CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1461:

  A technician has deployed a new VPN concentrator. The device needs to authenticate users based on a backend directory service. Which of the following services could be run on the VPN concentrator to perform this authentication?

  A. Kerberos
  B. RADIUS
  C. GRE
  D. IPSec
  B. RADIUS

• Question 1462:

  A retail store uses a wireless network for its employees to access inventory from anywhere in the store. Due to concerns regarding the aging wireless network, the store manager has brought in a consultant to harden the network. During the site survey, the consultant discovers that the network was using WEP encryption. Which of the following would be the BEST course of action for the consultant to recommend?

  A. Replace the unidirectional antenna at the front of the store with an omni-directional antenna.
  B. Change the encryption used so that the encryption protocol is CCMP-based.
  C. Disable the network's SSID and configure the router to only access store devices based on MAC addresses.
  D. Increase the access point's encryption from WEP to WPA TKIP.
  B. Change the encryption used so that the encryption protocol is CCMP-based.

  ---

  CCMP is the standard encryption protocol for use with the WPA2 standard and is much more secure than the WEP protocol and TKIP protocol of WPA. CCMP provides the following security services:

  Data confidentiality; ensures only authorized parties can access the information Authentication; provides proof of genuineness of the user Access control in conjunction with layer management Incorrect Options:

  A: The antenna type deals with signal strength and direction. It will not have a bearing on whether technology is older.

  C: This option would "cloak" the network, not harden the network.

  D: WPA2, which uses CCMP as its standard encryption protocol, more secure than WPA- TKIP.

  Reference:

  http://en.wikipedia.org/wiki/CCMP

  http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access

  Stewart, James Michael, CompTIA Security+ Review Guide, Sybex, Indianapolis, 2014, pp.

  61, 63

• Question 1463:

  Ann, a sales manager, successfully connected her company-issued smartphone to the wireless network in her office without supplying a username/password combination. Upon disconnecting from the wireless network, she attempted to connect her personal tablet computer to the same wireless network and could not connect.

  Which of the following is MOST likely the reason?

  A. The company wireless is using a MAC filter.
  B. The company wireless has SSID broadcast disabled.
  C. The company wireless is using WEP.
  D. The company wireless is using WPA2.
  A. The company wireless is using a MAC filter.

  ---

  MAC filtering allows you to include or exclude computers and devices based on their MAC address.

• Question 1464:

  A company hires outside security experts to evaluate the security status of the corporate network. All of the company's IT resources are outdated and prone to crashing. The company requests that all testing be performed in a way which minimizes the risk of system failures. Which of the following types of testing does the company want performed?

  A. Penetration testing
  B. WAF testing
  C. Vulnerability scanning
  D. White box testing
  C. Vulnerability scanning

  ---

  Vulnerability scanning has minimal impact on network resource due to the passive nature of the scanning.

  A vulnerability scan is the process of scanning the network and/or I.T. infrastructure for threats and vulnerabilities. The threats and vulnerabilities are then evaluated in a risk assessment and the necessary actions taken to resolve and

  vulnerabilities. A vulnerability scan scans for known weaknesses such as missing patches or security updates.

  A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are

  important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers. Vulnerability scanning employs software that seeks out security flaws based on a

  database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to tighten the network's security.

• Question 1465:

  A security analyst informs the Chief Executive Officer (CEO) that a security breach has just occurred. This results in the Risk Manager and Chief Information Officer (CIO) being caught unaware when the CEO asks for further information. Which of the following strategies should be implemented to ensure the Risk Manager and CIO are not caught unaware in the future?

  A. Procedure and policy management
  B. Chain of custody management
  C. Change management
  D. Incident management
  D. Incident management

  ---

  incident management refers to the steps followed when events occur (making sure controls are in place to prevent unauthorized access to, and changes of, all IT assets). The events that could occur include security breaches.

• Question 1466:

  Which of the following attacks initiates a connection by sending specially crafted packets in which multiple TCP flags are set to 1?

  A. Replay
  B. Smurf
  C. Xmas
  D. Fraggle
  C. Xmas

• Question 1467:

  A security analyst is reviewing firewall logs while investigating a compromised web server.

  The following ports appear in the log:

  22, 25, 445, 1433, 3128, 3389, 6667

  Which of the following protocols was used to access the server remotely?

  A. LDAP
  B. HTTP
  C. RDP
  D. HTTPS
  C. RDP

  ---

  RDP uses TCP port 3389.

• Question 1468:

  Which of the following is a vulnerability associated with disabling pop-up blockers?

  A. An alert message from the administrator may not be visible
  B. A form submitted by the user may not open
  C. The help window may not be displayed
  D. Another browser instance may execute malicious code
  D. Another browser instance may execute malicious code

  ---

  Explanation: Pop-up blockers prevent websites from opening new browser windows without the users consent. These are often used for advertisements but can also be used to distribute malicious code.

• Question 1469:

  While responding to an incident on a new Windows server, the administrator needs to disable unused services. Which of the following commands can be used to see processes that are listening on a TCP port?

  A. IPCONFIG
  B. Netstat
  C. PSINFO
  D. Net session
  B. Netstat

• Question 1470:

  Which of the following solutions provides the most flexibility when testing new security controls prior to implementation?

  A. Trusted OS
  B. Host software baselining
  C. OS hardening
  D. Virtualization
  D. Virtualization

  ---

  Virtualization is used to host one or more operating systems in the memory of a single host computer and allows multiple operating systems to run simultaneously on the same hardware. Virtualization offers the flexibility of quickly and easily making backups of entire virtual systems, and quickly recovering the virtual system when errors occur. Furthermore, malicious code compromises of virtual systems rarely affect the host system, which allows for safer testing and experimentation.