CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1361:

  Several users' computers are no longer responding normally and sending out spam email to the users' entire contact list. This is an example of which of the following?

  A. Trojan virus
  B. Botnet
  C. Worm outbreak
  D. Logic bomb
  C. Worm outbreak

  ---

  A worm is similar to a virus but is typically less malicious. A virus will usually cause damage to the system or files whereas a worm will usually just spread itself either using the network or by sending emails.

  A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. Unlike

  a computer virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a

  targeted computer.

• Question 1362:

  Select the appropriate attack from each drop down list to label the corresponding illustrated attack Instructions: Attacks may only be used once, and will disappear from drop down list if selected. When you have completed the simulation, please select the Done button to submit.

  Hot Area:

  

  

  ---

  1: Spear phishing is an e-mail spoofing fraud attempt that targets a specific organization,seeking unauthorized access to confidential data. As with the e-mail messages used in regular phishing expeditions, spear phishing messages appear to

  come from a trusted source. Phishing messages usually appear to come from a large and well-known company or Web site with a broad membership base, such as eBay or PayPal. In the case of spear phishing, however, the apparent source

  of the e-mail is likely to be an individual within the recipient's own company and generally someone in a position of authority.

  2: The Hoax in this question is designed to make people believe that the fake AV (antivirus) software is genuine.

  3: Vishing is the act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft. The scammer usually pretends to be a legitimate business, and fools the victim into thinking he

  or she will profit.

  4: Phishing is the act of sending an email to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft.

  Phishing email will direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers, that the legitimate organization already has. The website,

  however, is bogus and set up only to steal the information the user enters on the page.

  5: Similar in nature to e-mail phishing, pharming seeks to obtain personal or private (usually financial related) information through domain spoofing. Rather than being spammed with malicious and mischievous e-mail requests for you to visit

  spoof Web sites which appear legitimate, pharming 'poisons' a DNS server by infusing false information into the DNS server, resulting in a user's request being redirected elsewhere. Your browser, however will show you are at the correct

  Web site, which makes pharming a bit more serious and more difficult to detect. Phishing attempts to scam people one at a time with an e-mail while pharming allows the scammers to target large groups of people at one time through domain

  spoofing.

  References:

  http://searchsecurity.techtarget.com/definition/spear-phishing

  http://www.webopedia.com/TERM/V/vishing.html

  http://www.webopedia.com/TERM/P/phishing.html

  http://www.webopedia.com/TERM/P/pharming.html

• Question 1363:

  Sara, an employee, tethers her smartphone to her work PC to bypass the corporate web security gateway while connected to the LAN. While Sara is out at lunch her PC is compromised via the tethered connection and corporate data is stolen. Which of the following would BEST prevent this from occurring again?

  A. Disable the wireless access and implement strict router ACLs.
  B. Reduce restrictions on the corporate web security gateway.
  C. Security policy and threat awareness training.
  D. Perform user rights and permissions reviews.
  C. Security policy and threat awareness training.

  ---

  BYOD (In this case Sara's smart phone) involves the possibility of a personal device that is infected with malware introducing that malware to the network and security awareness training will address the issue of the company's security policy with regard to BYOD.

• Question 1364:

  Joe is a helpdesk specialist. During a routine audit, a company discovered that his credentials were used while he was on vacation. The investigation further confirmed that Joe still has his badge and it was last used to exit the facility. Which of the following access control methods is MOST appropriate for preventing such occurrences in the future?

  A. Access control where the credentials cannot be used except when the associated badge is in the facility
  B. Access control where system administrators may limit which users can access their systems
  C. Access control where employee's access permissions is based on the job title
  D. Access control system where badges are only issued to cleared personnel
  A. Access control where the credentials cannot be used except when the associated badge is in the facility

• Question 1365:

  A security architect wishes to implement a wireless network with connectivity to the company's internal network. Before they inform all employees that this network is being put in place, the architect wants to roll it out to a small test segment. Which of the following allows for greater secrecy about this network during this initial phase of implementation?

  A. Disabling SSID broadcasting
  B. Implementing WPA2 - TKIP
  C. Implementing WPA2 - CCMP
  D. Filtering test workstations by MAC address
  A. Disabling SSID broadcasting

  ---

  Network administrators may choose to disable SSID broadcast to hide their network from unauthorized personnel. However, the SSID is still needed to direct packets to and from the base station, so it's a discoverable value using a wireless packet sniffer. Thus, the SSID should be disabled if the network isn't for public use.

• Question 1366:

  Malware that changes its binary pattern on specific dates at specific times to avoid detection is known as a (n):

  A. armored virus
  B. logic bomb
  C. polymorphic virus
  D. Trojan
  C. polymorphic virus

• Question 1367:

  Which of the following devices is BEST suited to protect an HTTP-based application that is susceptible to injection attacks?

  A. Protocol filter
  B. Load balancer
  C. NIDS
  D. Layer 7 firewall
  D. Layer 7 firewall

  ---

  An application-level gateway firewall filters traffic based on user access, group membership, the application or service used, or even the type of resources being transmitted. This type of firewall operates at the Application layer (Layer 7) of the OSI model.

• Question 1368:

  A technician is investigating intermittent switch degradation. The issue only seems to occur when the building's roof air conditioning system runs. Which of the following would reduce the connectivity issues?

  A. Adding a heat deflector
  B. Redundant HVAC systems
  C. Shielding
  D. Add a wireless network
  C. Shielding

  ---

  EMI can cause circuit overload, spikes, or even electrical component failure. In the question it is mentioned that switch degradation occurs when the building's roof air- conditioning system is also running. All electromechanical systems emanate EMI. Thus you could alleviate the problem using EMI shielding.

• Question 1369:

  In the case of a major outage or business interruption, the security office has documented the expected loss of earnings, potential fines and potential consequence to customer service. Which of the following would include the MOST detail on these objectives?

  A. Business Impact Analysis
  B. IT Contingency Plan
  C. Disaster Recovery Plan
  D. Continuity of Operations
  A. Business Impact Analysis

  ---

  Business impact analysis (BIA) is the process of evaluating all of the critical systems in an organization to define impact and recovery plans. BIA isn't concerned with external threats or vulnerabilities; the analysis focuses on the impact a loss would have on the organization. A BIA comprises the following: identifying critical functions, prioritizing critical business functions, calculating a timeframe for critical systems loss, and estimating the tangible impact on the organization.

• Question 1370:

  To protect corporate data on removable media, a security policy should mandate that all removable devices use which of the following?

  A. Full disk encryption
  B. Application isolation
  C. Digital rights management
  D. Data execution prevention
  A. Full disk encryption

  ---

  Full-disk encryption encrypts the data on the hard drive of the device or on a removable drive. This feature ensures that the data on the device or removable drive cannot be accessed in a useable form should it be stolen.