CompTIA SY0-401 Online Practice Questions and Exam Preparation

CompTIA SY0-401 Online Questions & Answers

• Question 1471:

  A computer is put into a restricted VLAN until the computer's virus definitions are up-to- date.

  Which of the following BEST describes this system type?

  A. NAT
  B. NIPS
  C. NAC
  D. DMZ
  C. NAC

  ---

  Network Access Control (NAC) means controlling access to an environment through strict adherence to and implementation of security policies. The goals of NAC are to prevent/reduce zero-day attacks, enforce security policy throughout the network, and use identities to perform access control.

• Question 1472:

  Which of the following is true about PKI? (Select TWO).

  A. When encrypting a message with the public key, only the public key can decrypt it.
  B. When encrypting a message with the private key, only the private key can decrypt it.
  C. When encrypting a message with the public key, only the CA can decrypt it.
  D. When encrypting a message with the public key, only the private key can decrypt it.
  E. When encrypting a message with the private key, only the public key can decrypt it.
  D. When encrypting a message with the public key, only the private key can decrypt it.
  E. When encrypting a message with the private key, only the public key can decrypt it.

  ---

  E: You encrypt data with the private key and decrypt with the public key, though the opposite is much more frequent.

  Public-key cryptography, also known as asymmetric cryptography, is a class of cryptographic protocols based on algorithms that require two separate keys, one of which is secret (or private) and one of which is public. Although different, the

  two parts of this key pair are mathematically linked.

  D: In a PKI the sender encrypts the data using the receiver's public key. The receiver decrypts the data using his own private key.

  PKI is a two-key, asymmetric system with four main components: certificate authority (CA), registration authority (RA), RSA (the encryption algorithm), and digital certificates. Messages are encrypted with a public key and decrypted with a

  private key.

  A PKI example:

  You want to send an encrypted message to Jordan, so you request his public key.

  Jordan responds by sending you that key.

  You use the public key he sends you to encrypt the message.

  You send the message to him.

  Jordan uses his private key to decrypt the message.

• Question 1473:

  Which of the following is a security concern regarding users bringing personally-owned devices that they connect to the corporate network?

  A. Cross-platform compatibility issues between personal devices and server-based applications
  B. Lack of controls in place to ensure that the devices have the latest system patches and signature files
  C. Non-corporate devices are more difficult to locate when a user is terminated
  D. Non-purchased or leased equipment may cause failure during the audits of company- owned assets
  B. Lack of controls in place to ensure that the devices have the latest system patches and signature files

  ---

  With employees who want to bring their own devices you will have to make them understand why they cannot. You do not want them plugging in a flash drive, let alone a camera, smartphone, tablet computer, or other device, on which company fi les could get intermingled with personal files. Allowing this to happen can create situations where data can leave the building that shouldn't as well as introduce malware to the system. Employees should not sync unauthorized smartphones to their work systems. Some smartphones use multiple wireless spectrums and unwittingly open up the possibility for an attacker in the parking lot to gain access through the phone to the internal network. Thus if you do not have controls in place then your network is definitely at risk.

• Question 1474:

  The IT department has been tasked with reducing the risk of sensitive information being shared with unauthorized entities from computers it is saved on, without impeding the ability of the employees to access the internet. Implementing which of the following would be the best way to accomplish this objective?

  A. Host-based firewalls
  B. DLP
  C. URL filtering
  D. Pop-up blockers
  B. DLP

• Question 1475:

  A security engineer is asked by the company's development team to recommend the most secure method for password storage. Which of the following provide the BEST protection against brute forcing stored passwords? (Select TWO).

  A. PBKDF2
  B. MD5
  C. SHA2
  D. Bcrypt
  E. AES
  F. CHAP
  A. PBKDF2
  D. Bcrypt

  ---

  A: PBKDF2 (Password-Based Key Derivation Function 2) is part of PKCS #5 v. 2.01. It applies some function (like a hash or HMAC) to the password or passphrase along with Salt to produce a derived key.

  D: bcrypt is a key derivation function for passwords based on the Blowfish cipher. Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive function:

  over time, the iteration count can be increased to make it slower, so it remains resistant to brute-force search attacks even with increasing computation power. The bcrypt function is the default password hash algorithm for BSD and many

  other systems.

  References:

  Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis, 2014, pp. 109-110, 139, 143, 250, 255-256, 256

• Question 1476:

  Due to limited resources, a company must reduce their hardware budget while still maintaining availability. Which of the following would MOST likely help them achieve their objectives?

  A. Virtualization
  B. Remote access
  C. Network access control
  D. Blade servers
  A. Virtualization

  ---

  Because Virtualization allows a single set of hardware to host multiple virtual machines, it requires less hardware to maintain the current scenario.

• Question 1477:

  A system administrator is configuring shared secrets on servers and clients. Which of the following authentication services is being deployed by the administrator? (Select two.)

  A. Kerberos
  B. RADIUS
  C. TACACS+
  D. LDAP
  E. Secure LDAP
  B. RADIUS
  D. LDAP

• Question 1478:

  A company hosts a web server that requires entropy in encryption initialization and authentication. To meet this goal, the company would like to select a block cipher mode of operation that allows an arbitrary length IV and supports authenticated encryption. Which of the following would meet these objectives?

  A. CFB
  B. GCM
  C. ECB
  D. CBC
  C. ECB

• Question 1479:

  A network administrator has been tasked with securing the WLAN. Which of the following cryptographic products would be used to provide the MOST secure environment for the WLAN?

  A. WPA2 CCMP
  B. WPA
  C. WPA with MAC filtering
  D. WPA2 TKIP
  A. WPA2 CCMP

  ---

  CCMP is the standard encryption protocol for use with the WPA2 standard and is much more secure than the WEP protocol and TKIP protocol of WPA. CCMP provides the following security services: Data confidentiality; ensures only authorized parties can access the information Authentication; provides proof of genuineness of the user Access control in conjunction with layer management

  Because CCMP is a block cipher mode using a 128-bit key, it is secure against attacks to the 264 steps of operation.

• Question 1480:

  Several employees clicked on a link in a malicious message that bypassed the spam filter and their PCs were infected with malware as a result. Which of the following BEST prevents this situation from occurring in the future?

  A. Data loss prevention
  B. Enforcing complex passwords
  C. Security awareness training
  D. Digital signatures
  C. Security awareness training

  ---

  Security awareness and training include explaining policies, procedures, and current threats to both users and management. A security awareness and training program can do much to assist in your efforts to improve and maintain security. Ideally, a security awareness training program for the entire organization should cover the following areas: Importance of security Responsibilities of people in the organization Policies and procedures Usage policies Account and password-selection criteria Social engineering prevention