CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1431:

  A security analyst performs the following activities: monitors security logs, installs surveillance cameras and analyzes trend reports. Which of the following job responsibilities is the analyst performing? (Select TWO).

  A. Detect security incidents
  B. Reduce attack surface of systems
  C. Implement monitoring controls
  D. Hardening network devices
  E. Prevent unauthorized access
  A. Detect security incidents
  C. Implement monitoring controls

  ---

  By monitoring security logs, installing security cameras and analyzing trend reports, the security analyst is implementing monitoring controls. With the monitoring controls in place, by monitoring the security logs, reviewing the footage from the security cameras and analyzing trend reports, the security analyst is able to detect security incidents.

• Question 1432:

  A company is investigating a data compromise where data exfiltration occurred. Prior to the investigation, the supervisor terminates an employee as a result of the suspected data loss. During the investigation, the supervisor is absent for the interview, and little evidence can be provided form the role-based authentication system in use by the company. The situation can be identified for future mitigation as which of the following?

  A. Job rotation
  B. Log failure
  C. Lack of training
  D. Insider threat
  B. Log failure

• Question 1433:

  Joe a technician initiated scans if the company's 10 routers and discovered that half if the routers were not changed from their default configuration prior installed on the network. Which of the following would address this?

  A. Secure router configuration
  B. Implementing 802.1x
  C. Enabling loop protection
  D. Configuring port security
  A. Secure router configuration

• Question 1434:

  Which of the following practices reduces the management burden of access management?

  A. Password complexity policies
  B. User account audit
  C. Log analysis and review
  D. Group based privileges
  D. Group based privileges

  ---

  Explanation: Granting permissions to all members of a group is quicker than individually assigning them to each user. This means an administrator will spend less time on assigning permissions to users who require the same access privileges.

• Question 1435:

  Which of the following types of application attacks would be used to specifically gain unauthorized information from databases that did not have any input validation implemented?

  A. SQL injection
  B. Session hijacking and XML injection
  C. Cookies and attachments
  D. Buffer overflow and XSS
  A. SQL injection

  ---

  To access information in databases, you use SQL. To gain unauthorized information from databases, a SQL Injection attack is used.

  SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

• Question 1436:

  Which of the following fire suppression systems is MOST likely used in a datacenter?

  A. FM-200
  B. Dry-pipe
  C. Wet-pipe
  D. Vacuum
  A. FM-200

  ---

  FM200 is a gas and the principle of a gas system is that it displaces the oxygen in the room, thereby removing this essential component of a fi re. in a data center is is the preferred choice of fire suppressant.

• Question 1437:

  Which of the following would a security administrator implement in order to discover comprehensive security threats on a network?

  A. Design reviews
  B. Baseline reporting
  C. Vulnerability scan
  D. Code review
  C. Vulnerability scan

  ---

  A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. Vulnerabilities include computer systems that do not have the latest security patches installed.

  The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and vulnerabilities.

  A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are

  important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a

  database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security. Vulnerability scanning typically refers to the

  scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software or malicious employees in an enterprise.

• Question 1438:

  Four weeks ago, a network administrator applied a new IDS and allowed it to gather baseline data. As rumors of a layoff began to spread, the IDS alerted the network administrator that access to sensitive client files had risen far above normal. Which of the following kind of IDS is in use?

  A. Protocol based
  B. Heuristic based
  C. Signature based
  D. Anomaly based
  D. Anomaly based

  ---

  Most intrusion detection systems (IDS) are what is known as signature-based. This means that they operate in much the same way as a virus scanner, by searching for a known identity - or signature - for each specific intrusion event. And,

  while signature-based IDS is very efficient at sniffing out known methods of attack, it does, like anti-virus software, depend on receiving regular signature updates, to keep in touch with variations in hacker technique. In other words, signature-

  based IDS is only as good as its database of stored signatures.

  Any organization wanting to implement a more thorough - and hence safer - solution, should consider what we call anomaly-based IDS. By its nature, anomaly-based IDS is a rather more complex creature. In network traffic terms, it captures

  all the headers of the IP packets running towards the network. From this, it filters out all known and legal traffic, including web traffic to the organization's web server, mail traffic to and from its mail server, outgoing web traffic from company

  employees and DNS traffic to and from its DNS server.

  There are other equally obvious advantages to using anomaly-based IDS. For example, because it detects any traffic that is new or unusual, the anomaly method is particularly good at identifying sweeps and probes towards network

  hardware. It can, therefore, give early warnings of potential intrusions, because probes and scans are the predecessors of all attacks. And this applies equally to any new service installed on any item of hardware - for example, Telnet

  deployed on a network router for maintenance purposes and forgotten about when the maintenance was finished. This makes anomaly-based IDS perfect for detecting anything from port anomalies and web anomalies to mis-formed attacks,

  where the URL is deliberately mis-typed.

• Question 1439:

  A periodic update that corrects problems in one version of a product is called a

  A. Hotfix
  B. Overhaul
  C. Service pack
  D. Security update
  C. Service pack

  ---

  A service pack is a collection of updates and hotfixes that address a number of software issues, as well as new software features. It is released periodically by the vendor.

• Question 1440:

  A security administrator wants to implement a company-wide policy to empower data owners to manage and enforce access control rules on various resources. Which of the following should be implemented?

  A. Mandatory access control
  B. Discretionary access control
  C. Role based access control
  D. Rule-based access control
  C. Role based access control