer (CTO), has agreed to allow users to bring their own device (BYOD) in order to leverage mobile technology without providing every user with a company owned device. She is concerned that users may not understand the company's rules, and she wants to limit potential legal concerns. Which of the following is the CTO concerned with?

  A. Data ownership
  B. Device access control
  C. Support ownership
  D. Acceptable use
  A. Data ownership

  ---

  Issues of limiting potential legal concerns regarding company rules where users are allowed to bring their own devices is the premise of data ownership. When a third party (in this case the user's own device) is involves in a data exchange when clear rules and restrictions should be applied regarding data ownership.

• Question 1354:

  The string:

  ` or 1=1--

  Represents which of the following?

  A. Bluejacking
  B. Rogue access point
  C. SQL Injection
  D. Client-side attacks
  C. SQL Injection

  ---

  The code in the question is an example of a SQL Injection attack. The code `1=1' will always provide a value of true. This can be included in statement designed to return all rows in a SQL table.

  SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

• Question 1355:

  The chief security officer (CSO) has reported a rise in data loss but no break-ins have occurred. By doing which of the following would the CSO MOST likely to reduce the number of incidents?

  A. Implement protected distribution
  B. Employ additional firewalls
  C. Conduct security awareness training
  D. Install perimeter barricades
  C. Conduct security awareness training

• Question 1356:

  Users are encouraged to click on a link in an email to obtain exclusive access to the newest version of a popular Smartphone. This is an example of.

  A. Scarcity
  B. Familiarity
  C. Intimidation
  D. Trust
  A. Scarcity

  ---

  Scarcity, in the area of social psychology, works much like scarcity in the area of economics. Simply put, humans place a higher value on an object that is scarce, and a lower value on those that are abundant. The thought that we, as humans, want something we cannot have drives us to desire the object even more. This idea is deeply embedded in the intensely popular, "Black Friday" shopping extravaganza that U.S. consumers participate in every year on the day after Thanksgiving. More than getting a bargain on a hot gift idea, shoppers thrive on the competition itself, in obtaining the scarce product.

  In this question, people want the brand new latest version of a smartphone. The temptation of being one of the first to get the new phone will tempt people into clicking the link in the email.

• Question 1357:

  Several bins are located throughout a building for secure disposal of sensitive information. Which of the following does this prevent?

  A. Dumpster diving
  B. War driving
  C. Tailgating
  D. War chalking
  A. Dumpster diving

  ---

  The bins in this question will be secure bins designed to prevent someone accessing the `rubbish' to learn sensitive information. Dumpster diving is looking for treasure in someone else's trash. (A dumpster is a large trash container.) In the world of information technology, dumpster diving is a technique used to retrieve information that could be used to carry out an attack on a computer network. Dumpster diving isn't limited to searching through the trash for obvious treasures like access codes or passwords written down on sticky notes. Seemingly innocent information like a phone list, calendar, or organizational chart can be used to assist an attacker using social engineering techniques to gain access to the network. To prevent dumpster divers from learning anything valuable from your trash, experts recommend that your company establish a disposal policy where all paper, including print-outs, is shredded in a cross-cut shredder before being recycled, all storage media is erased, and all staff is educated about the danger of untracked trash.

• Question 1358:

  A security analyst has been tasked with securing a guest wireless network. They recommend the company use an authentication server but are told the funds are not available to set this up. Which of the following BEST allows the analyst to restrict user access to approved devices?

  A. Antenna placement
  B. Power level adjustment
  C. Disable SSID broadcasting
  D. MAC filtering
  D. MAC filtering

  ---

  A MAC filter is a list of authorized wireless client interface MAC addresses that is used by a WAP to block access to all unauthorized devices.

• Question 1359:

  A user tries to visit a web site with a revoked certificate. In the background a server from the certificate authority only sends the browser revocation information about the domain the user is visiting. Which of the following is being used by the certificate authority in this exchange?

  A. CSR
  B. Key escrow
  C. OCSP
  D. CRL
  D. CRL

• Question 1360:

  Matt, a security analyst, needs to implement encryption for company data and also prevent theft of company data. Where and how should Matt meet this requirement?

  A. Matt should implement access control lists and turn on EFS.
  B. Matt should implement DLP and encrypt the company database.
  C. Matt should install Truecrypt and encrypt the company server.
  D. Matt should install TPMs and encrypt the company database.
  B. Matt should implement DLP and encrypt the company database.

  ---

  Data loss prevention (DLP) systems monitor the contents of systems (workstations, servers, and networks) to make sure that key content is not deleted or removed. They also monitor who is using the data (looking for unauthorized access)

  and transmitting the data.

  Encryption is used to protect data.