CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1371:

  Which of the following concepts is BEST described as developing a new chain of command in the event of a contingency?

  A. Business continuity planning
  B. Continuity of operations
  C. Business impact analysis
  D. Succession planning
  D. Succession planning

  ---

  Succession planning outlines those internal to the organization who have the ability to step into positions when they open. By identifying key roles that cannot be left unfilled and associating internal employees who can step into these roles, you can groom those employees to make sure that they are up to speed when it comes time for them to fill those positions.

• Question 1372:

  An administrator connects VoIP phones to the same switch as the network PCs and printers. Which of the following would provide the BEST logical separation of these three device types while still allowing traffic between them via ACL?

  A. Create three VLANs on the switch connected to a router
  B. Define three subnets, configure each device to use their own dedicated IP address range, and then connect the network to a router
  C. Install a firewall and connect it to the switch
  D. Install a firewall and connect it to a dedicated switch for each device type
  A. Create three VLANs on the switch connected to a router

  ---

  A virtual local area network (VLAN) is a hardware-imposed network segmentation created by switches. VLANs are used for traffic management. Communications between ports within the same VLAN occur without hindrance, but communications between VLANs require a routing function.

• Question 1373:

  Each server on a subnet is configured to only allow SSH access from the administrator's workstation. Which of the following BEST describes this implementation?

  A. Host-based firewalls
  B. Network firewalls
  C. Network proxy
  D. Host intrusion prevention
  A. Host-based firewalls

  ---

  A host-based firewall is installed on a client system and is used to protect the client system from the activities of the user as well as from communication from the network or Internet. These firewalls manage network traffic using filters to block certain ports and protocols while allowing others to pass through the system.

• Question 1374:

  A technician has just installed a new firewall onto the network. Users are reporting that they cannot reach any website. Upon further investigation, the technician determines that websites can be reached by entering their IP addresses. Which of the following ports may have been closed to cause this issue?

  A. HTTP
  B. DHCP
  C. DNS
  D. NetBIOS
  C. DNS

  ---

  DNS links IP addresses and human-friendly fully qualified domain names (FQDNs), which are made up of the Top-level domain (TLD), the registered domain name, and the Subdomain or hostname. Therefore, if the DNS ports are blocked websites will not be reachable.

• Question 1375:

  Configuring the mode, encryption methods, and security associations are part of which of the following?

  A. IPSec
  B. Full disk encryption
  C. 802.1x
  D. PKI
  A. IPSec

  ---

  IPSec can operate in tunnel mode or transport mode. It uses symmetric cryptography to provide encryption security. Furthermore, it makes use of Internet Security Association and Key Management Protocol (ISAKMP).

• Question 1376:

  A thief has stolen mobile device and removed its battery to circumvent GPS location tracking. The device user is a four digit PIN. Which of the following is a mobile device security control that ensures the confidentiality of company data?

  A. Remote wiping
  B. Mobile Access control
  C. Full device encryption
  D. Inventory control
  C. Full device encryption

• Question 1377:

  Sara, a security manager, has decided to force expiration of all company passwords by the close of business day. Which of the following BEST supports this reasoning?

  A. A recent security breach in which passwords were cracked.
  B. Implementation of configuration management processes.
  C. Enforcement of password complexity requirements.
  D. Implementation of account lockout procedures.
  A. A recent security breach in which passwords were cracked.

  ---

  A password only needs to be changed if it doesn't meet the compliance requirements of the company's password policy, or is evidently insecure. It will also need to be changed if it has been reused, or due to possible compromise as a result of a system intrusion.

• Question 1378:

  A government agency wants to ensure that the systems they use have been deployed as security as possible. Which of the following technologies will enforce protections on these systems to prevent files and services from operating outside of a strict rule set?

  A. Host based Intrusion detection
  B. Host-based firewall
  C. Trusted OS
  D. Antivirus
  B. Host-based firewall

• Question 1379:

  A small company has recently purchased cell phones for managers to use while working outside if the office.

  The company does not currently have a budget for mobile device management and is primarily concerned with deterring leaks if sensitive information obtained by unauthorized access to unattended phones. Which of the following would

  provide the solution BEST meets the company's requirements?

  A. Screen-lock
  B. Disable removable storage
  C. Full device encryption
  D. Remote wiping
  A. Screen-lock

  ---

  Explanation: Screen-lock is a security feature that requires the user to enter a password after a short period of inactivity before they can access the system again. This feature ensures that if your device is left unattended or is lost or stolen, it will be difficult for anyone else to access your data or applications.

• Question 1380:

  An administrator is assigned to monitor servers in a data center. A web server connected to the Internet suddenly experiences a large spike in CPU activity. Which of the following is the MOST likely cause?

  A. Spyware
  B. Trojan
  C. Privilege escalation
  D. DoS
  D. DoS

  ---

  A Distributed Denial of Service (DDoS) attack is a DoS attack from multiple computers whereas a DoS attack is from a single computer. In terms of the actual method of attack, DDoS and DoS attacks are the same. One common method of attack involves saturating the target machine with external communications requests, so much so that it cannot respond to legitimate traffic, or responds so slowly as to be rendered essentially unavailable. Such attacks usually lead to a server overload. A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised systems (for example a botnet) flooding the targeted system with traffic. When a server is overloaded with connections, new connections can no longer be accepted. The major advantages to an attacker of using a distributed denial-of-service attack are that multiple machines can generate more attack traffic than one machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than the current volume of the attack might not help, because the attacker might be able to simply add more attack machines. This after all will end up completely crashing a website for periods of time. Malware can carry DDoS attack mechanisms; one of the better-known examples of this was MyDoom. Its DoS mechanism was triggered on a specific date and time. This type of DDoS involved hardcoding the target IP address prior to release of the malware and no further interaction was necessary to launch the attack.